Colorado SB26-189 (Automated Decision-Making Technology)

• Authority: Colorado
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Enacted
• Most recent activity date: 2026-05-14

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Overreliance and unsafe use
• Loss of human agency and autonomy
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Unequal performance across groups
• Compromise of privacy
• False or misleading information
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 5-6 subdomains, with strong focus on unfair discrimination (1.1), overreliance and unsafe use (5.1), loss of human agency and autonomy (5.2), and lack of transparency (7.4). Coverage is concentrated in discrimination/fairness, human-computer interaction, and AI system transparency domains, reflecting the law's emphasis on consequential decisions affecting individuals.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Finance & Insurance
• Real Estate, Rental & Leasing
• Educational Services
• Health Care & Social Assistance
• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Trade, Transportation & Utilities
• Information
• Professional & Technical Services
• Scientific Research & Development Services
• Management, Administrative & Support Services
• Arts, Entertainment & Recreation
• Accommodation, Food & Other Services

All other sectors had no coverage in this document.

Sectors Summary

The document explicitly governs ADMT use across seven 'covered domains': education, employment, residential real estate, financial/lending services, insurance, healthcare, and government services/public benefits. This corresponds to regulations spanning Educational Services, multiple employment-related sectors, Real Estate, Finance and Insurance, Health Care and Social Assistance, and Public Administration sectors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding state statute enacted by the Colorado General Assembly with mandatory obligations enforced by the Attorney General through the Colorado Consumer Protection Act, including civil penalties for violations.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Colorado General Assembly; State of Colorado
• Summary: The document begins with 'Be it enacted by the General Assembly of the State of Colorado' indicating the state legislature as the proposer of this governance instrument.

Target

• Entity Types: AI_Developer, AI_Deployer
• Summary: The law explicitly targets 'developers' (persons who develop, offer, sell, lease, or license ADMT) and 'deployers' (persons doing business in Colorado that deploy covered ADMT), applying obligations to each group throughout the statute.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Colorado Attorney General; Department of Law
• Summary: The Attorney General has exclusive enforcement authority and is explicitly designated as the enforcer through the Colorado Consumer Protection Act.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Colorado Attorney General; Department of Law
• Summary: The Attorney General is responsible for monitoring implementation through annual reporting requirements and has authority to adopt implementing rules.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily focuses on the Deploy and Operate and Monitor stages, with substantial coverage of Build and Use Model through developer documentation requirements. It addresses the full lifecycle of ADMT from development through ongoing operation, with emphasis on transparency, disclosure, and human oversight at deployment and operation stages.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• Foundation Models
• AI Systems
• Generative AI
• Predictive AI

Technical Scope Summary

The document defines and regulates 'Automated Decision-Making Technology' (ADMT) broadly as technology that processes personal data to make predictions, recommendations, or classifications. It does not distinguish between AI models and AI systems as separate concepts, nor does it reference frontier AI, GPAI, foundation models, or compute thresholds. The focus is on the functional application of automated systems in consequential decisions rather than technical AI categorizations.