Colorado ADMT Act compliance checklist (SB 26-189)
- Start with an inventory of covered ADMT tied to consequential decisions about Colorado residents.
- Five of the six duties fall on the deployer; one on the developer.
- Run each duty as an operating control, not as a policy paragraph.
- Enforcement posture rewards demonstrable good-faith preparation.
- Current as of July 2026. The US state AI landscape is in active motion; these guides track the live position.
Step 1: identify covered ADMT
Inventory every system that processes personal data to produce predictions, recommendations, classifications or scores, and mark those whose outputs guide or assist consequential decisions, employment, credit, housing, insurance, education, essential services, about Colorado residents. Each marked system carries the duties individually; an owner per system makes everything after this step tractable.
Step 2: the deployer duties, as a checklist
Pre-use notice: clear and conspicuous, delivered before the technology is used in the decision. Adverse-outcome explanation: plain language, within 30 days, covering the technology's role. Human review: a named reviewer with genuine authority to reconsider, reachable on request. Access and correction: a working path for individuals to see and fix inaccurate personal data used about them. Records: three years, retrievable, covering the decisions and the duties above. Run each as an operating control on the system, not a policy paragraph.
Step 3: the developer duty
If you supply covered ADMT to deployers, prepare documentation of intended uses, known harmful uses, training data categories, and known limitations, and version it: when the system changes materially, the documentation and your deployers should hear about it before their consumers do.
Step 4: watch the two moving parts
Attorney General rulemaking will specify formats and mechanics ahead of the effective date; build flexibly and absorb the rules as configuration. The federal litigation that stayed the predecessor continues; if it reaches SB 26-189, timing may move again, which changes your deadline, not the wisdom of being ready. And note the enforcement posture: AG only, no private right of action, and a 60-day cure period until 2030, a regime that rewards demonstrable good-faith preparation.
Key terms
- Covered ADMT inventory
- The list of systems whose outputs guide or assist consequential decisions about Colorado residents.
- Pre-use notice
- The clear and conspicuous notice delivered before covered ADMT is used in a decision.
- 30-day explanation
- The plain-language explanation of an adverse outcome, delivered within 30 days.
- Cure period
- The 60-day window until 2030 to remedy a violation before AG enforcement.
- Rulemaking
- The AG's process to specify operational detail ahead of the 1 January 2027 effective date.