Colorado ADMT Act (SB 26-189)
Colorado's automated decision-making law. A disclosure regime — notice, explanation, human review, correction and record-keeping — effective 1 January 2027, replacing the repealed SB 24-205.
What the law demands.
SB 26-189, the Automated Decision-Making Technology Act, is a disclosure and consumer-rights regime. It applies where covered ADMT — computational technology that processes personal data to produce predictions, recommendations, classifications or scores — is used to guide or assist a consequential decision about an individual.
The duty of care, mandatory risk-management programme and per-system impact assessment from the repealed SB 24-205 are gone. So is the NIST AI RMF / ISO 42001 affirmative defence. What deployers and developers owe now is notice, explanation, human review, correction, retention and documentation.
SB 24-205, signed in May 2024, was the first comprehensive US state AI law, modelled on the EU's risk-based approach. Its effective date was pushed from February to June 2026, a federal court stayed enforcement amid a constitutional challenge, and on 14 May 2026 the legislature repealed it outright. SB 26-189 is a deliberate pivot: from risk management mandates to disclosure and consumer rights. For anyone who built a compliance plan around impact assessments and the NIST affirmative defence, that plan is now historical.
Three things Hael does.
The affirmative defence is gone. The discipline is not.
SB 26-189 removed the statutory shield for following NIST AI RMF or ISO 42001, but the duties it kept — notices, explanations, human review, records — are exactly what a record produces as a by-product. One record, and Colorado's duties are outputs, not projects.
The pre-use consumer notice, generated and sourced.
The notice cites the covered ADMT it describes, the consequential decision it precedes and the explanation, review and correction paths it points to — sourced from the record and versioned.
Govern this alongside everything else.
One system, one record, governed against every framework at the same time. Map an obligation once; satisfy it everywhere it recurs.
See where you stand on Colorado AI Act, free.
Answer a few questions and get an indicative view of what Colorado AI Act expects of your AI systems and where you stand today — no sign-up to see your result.