Colorado's SB 26-189 replaced the repealed Colorado AI Act from 1 January 2027. It carries four duties where automated decision-making technology is used in a consequential decision: notice before it is used, a plain-language disclosure after an adverse outcome, meaningful human review on request, and records kept for three years.
Read as a list, it looks like a policy exercise. Three of the four are. The second is not, and it is the one that arrives late in every programme we see.
1. Notice before the decision
A person has to be told that automated decision-making technology is involved, before it is used on them.
This is the easiest duty to satisfy and the easiest to get subtly wrong, because notice has to be attached to the decision rather than to the company. A line in a privacy policy stating that the organisation uses automation somewhere is not notice that this application, in this flow, is being decided this way.
The practical question is which surfaces need to change: an application form, a portal, a letter, an IVR script, a broker's script. Usually more of them than the first inventory found.
2. The disclosure after an adverse outcome, which is the hard one
When the outcome goes against someone, they get a plain-language explanation of why.
Every part of that sentence is expensive. Plain-language rules out feature weights and model output. Why rules out a description of the process. And it has to be true of the decision that was actually made about that person, which rules out a generic paragraph about the factors the model considers.
What it requires in practice is that the system retains, at decision time, enough about that specific decision to reconstruct a human-readable reason later. That is a data-retention and instrumentation decision, taken by engineering, months before anyone reads the statute. Retrofitting it is the single most expensive remediation in this area, because the decisions already made cannot be explained after the fact — the information needed was never kept.
If you do one thing after reading this, check whether your decision path stores anything beyond the outcome.
3. Meaningful human review on request
A person can ask for a human to look again, and the review has to be meaningful.
The word "meaningful" is doing the same job here that "independent" does in an audit context: it rules out an arrangement that exists on paper. A reviewer who sees only the model's output and has no authority to depart from it is a rubber stamp, and a queue that routes every request back to the same automated result is the process failing while appearing to run.
Two structural questions decide it. Does the reviewer see the underlying case rather than the score? And has a reviewer ever actually overturned an outcome? A review function with no overturns in its history has not been exercised, and you do not yet know whether it works.
4. Three years of records
Records of the decisions, retained for three years.
Straightforward as a policy, and it interacts with the second duty in a way worth noticing: whatever you decided to retain in order to be able to explain a decision is also the thing you now have to keep, protect and be able to produce. The retention design and the explanation design are one design, and doing them separately produces either a gap or a data hoard.
5. What an engagement examines
The work against SB 26-189 is an audit — a state statute with duties, not a certification scheme.
It traces one real decision end to end: what the person was told before, what was stored at decision time, what could actually be said to them afterwards, what a review would have seen, and whether the record exists. A duty that cannot be evidenced on a single real case is not implemented, whatever the policy says. The scope is set out on the Colorado framework page.
These pages describe what an instrument requires and what an audit covers against it. They are scoping guidance, not legal advice — iDharma works alongside your counsel, not in place of them.
Three questions worth asking
Take yesterday's adverse decision. Can we say why, in a sentence a person would understand? If it takes an engineer and a database query, the duty is not built yet.
What does the system store at decision time? Outcome only, or enough to reconstruct a reason.
Has a human review ever changed an outcome? If never, the review is not yet meaningful in any sense that would survive being asked about.
Frequently asked questions
- When does Colorado SB 26-189 apply?
- It replaced the repealed Colorado AI Act from 1 January 2027. It applies where automated decision-making technology is used in a consequential decision about a person, and it carries four duties: notice before use, plain-language disclosure after an adverse outcome, meaningful human review on request, and three-year records.
- What counts as a plain-language disclosure?
- An explanation of why this decision went against this person, in language they can understand — not feature weights, not model output, and not a general description of the factors the system considers. In practice it requires that enough about the individual decision was retained at the time to reconstruct a human-readable reason later.
- What makes human review "meaningful"?
- A reviewer who sees the underlying case rather than only the model's output, and who has the authority to reach a different conclusion. A review function that has never overturned an outcome has not been exercised, and there is no evidence yet that it works.
- Is this the same as the old Colorado AI Act?
- No. The earlier Colorado AI Act was repealed and SB 26-189 replaced it from 1 January 2027, with a different structure — disclosure and review duties around consequential automated decisions rather than the developer and deployer duty scheme the earlier act carried.
