Overview
- Governor Jared Polis signed SB 26‑189 on May 14, 2026, repealing the 2024 law and reframing Colorado’s approach around “automated decision‑making technology,” or ADMT.
- The new law drops system‑level mandates from the earlier statute and replaces them with point‑of‑decision duties focused on notice, recordkeeping, individual explanations, correction rights, and meaningful human review.
- Deployers must give clear pre‑use notice, keep records for three years, and provide a plain‑language explanation within 30 days after an adverse consequential decision, with the right to request correction where commercially reasonable.
- Employers and financial institutions are explicitly in scope because the narrow 2024 bank exemption was removed, but SB 26‑189 preserves limited carve‑outs for cybersecurity, AML/sanctions work and fraud prevention and lets ECOA/FCRA adverse‑action notices satisfy some disclosure duties.
- The Colorado Attorney General has exclusive enforcement authority, a conditional 60‑day cure period, and must issue implementing rules by the January 1, 2027 effective date, leaving key terms like “materially influence” and “meaningful human review” to be defined in rulemaking and creating urgent compliance work for covered entities.