AI Compliance Requirements in Colorado: What Small Businesses Need to Know in 2026

Colorado's AI Law Changed in 2026 — Here's Where It Stands

If you researched Colorado AI compliance any time before mid-2026, most of what you read is now out of date. On May 14, 2026, Colorado repealed the Colorado AI Act (SB 24-205) — before it ever took effect — and replaced it with the Automated Decision-Making Technology Act (SB 26-189), which takes effect January 1, 2027.

The new law is narrower than the original: it dropped the impact-assessment and risk-management-program requirements and focuses on notice and transparency. But for small businesses there's a critical catch: the old law's under-50-employee carve-out is gone. If you use automated decision-making technology in consequential decisions about Colorado residents, SB 26-189 applies to you whether you have 2 employees or 2,000.

For the full story of the repeal and a deadline-focused checklist, see our Colorado AI law deadline guide.

Who Does the Law Apply To?

SB 26-189 applies to deployers of automated decision-making technology (ADMT) — software that makes, or materially influences, "consequential decisions" about people. That includes AI tools, but also simpler algorithmic systems like weighted screening formulas.

The law defines consequential decisions as those with legal or similarly significant effects concerning:

• Employment and hiring
• Education and educational opportunities
• Financial or lending services
• Housing and real estate
• Healthcare services
• Insurance coverage and pricing
• Legal services
• Access to essential government services

If you use AI resume screening, credit or financing algorithms, insurance pricing tools, or tenant screening systems that touch Colorado residents, the law almost certainly applies to you.

Does Business Size Matter?

No — and this is the biggest change from the repealed law. SB 24-205 would have let deployers with fewer than 50 employees qualify for reduced obligations. SB 26-189 eliminated that carve-out entirely. There is no small-business exemption.

The law does exclude some people from its scope: independent contractors, out-of-state job applicants, and employees who live outside Colorado.

Colorado joins states like California and New York in regulating AI-driven decisions. If you operate in multiple states, you'll need the full landscape of AI compliance requirements.

What Does Compliance Require?

SB 26-189 has three core obligations for businesses:

1. Clear Notice

You must clearly notify individuals when ADMT is used to make or materially influence a consequential decision about them. For hiring, that means language in your application process; for customers, disclosure at the point the decision is made. The notice should be plain-language and delivered before or at the time the technology is used.

2. Human Review of Adverse Decisions

If someone is on the wrong end of an ADMT-influenced consequential decision — a rejected application, a denied claim — you must offer them human review and an opportunity to appeal. Practically, this means a documented process: who conducts the review, how someone requests it, and how outcomes are communicated.

3. Record Retention

You must retain records relevant to ADMT-influenced consequential decisions for at least three years — which tool was used, what data went in, what the outcome was, what notice was given, and any appeals.

What's not required anymore: the algorithmic impact assessments, formal risk-management programs, annual system reviews, and AG discrimination-reporting duties from the repealed law. (Note that the Colorado Privacy Act separately requires data protection assessments for certain kinds of profiling — that's still in force.)

What Documents Do You Need?

Based on the new requirements, most Colorado businesses using AI need:

AI Disclosure Policy — A public-facing document explaining how your business uses AI, including where it influences decisions. This is the foundational compliance document.

Employee AI Notification — If AI or algorithmic tools influence employment decisions (hiring, scheduling, performance evaluation), employees and applicants need notice — this is the heart of SB 26-189's employment-side obligations.

Internal AI Use Policy — Guidelines for your team: which tools are approved, how data is handled, who conducts human review of adverse decisions, and how records are retained.

Client AI Notice — If you serve other businesses, this informs clients about AI used in delivering their services.

Data Processing Addendum — If your AI tools process personal data of Colorado residents, contract language covering AI-specific data processing under the Colorado Privacy Act.

Learn more about whether you need an AI disclosure policy and what AI compliance costs for small businesses.

Key Deadlines and Enforcement

January 1, 2027: SB 26-189 takes effect. Notices, your adverse-action review process, and record retention should be in place before this date.

Enforcement: The Colorado Attorney General has exclusive enforcement authority. Violations are treated as unfair or deceptive trade practices under the Colorado Consumer Protection Act, with penalties up to $20,000 per violation. There is no private right of action — consumers cannot sue you directly under this law. For enforcement actions initiated before January 1, 2030, the AG must provide 60 days' notice and an opportunity to cure where a cure is possible.

Practical Timeline

1. Now: Inventory every AI or algorithmic tool your business uses and document which decisions each one influences
2. Within 30 days: Create your AI disclosure policy and employee/applicant notices
3. Within 60 days: Stand up your adverse-action process — who reviews, how appeals work — and train the people involved
4. Within 90 days: Set up three-year record retention for ADMT-influenced decisions
5. Ongoing: Update documents when your AI usage changes — or when the law does, as Colorado just demonstrated

Common Questions from Small Business Owners

I only use ChatGPT for writing marketing copy. Do I need to comply?

If AI never influences consequential decisions about individuals — hiring, credit, insurance, housing — SB 26-189's core obligations likely don't reach that use. A general AI disclosure policy is still smart practice, especially if AI-generated content reaches consumers.

I am a solopreneur. Does this really apply to me?

If you use ADMT in consequential decisions about Colorado residents, yes. The new law has no size threshold at all.

What if I use AI through a third-party platform?

You are still responsible. If your applicant-tracking system, CRM, or underwriting platform uses AI features that materially influence covered decisions, you are the deployer. Not having built the AI does not remove your notice and review obligations.

My documents reference SB 24-205. Are they still valid?

They cite a repealed law, which undermines them — and signals to anyone reviewing them (an employee's lawyer, an insurer, the AG's office) that your compliance program is stale. Update them to reference SB 26-189 and the new obligations.

Can I just copy a template from the internet?

Many templates still reflect the repealed law's requirements — impact assessments and risk programs that no longer apply — while missing the notice and human-review obligations that do. Compliance documents should match the current statute and your actual AI usage.

How Attestly Can Help

Attestly generates customized AI compliance documents based on your specific business situation. Our questionnaire takes about 90 seconds and covers your business type, the states where you operate, and the AI tools you use.

For Colorado businesses, Attestly generates documents aligned to the current law — SB 26-189, not the repealed AI Act — including notice language, adverse-action process documentation, and record-retention provisions tailored to your industry and AI usage. When laws change, as Colorado's just did, Pro subscribers can regenerate their documents to match.

The AI Disclosure Policy and Client AI Notice are free. The full package of five compliance documents is available with an Attestly Pro subscription.

Frequently Asked Questions