Colorado Gov. Jared Polis signed Senate Bill 26-189 in May, repealing the state's 2024 AI Act before it took effect and replacing it with a disclosure-based law that drops many of the original compliance mandates. The revised statute, scheduled to take effect Jan. 1, 2027, still covers automated decision-making technology used in consequential decisions - a definition broad enough to capture analytics tools many companies don't think of as AI.
Enforcement remains on hold pending rulemaking by the Colorado attorney general and litigation over the law's constitutionality, according to an analysis by McDermott Will & Emery. That leaves businesses preparing for obligations that may shift as the rulemaking clarifies key definitions.
What counts as automated decision-making technology
The statute defines ADMT as technology that processes personal data to generate predictions, scores, rankings or recommendations that help make or influence decisions about individuals. That captures many automated analytics tools organizations may not traditionally label as AI.
Routine technologies sit outside the law: antivirus software, firewalls, databases, conventional spreadsheets that don't use machine learning, tools used only to summarize or organize information for human review, and consumer chatbots that aren't marketed or configured to make consequential decisions. Whether a technology is covered depends largely on how it is used. Lawyers tracking state AI regulation through resources such as AI for Legal will need to audit which of their systems fall under that functional test.
When a decision is "consequential"
A consequential decision materially affects a person's access to employment, housing, education, credit, insurance, healthcare or essential government services, including pricing and other significant terms. Routine scheduling, administrative workflows, advertising, customer-service triage, cybersecurity, fraud prevention and financial-crime compliance systems generally fall outside the statute's scope.
McDermott's analysis draws the line this way: if a system uses personal data to generate recommendations or scores that meaningfully influence major decisions about an individual's job, housing or access to financial services, it is likely subject to the law.
Fewer mandates, new disclosure duties
The original statute would have required written risk-management programs, algorithmic impact assessments and periodic reviews designed to prevent discriminatory outcomes. Those provisions are gone. Organizations must instead focus on consumer notice, transparency and documentation surrounding covered ADMT.
Deployers must notify individuals when they interact with covered systems. If an adverse consequential decision is made, consumers must receive an explanation of the technology's role in the decision and an opportunity for meaningful human review. Individuals also gain rights to access and correct personal data used in covered decisions.
Adding another layer, the FTC recently issued a proposed policy statement expressing concern that certain state AI laws, including Colorado's, could create deception issues under Section 5 of the FTC Act. The proposal would not preempt Colorado law or change existing compliance obligations, but McDermott says it underscores growing tension between state AI regulation and federal consumer protection policy.
McDermott recommends companies begin preparing now by inventorying AI and other automated decision-making tools, paying particular attention to employment-related systems. That includes developing required notice and human-review procedures, documenting intended and inappropriate uses of covered technologies, and monitoring the attorney general's rulemaking. Legal and compliance staff tracking this rulemaking process can work through the AI Learning Path for Regulatory Affairs Specialists, which covers the regulatory compliance and risk monitoring work Colorado's law demands.
Why this matters for legal professionals
For legal teams, Colorado's shift from prescriptive risk-management paperwork to disclosure duties doesn't reduce exposure - it changes where liability sits. The ADMT definition reaches into HR, finance and marketing systems, so waiting for the attorney general to finalize definitions means auditing under deadline pressure. Employment-related tools deserve immediate attention: adverse hiring and promotion decisions are the clearest triggers for explainability and human-review obligations, giving legal teams a concrete priority list while the rulemaking unfolds.
Your membership also unlocks:
