January 1, 2027: SB 26-189 applies. It repealed and reenacted SB 24-205, replacing the original impact-assessment and risk-program mandates with disclosure and consumer-rights duties. Enforcement sits with the Colorado Attorney General under the Colorado Consumer Protection Act, with penalties up to $20,000 per violation.
Step 1: Confirm you are covered
Now · 7 items- Confirmed your organization does business in Colorado (the law applies to deployers doing business in the state)
- Inventoried AI and automated decision-making technology (ADMT) used in decisions about consumers
- Identified which systems materially influence a consequential decision (outputs that constrain, rank, score, recommend, or classify)
- Mapped covered decision domains: employment, education, financial or lending services, housing, healthcare, insurance, and essential government services (the 2024 law's "legal services" category was not carried into the reenacted statute)
- Checked the statutory exclusions: advertising and product recommendations, search, content moderation, cybersecurity and anti-fraud tools, and tools that only summarize or organize information for human review
- Checked entity carve-outs: insurers subject to C.R.S. 10-3-1104.9 are deemed compliant, and HIPAA covered entities and business associates are excluded
- Documented your covered / not covered determination with supporting rationale
Step 2: Inventory and ownership
Now · 5 items- Created a complete inventory of covered ADMT and the consequential decisions each system influences
- Recorded whether each system was developed in-house or procured from a vendor
- Assigned a business owner accountable for each covered system
- Collected vendor documentation on how each system produces its outputs
- Recorded which consumer populations each system affects
Step 3: Consumer notice
Before January 1, 2027 · 4 items- Drafted consumer notices disclosing that ADMT is used in the decision
- Notice describes the decision being made and the role the ADMT plays
- Notice provides contact information for questions
- Tested notice delivery end to end for each covered decision
Step 4: Adverse decisions: explanation, correction, human review
Before January 1, 2027 · 5 items- Built a process to give consumers the reasons for an adverse decision the ADMT materially influenced
- Built a process for consumers to correct inaccurate personal data used in the decision
- Built a process for consumers to request human review of an adverse decision
- Trained the staff who will handle explanation, correction, and review requests
- Set response-time targets and logging for each request type
Step 5: Contracts and fault allocation
Before January 1, 2027 · 4 items- Reviewed developer and deployer contracts against C.R.S. 6-1-1707 (fault allocation in discrimination actions)
- Removed or flagged indemnity clauses that cover a party's own anti-discrimination violations (void by statute)
- Confirmed you receive the developer information you need to meet your own obligations
- Added Colorado AI Act requirements to procurement checklists for new ADMT
Step 6: Enforcement readiness
Recurring · 5 items- Documented compliance measures for AG enforcement (penalties up to $20,000 per violation under the Colorado Consumer Protection Act)
- Noted the cure provision: the AG may allow 60 days to cure if the AG deems a cure possible (provision repeals January 1, 2030)
- Assigned an owner to track Colorado AG rulemaking (formal rules not yet issued as of August 2026)
- Scheduled periodic review of the ADMT inventory against this checklist
- Trained relevant staff on the January 1, 2027 obligations and consumer rights
Go deeper on the Colorado AI Act
The regulation guide covers scope, exclusions, penalties, and the rulemaking status in detail. Providers working on Colorado compliance are listed in the register.
regulome.io/tools/colorado-ai-act-checklist · Colorado SB 26-189 · Applies January 1, 2027