Regulon — CO-SB-189 · CO SB 189 (ADMT in Consequential Decisions)

2026-05-01 introduced Introduced In Senate - Assigned to Business, Labor, & Technology

2026-05-05 amendment Senate Committee on Business, Labor, & Technology Refer Amended to Appropriations

2026-05-06 amendment Senate Committee on Appropriations Refer Amended to Senate Committee of the Whole

2026-05-06 Senate Second Reading Special Order - Passed with Amendments - Committee, Floor Senate Second Reading Special Order - Passed with Amendments - Committee, Floor

2026-05-07 chamber passage Senate Third Reading Passed - No Amendments

2026-05-07 introduced Introduced In House - Assigned to Judiciary

2026-05-08 amendment House Committee on Judiciary Refer Amended to Appropriations

2026-05-08 amendment House Committee on Appropriations Refer Unamended to House Committee of the Whole

2026-05-08 House Second Reading Special Order - Passed with Amendments - Committee House Second Reading Special Order - Passed with Amendments - Committee

2026-05-09 chamber passage House Third Reading Passed - No Amendments

2026-05-12 Senate Considered House Amendments - Result was to Concur - Repass Senate Considered House Amendments - Result was to Concur - Repass

2026-05-12 Signed by the President of the Senate Signed by the President of the Senate

2026-05-12 Signed by the Speaker of the House Signed by the Speaker of the House

2026-05-12 Sent to the Governor Sent to the Governor

2026-05-13 House Consideration of First Conference Committee Report result was to Adopt Committee Report - Repass House Consideration of First Conference Committee Report result was to Adopt Committee Report - Repass

Summary

Colorado SB 189 repeals and replaces the state's 2024 AI consumer protection law (SB 24-205) with a focused framework governing automated decision-making technology (ADMT) used to materially influence consequential decisions in education, employment, housing, financial services, insurance, healthcare, and government services. Developers must provide deployers with technical documentation covering intended uses, training data categories, known limitations, and human review instructions, and must notify deployers of material updates. Deployers must provide consumers with clear pre-interaction notice of ADMT use, post-adverse-outcome disclosures within 30 days, and must honor consumer rights to data correction and meaningful human review. Enforcement is exclusively by the Colorado Attorney General under the Consumer Protection Act, with a 60-day cure period for curable violations. The bill does not create a private right of action but establishes fault allocation rules for discrimination claims involving ADMT under existing anti-discrimination law. Significant carve-outs exist for HIPAA covered entities, insurers subject to § 10-3-1104.9, FDA-regulated devices, and creditors complying with ECOA/FCRA.

Enforcement & Penalties

Enforcement Authority

Exclusive enforcement by the Colorado Attorney General through the Colorado Consumer Protection Act. Enforcement is agency-initiated. Before initiating an action, the attorney general must issue a notice of violation and provide a 60-day cure period if a cure is deemed possible. No cure period is required for knowing or repeated violations. Violations are deemed deceptive trade practices under the Colorado Consumer Protection Act.

Penalties

Violations are deceptive trade practices under the Colorado Consumer Protection Act, subjecting violators to civil penalties and remedies available under that Act. The bill itself does not specify separate statutory damages amounts. A court may consider a timely cure as a mitigating factor in determining civil penalties or other monetary relief. The bill does not create a new private right of action but preserves existing rights and remedies under the Colorado Anti-Discrimination Act, product liability law, and other applicable law. Indemnification clauses in developer-deployer contracts that purport to hold harmless a party for its own anti-discrimination violations related to ADMT use are void as against public policy.

Who Is Covered

"Deployer" means a person doing business in Colorado that deploys a covered ADMT.

"Developer" means a person doing business in Colorado that: (I) Develops, offers, sells, leases, licenses, or otherwise makes commercially available a covered ADMT; (II) Develops a component that is designed, marketed, intended, documented, advertised, configured, or contracted to be used as part of a covered ADMT; or (III) Intentionally and substantially modifies an ADMT such that it becomes a covered ADMT. "Developer" does not include a person that: (I) Develops and uses an ADMT: (A) Solely for research purposes and the ADMT is not used in a consequential decision in the research; or (B) For internal purposes, such as use and development activities by affiliates and commercial support functions, and that does not make the system available to another person for use in a consequential decision; (II) Is a preceding developer that makes an ADMT commercially available and an unaffiliated person modifies the covered ADMT in a manner that changes the system's intended, documented, marketed, advertised, configured, or contracted use; or (III) Has designed, marketed, intended, documented, advertised, configured, or contracted a component that is used as part of an ADMT, but the component is integrated into a covered ADMT without the actual knowledge of the person.

What Is Covered

"Automated decision-making technology" or "ADMT" means a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual. "Automated decision-making technology" or "ADMT" does not include: (I) The following technologies: (A) Anti-malware; (B) Anti-virus; (C) Calculators; (D) Databases; (E) Data storage; (F) Firewalls; (G) Internet domain registration; (H) Internet website loading; (I) Networking; (J) Spam- and robocall-filtering; (K) Spell-checking; (L) Spreadsheets that require human analysis and do not use machine learning, foundation models, or large language models; (M) Web caching; or (N) Web hosting; (II) A tool used by an individual solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing; or (III) Technology that communicates with consumers in natural language or other means readily understood by an average consumer for the purpose of providing consumers with information, making referrals or recommendations, answering questions, or generating other content, if: (A) The technology is not contracted, advertised, marketed, configured, or intended by a person to be used in a consequential decision; and (B) The technology is subject to an acceptable use policy that prohibits generated content to be used in a consequential decision.

"Covered ADMT" means automated decision-making technology that is used to materially influence a consequential decision.

Compliance Obligations 15 obligations · click obligation ID to open requirement page

T-03 Training Data Disclosure · T-03.3 · Developer · Automated Decisionmaking

C.R.S. § 6-1-1702(1)(a)-(e)

Plain Language

Developers must provide each deployer of their covered ADMT with technical documentation that is reasonably understandable and that protects trade secrets. The documentation must cover: intended uses and known harmful uses, categories of training data (including personal data), known limitations and risks, instructions for appropriate use and human review, and information the deployer needs to comply with its own disclosure obligations. If any information is withheld for trade secret or legal protection reasons, the developer must notify the deployer.

Statutory Text

ON AND AFTER JANUARY 1, 2027, A DEVELOPER SHALL MAKE AVAILABLE TO EACH DEPLOYER OF A COVERED ADMT DEVELOPED BY THE DEVELOPER, IN A FORM AND MANNER THAT IS REASONABLY UNDERSTANDABLE TO A DEPLOYER AND THAT PROTECTS TRADE SECRETS OR INFORMATION PROTECTED FROM DISCLOSURE BY STATE OR FEDERAL LAW: (a) A GENERAL STATEMENT DESCRIBING THE INTENDED USES AND KNOWN HARMFUL OR INAPPROPRIATE USES OF THE COVERED ADMT; (b) A DESCRIPTION OF THE CATEGORIES OF DATA, INCLUDING PERSONAL DATA, USED TO TRAIN THE COVERED ADMT, TO THE EXTENT KNOWN; (c) KNOWN LIMITATIONS OF THE COVERED ADMT, INCLUDING KNOWN RISKS AND CIRCUMSTANCES IN WHICH THE COVERED ADMT SHOULD NOT BE USED; (d) INSTRUCTIONS FOR THE DEPLOYER'S APPROPRIATE USE, MONITORING, AND MEANINGFUL HUMAN REVIEW, WHERE APPLICABLE; (e) INFORMATION REASONABLY NECESSARY FOR THE DEPLOYER TO COMPLY WITH SECTION 6-1-1704. IF INFORMATION IS WITHHELD, THE DEVELOPER SHALL NOTIFY THE DEPLOYER.

G-01 AI Governance Program & Documentation · G-01.3 · Developer · Automated Decisionmaking

C.R.S. § 6-1-1702(2)(a)-(b)

Plain Language

Developers must notify each deployer within a reasonable time of material updates, intentional and substantial modifications, and changes to the covered ADMT's intended use, limitations, or risk mitigation. Developers may satisfy this obligation through public release notes if they also provide direct notice to each deployer that the release notes have been published. This is an ongoing notification obligation that applies whenever the developer makes qualifying changes — not just at initial deployment.

Statutory Text

(2) (a) A DEVELOPER SHALL PROVIDE TO EACH DEPLOYER OF A COVERED ADMT DEVELOPED BY THE DEVELOPER A NOTICE OF MATERIAL UPDATES, INTENTIONAL AND SUBSTANTIAL MODIFICATIONS, AND CHANGES TO THE INTENDED USE OF, LIMITATIONS FOR, OR RISK MITIGATION FOR THE COVERED ADMT WITHIN A REASONABLE TIME. (b) A DEVELOPER MAY USE PUBLIC RELEASE NOTES CONTAINING THE INFORMATION REQUIRED BY SUBSECTION (2)(a) OF THIS SECTION TO COMPLY WITH THIS SUBSECTION (2) IF THE DEVELOPER PROVIDES DIRECT NOTICE OF THE PUBLIC RELEASE TO EACH DEPLOYER OF THE COVERED ADMT.

G-01 AI Governance Program & Documentation · G-01.3 G-01.4 · Developer · Automated Decisionmaking

C.R.S. § 6-1-1702(4)

Plain Language

Developers must retain all records necessary to demonstrate compliance with their documentation and notification obligations for at least three years after creation, or longer if required by other law. Records include system version identifiers, changelogs, and copies of material update notices provided to deployers. This is a continuing recordkeeping obligation — each new record starts a fresh three-year retention clock.

Statutory Text

A DEVELOPER SHALL RETAIN, FOR NOT LESS THAN THREE YEARS AFTER THE CREATION OF A RECORD REQUIRED OR CREATED UNDER THIS SECTION OR FOR A LONGER PERIOD IF REQUIRED BY APPLICABLE STATE OR FEDERAL LAW, RECORDS REASONABLY NECESSARY TO DEMONSTRATE COMPLIANCE WITH THIS SECTION. RECORDS INCLUDE SYSTEM VERSION IDENTIFIERS, CHANGELOGS, AND DOCUMENTATION AND NOTICES OF MATERIAL UPDATES PROVIDED TO DEPLOYERS PURSUANT TO SUBSECTION (2) OF THIS SECTION.

G-01 AI Governance Program & Documentation · G-01.3 G-01.4 · Deployer · Automated Decisionmaking

C.R.S. § 6-1-1703

Plain Language

Deployers must retain records necessary to demonstrate compliance with the entire Part 17 for at least three years after each consequential decision, or longer if required by other law. Records may include ADMT version identifiers, changelogs, and documentation of material mitigation changes. Note that the retention clock runs from the date of each consequential decision, not from record creation — this means records supporting recurring decisions may need to be retained for well beyond three years from their creation date.

Statutory Text

A DEPLOYER SHALL RETAIN, FOR NOT LESS THAN THREE YEARS AFTER THE DATE OF A CONSEQUENTIAL DECISION OR FOR A LONGER PERIOD IF REQUIRED BY APPLICABLE STATE OR FEDERAL LAW, RECORDS REASONABLY NECESSARY TO DEMONSTRATE COMPLIANCE WITH THIS PART 17. RECORDS MAY INCLUDE, AS APPLICABLE, COVERED ADMT VERSION IDENTIFIERS, CHANGELOGS, AND DOCUMENTATION OF MATERIAL MITIGATION CHANGES.

H-01 Human Oversight of Automated Decisions · H-01.3 · Deployer · Automated Decisionmaking

C.R.S. § 6-1-1704(1)-(2)

Plain Language

Before using a covered ADMT to materially influence a consequential decision, the deployer must give consumers clear and conspicuous notice that ADMT is or will be used and tell them how to get more information. The deployer can satisfy this requirement by maintaining a prominent public notice at consumer interaction points — such as a link or posting near the transaction. This is a pre-decision disclosure, not a post-adverse-outcome notice.

Statutory Text

(1) PRIOR TO A DEPLOYER USING A COVERED ADMT TO MATERIALLY INFLUENCE A CONSEQUENTIAL DECISION, THE DEPLOYER SHALL PROVIDE A CLEAR AND CONSPICUOUS NOTICE TO A CONSUMER THAT THE DEPLOYER USED OR WILL USE A COVERED ADMT IN A CONSEQUENTIAL DECISION AFFECTING THE CONSUMER AND INSTRUCTIONS REGARDING HOW THE CONSUMER MAY OBTAIN THE ADDITIONAL INFORMATION DESCRIBED IN THIS SECTION. (2) A DEPLOYER COMPLIES WITH SUBSECTION (1) OF THIS SECTION BY MAINTAINING A PROMINENT PUBLIC NOTICE THAT IS REASONABLY ACCESSIBLE AT POINTS OF CONSUMER INTERACTION, INCLUDING THROUGH A LINK OR POSTING THAT IS REASONABLY PROXIMATE TO THE INTERACTION OR TRANSACTION IN WHICH A CONSEQUENTIAL DECISION MAY OCCUR.

H-01 Human Oversight of Automated Decisions · H-01.1 H-01.2 · Deployer · Automated Decisionmaking

C.R.S. § 6-1-1704(3)(a)-(c)

Plain Language

When a covered ADMT materially influences a consequential decision that results in an adverse outcome for a consumer, the deployer must provide within 30 days: (1) a plain-language explanation of the decision and the ADMT's role; (2) instructions and a simple process for requesting additional information about the ADMT (including its name, version, developer, and categories and sources of personal data used); and (3) an explanation of the consumer's rights to data correction and human review. The deployer's obligation to disclose input details is limited to information the developer has provided under § 6-1-1702. Trade secrets and legally protected information may be withheld, but the deployer must notify the consumer of any withholding. The attorney general must adopt rules by January 1, 2027 to further clarify these post-adverse-outcome disclosure requirements.

Statutory Text

(3) IF A DEPLOYER USES A COVERED ADMT TO MATERIALLY INFLUENCE A CONSEQUENTIAL DECISION THAT RESULTS IN AN ADVERSE OUTCOME FOR A CONSUMER, THE DEPLOYER SHALL PROVIDE WITHIN THIRTY DAYS AFTER MAKING THE DECISION: (a) A PLAIN LANGUAGE DESCRIPTION OF THE CONSEQUENTIAL DECISION AND THE ROLE THE COVERED ADMT PLAYED IN THE CONSEQUENTIAL DECISION; (b) INSTRUCTIONS AND A SIMPLE-TO-FOLLOW PROCESS TO REQUEST ADDITIONAL INFORMATION ABOUT THE COVERED ADMT AND THE INPUTS, INCLUDING THE NAME OF THE COVERED ADMT, THE COVERED ADMT VERSION NUMBER, IF APPLICABLE, THE COVERED ADMT DEVELOPER, AND THE TYPES, CATEGORIES, AND SOURCES OF PERSONAL DATA USED, TO THE EXTENT THE DEPLOYER RECEIVES THE NECESSARY INFORMATION FROM THE DEVELOPER IN COMPLIANCE WITH SECTION 6-1-1702; AND (c) AN EXPLANATION OF THE CONSUMER RIGHTS DESCRIBED IN SECTION 6-1-1705 AND HOW TO EXERCISE THEM.

D-01 Automated Processing Rights & Data Controls · D-01.2 · Deployer · Automated Decisionmaking

C.R.S. § 6-1-1705(1)(a)(I), (1)(b), (1)(c)

Plain Language

When a consumer experiences an adverse outcome from a consequential decision materially influenced by a covered ADMT, the consumer may request instructions for accessing their personal data and correcting factually incorrect or materially inaccurate personal data used in the decision, consistent with the Colorado Privacy Act (§ 6-1-1306). The data correction right applies broadly — certain CPA consumer definition exceptions and processing exceptions do not limit this right. However, the correction right does not extend to opinions, predictions, scores, or protected evaluations. The attorney general must adopt implementing rules by January 1, 2027.

Statutory Text

(1) (a) WHEN A CONSUMER EXPERIENCES AN ADVERSE OUTCOME RESULTING FROM A CONSEQUENTIAL DECISION IN WHICH A COVERED ADMT MATERIALLY INFLUENCES THE CONSEQUENTIAL DECISION, THE CONSUMER MAY REQUEST AND THE DEPLOYER SHALL PROVIDE IN RESPONSE TO THE REQUEST: (I) INSTRUCTIONS FOR REQUESTING PERSONAL DATA AND CORRECTING FACTUALLY INCORRECT OR MATERIALLY INACCURATE PERSONAL DATA USED IN A CONSEQUENTIAL DECISION THAT USED A COVERED ADMT CONSISTENT WITH SECTION 6-1-1306; ... (b) FOR THE PURPOSES OF THIS SUBSECTION (1), THE EXCEPTIONS TO THE DEFINITION OF "CONSUMER" IN SECTION 6-1-1303 (6)(b) AND THE EXCEPTIONS IN SECTION 6-1-1304 (2)(k), (2)(n), AND (2)(o) DO NOT APPLY TO THE RIGHT TO REQUEST CORRECTION OF FACTUALLY INCORRECT OR MATERIALLY INACCURATE PERSONAL DATA PURSUANT TO THIS SUBSECTION (1). (c) SUBSECTION (1)(a) OF THIS SECTION DOES NOT REQUIRE CORRECTION OF OPINIONS, PREDICTIONS, SCORES, OR PROTECTED EVALUATIONS.

H-01 Human Oversight of Automated Decisions · H-01.4 · Deployer · Automated Decisionmaking

C.R.S. § 6-1-1705(1)(a)(II)

Plain Language

When a consumer experiences an adverse outcome from a consequential decision materially influenced by a covered ADMT, the consumer may request meaningful human review and reconsideration of the decision, and the deployer must provide it to the extent commercially reasonable. The reviewing individual must have authority to approve, modify, or override the decision; must consider primary evidence; must be trained; must not default to the system output; and must understand the output's intended use, limitations, input categories, and principal factors. The 'commercially reasonable' qualifier gives deployers some flexibility but does not eliminate the obligation. FERPA-subject deployers may comply through existing student record amendment and appeal processes.

Statutory Text

Other · Automated Decisionmaking

C.R.S. § 6-1-1706(1)-(4)

Plain Language

This provision establishes the enforcement mechanism for the entire Part 17. Enforcement is exclusively by the attorney general under the Colorado Consumer Protection Act. Violations are deceptive trade practices. The AG must provide a 60-day cure period before enforcement actions where a cure is possible, but no cure period is required for knowing or repeated violations. A timely cure is a mitigating factor for penalties. The bill expressly does not create a private right of action but preserves all existing causes of action under state and federal law. This is an enforcement mechanism provision — it creates no new compliance obligation.

Statutory Text

(1) (a) THE ATTORNEY GENERAL SHALL ENFORCE THIS PART 17 THROUGH THE "COLORADO CONSUMER PROTECTION ACT", THIS ARTICLE 1. (b) VIOLATIONS OF THE DISCLOSURE REQUIREMENTS AND CONSUMER RIGHTS DESCRIBED IN SECTIONS 6-1-1702, 6-1-1703, 6-1-1704, AND 6-1-1705 ARE ENFORCEABLE EXCLUSIVELY BY THE ATTORNEY GENERAL WITHOUT REGARD TO ANY OTHER PROVISION IN THIS TITLE 6. (2) (a) A VIOLATION OF THIS PART 17 IS A DECEPTIVE TRADE PRACTICE AND IS SUBJECT TO THE PROVISIONS OF THE "COLORADO CONSUMER PROTECTION ACT", THIS ARTICLE 1. (b) ANY PROVISION OF THE "COLORADO CONSUMER PROTECTION ACT", THIS ARTICLE 1, THAT IS INCONSISTENT WITH THE EXCLUSIVE ENFORCEMENT AUTHORITY GRANTED TO THE ATTORNEY GENERAL IN THIS SECTION FOR A VIOLATION OF THIS PART 17 DOES NOT APPLY TO ANY SUCH VIOLATION. (3) (a) PRIOR TO ANY ENFORCEMENT ACTION FOR A VIOLATION OF THIS PART 17, THE ATTORNEY GENERAL SHALL ISSUE A NOTICE OF VIOLATION TO A DEVELOPER OR DEPLOYER IF A CURE IS DEEMED POSSIBLE BY THE ATTORNEY GENERAL. (b) IF THE DEVELOPER OR DEPLOYER FAILS TO CURE A VIOLATION WITHIN SIXTY DAYS AFTER RECEIPT OF A NOTICE OF VIOLATION, THE ATTORNEY GENERAL MAY BRING AN ACTION PURSUANT TO THIS SECTION. (c) IF THE ATTORNEY GENERAL FINDS AND CAN DEMONSTRATE THAT A DEVELOPER OR DEPLOYER KNOWINGLY VIOLATED THIS PART 17 OR A DEVELOPER OR DEPLOYER REPEATEDLY VIOLATED THIS PART 17, THE ATTORNEY GENERAL IS NOT REQUIRED TO PROVIDE A CURE PERIOD BEFORE SEEKING PENALTIES OR OTHER RELIEF. (d) IF A VIOLATION IS DISCOVERED IN THE COURSE OF AN ENFORCEMENT ACTION, A COURT MAY CONSIDER THAT A DEVELOPER OR DEPLOYER CURED THE VIOLATION WITHIN SIXTY DAYS AFTER RECEIPT OF WRITTEN NOTICE AS A MITIGATING FACTOR IN DETERMINING CIVIL PENALTIES OR OTHER MONETARY RELIEF, IF ANY. ... (4) NOTHING IN THIS PART 17 CREATES A NEW PRIVATE RIGHT OF ACTION. NOTHING IN THIS PART 17 LIMITS OR REDUCES ANY EXISTING RIGHTS OR REMEDIES AVAILABLE UNDER STATE OR FEDERAL LAW, INCLUDING THE "COLORADO ANTI-DISCRIMINATION ACT", PARTS 3 TO 8 OF ARTICLE 34 OF TITLE 24; THE "COLORADO CONSUMER PROTECTION ACT", THIS ARTICLE 1; PRODUCT LIABILITY LAW; OR OTHER APPLICABLE LAW.

Other · Automated Decisionmaking

C.R.S. § 6-1-1707(1)-(9)

Plain Language

This provision establishes fault allocation and liability rules for discrimination claims involving ADMT — it does not create new affirmative compliance obligations. Both developers and deployers may be liable for discrimination arising from ADMT-influenced consequential decisions under existing anti-discrimination laws. Fault is allocated based on relative responsibility. Developer liability is limited to cases where the ADMT was used as intended/marketed/contracted. Indemnification clauses in developer-deployer contracts are void to the extent they shield a party from its own anti-discrimination violations. Using an ADMT is never a defense to existing legal obligations. This section clarifies how existing law applies to ADMT-related discrimination but creates no new independent obligation.

Statutory Text

(1) A DEVELOPER OR DEPLOYER MAY BE HELD LIABLE IN AN ACTION ALLEGING UNLAWFUL DISCRIMINATION UNDER STATE ANTI-DISCRIMINATION LAWS, INCLUDING THE "COLORADO ANTI-DISCRIMINATION ACT", PARTS 3 TO 8 OF ARTICLE 34 OF TITLE 24, ARISING FROM A CONSEQUENTIAL DECISION MATERIALLY INFLUENCED BY A COVERED ADMT. (2) IN AN ACTION DESCRIBED IN SUBSECTION (1) OF THIS SECTION, FAULT SHALL BE ALLOCATED AMONG DEPLOYERS AND DEVELOPERS BASED ON THEIR RELATIVE FAULT FOR THE VIOLATION. (3) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO APPORTION LIABILITY TO A CLAIMANT WHERE SUCH APPORTIONMENT IS NOT PROVIDED FOR UNDER EXISTING LAW. (4) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO CREATE JOINT AND SEVERAL LIABILITY, EXCEPT TO THE EXTENT PERMITTED UNDER EXISTING LAW. (5) (a) A DEVELOPER IS LIABLE IN AN ACTION DESCRIBED IN SUBSECTION (1) OF THIS SECTION ONLY TO THE EXTENT THAT: (I) THE DEVELOPER'S COVERED ADMT WAS USED BY A DEPLOYER IN A MANNER THAT WAS INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED FOR BY THE DEVELOPER; AND (II) THE DEVELOPER'S COVERED ADMT MATERIALLY INFLUENCED A CONSEQUENTIAL DECISION THAT GAVE RISE TO THE VIOLATION OF EXISTING LAW. (b) A DEVELOPER IS NOT LIABLE UNDER THIS SECTION FOR VIOLATIONS OF EXISTING LAW ARISING FROM A DEPLOYER'S USE OF A COVERED ADMT IN A MANNER THAT WAS NOT INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED FOR BY THE DEVELOPER. (6) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO LIMIT THE LIABILITY OF A DEPLOYER FOR THE DEPLOYER'S INDEPENDENT ACTS OR OMISSIONS IN A CONSEQUENTIAL DECISION MATERIALLY INFLUENCED BY A COVERED ADMT, INCLUDING USING AN ADMT IN A MANNER THAT WAS NOT INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED FOR BY THE DEVELOPER IF THE DEVELOPER OF THE COVERED ADMT COMPLIED WITH SECTION 6-1-1702. (7) (a) NOTWITHSTANDING ANY OTHER PROVISION OF LAW, IF A PROVISION OF A CONTRACT FOR THE USE OF AUTOMATED DECISION-MAKING TECHNOLOGY IN MAKING A CONSEQUENTIAL DECISION OR ANY OTHER CONTRACT BETWEEN A DEVELOPER AND DEPLOYER PURPORTS TO INDEMNIFY, DEFEND, OR HOLD HARMLESS OR HAS THE EFFECT OF INDEMNIFYING, DEFENDING, OR HOLDING HARMLESS THE INDEMNITEE FROM OR AGAINST ANY LIABILITY FOR DAMAGES PURSUANT TO THIS SECTION RESULTING FROM THE DEVELOPER'S OR DEPLOYER'S OWN ACTS OR OMISSIONS RELATED TO THE USE OF AUTOMATED DECISION-MAKING TECHNOLOGY IN MAKING CONSEQUENTIAL DECISIONS IN VIOLATION OF THE "COLORADO ANTI-DISCRIMINATION ACT", PARTS 3 TO 8 OF ARTICLE 34 OF TITLE 24, OR OTHER COLORADO ANTI-DISCRIMINATION LAW, THE PROVISION IS CONTRARY TO PUBLIC POLICY AND VOID. (b) THE LIMITATIONS OF SUBSECTION (7)(a) OF THIS SECTION DO NOT APPLY TO A DEVELOPER WHERE THE USE OF THE COVERED ADMT IN MAKING A CONSEQUENTIAL DECISION WAS NOT INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED FOR BY THE DEVELOPER IF THE DEVELOPER OF THE COVERED ADMT COMPLIED WITH SECTION 6-1-1702. (c) THIS SUBSECTION (7) DOES NOT OTHERWISE LIMIT THE ENFORCEABILITY OF CONTRACT TERMS BETWEEN PARTIES ACTING IN A COMMERCIAL OR BUSINESS CAPACITY, EXCEPT TO THE EXTENT OTHERWISE PROVIDED BY APPLICABLE LAW. (d) THIS SUBSECTION (7) DOES NOT PROHIBIT OR LIMIT ANY PERSON FROM OBTAINING OR MAKING A CLAIM ON APPLICABLE INSURANCE FOR ANY APPLICABLE ALLEGED LIABILITIES OR RELATED LOSSES. (8) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO LIMIT, DISPLACE, OR OTHERWISE AFFECT ANY LIABILITY THAT A DEVELOPER OR A DEPLOYER MAY HAVE, SEPARATE AND APART FROM LIABILITY UNDER THIS SECTION, FOR A VIOLATION OF STATE LAW. COMPLIANCE WITH THE REQUIREMENTS OF THIS PART 17 IS NOT A DEFENSE TO AND DOES NOT OTHERWISE EXCUSE NONCOMPLIANCE WITH ANY APPLICABLE LAW. (9) THE USE OF AN ADMT IN A CONSEQUENTIAL DECISION DOES NOT EXCUSE, JUSTIFY, OR PROVIDE A DEFENSE TO ANY OBLIGATION OR LIABILITY UNDER STATE OR FEDERAL LAW, INCLUDING OBLIGATIONS AND LIABILITY RELATED TO DISCRIMINATION OR CONSUMER PROTECTION.

Other · Automated Decisionmaking

C.R.S. § 6-1-1708(1)(a)-(b)

Plain Language

Insurers subject to § 10-3-1104.9 (the existing Colorado insurer AI regulation) are deemed in compliance with this Part 17 for insurance practices. If an insurer does not qualify for this safe harbor, it must provide post-adverse-outcome disclosures under § 6-1-1704(3). This is an exemption and safe harbor — it creates no new compliance obligation beyond what already exists under § 10-3-1104.9 or, in the fallback, § 6-1-1704(3). The insurer exemption does not cover employment-related ADMT decisions.

Statutory Text

(1) (a) AN INSURER, AS DEFINED IN SECTION 10-1-102 (13), AND AFFILIATED ENTITIES THAT ARE SUBJECT TO THE REQUIREMENTS OF SECTION 10-3-1104.9 ARE IN COMPLIANCE WITH THIS PART 17 IN THE PRACTICE OF INSURANCE. (b) IF AN INSURER IS NOT DEEMED IN COMPLIANCE PURSUANT TO SUBSECTION (1)(a) OF THIS SECTION, THE INSURER SHALL PROVIDE NOTICE AND DISCLOSURE OF ITS USE OF A COVERED ADMT IN MATERIALLY INFLUENCING A CONSEQUENTIAL DECISION REGARDING THE PRACTICE OF INSURANCE PURSUANT TO THE DISCLOSURE REQUIREMENTS OF SECTION 6-1-1704 (3), TO THE EXTENT APPLICABLE.

H-01 Human Oversight of Automated Decisions · H-01.1 H-01.2 H-01.4 · Deployer · Automated DecisionmakingHealthcare

C.R.S. § 6-1-1708(3)(a)-(e)

Plain Language

HIPAA covered entities and their business associates are broadly exempt from Part 17, except for employment-related consequential decisions. However, even exempt healthcare entities must: (1) provide patients a general notice that they use advanced technologies including ADMT, and (2) when using ADMT to determine financial assistance eligibility, provide specific disclosures including a plain-language description of the decision and ADMT's role, the types of information relied upon, how to request data correction under HIPAA, and how to request human review. These financial assistance disclosures may be provided either through advance general disclosure or within 30 days after an adverse outcome. Healthcare providers must be operating from a Colorado location to qualify for the HIPAA exemption.

Statutory Text

(3) (a) SECTIONS 6-1-1701, 6-1-1702, 6-1-1703, 6-1-1704, 6-1-1705, AND 6-1-1706 DO NOT APPLY TO A COVERED ENTITY WITHIN THE MEANING OF THE FEDERAL "HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996", 42 U.S.C. SECS. 1320d TO 1320d-9, AND THE REGULATIONS PROMULGATED UNDER THE FEDERAL ACT, OR A COVERED ENTITY'S BUSINESS ASSOCIATES FOR ANY SERVICES RENDERED TO A COVERED ENTITY, TO THE EXTENT THE COVERED ENTITY IS DOING BUSINESS IN COLORADO, EXCEPT FOR A CONSEQUENTIAL DECISION RELATED TO EMPLOYMENT OR AN EMPLOYMENT OPPORTUNITY. (b) NOTWITHSTANDING SUBSECTION (3)(a) OF THIS SECTION, FOR A COVERED ENTITY THAT IS A HEALTH-CARE PROVIDER, AS DEFINED IN 45 CFR 160.103, THIS SUBSECTION (3) APPLIES ONLY IF THE HEALTH-CARE PROVIDER IS OPERATING FROM A LOCATION WITHIN COLORADO. (c) A COVERED ENTITY SHALL PROVIDE PATIENTS WITH A GENERAL NOTICE OF USE OF ADVANCED TECHNOLOGIES, INCLUDING A COVERED ADMT. THE NOTICE MAY BE INCORPORATED WITH OTHER NOTICES DESCRIBING PATIENT RIGHTS AND HOW THE COVERED ENTITY PROVIDES CARE. (d) NOTWITHSTANDING SUBSECTION (3)(a) OF THIS SECTION, A COVERED ENTITY THAT USES A COVERED ADMT TO DETERMINE A PATIENT'S ELIGIBILITY FOR FINANCIAL ASSISTANCE, INCLUDING DISCOUNTED CARE AS DESCRIBED IN SECTION 25.5-3-502, SHALL PROVIDE A PATIENT THE FOLLOWING DISCLOSURES: (I) A PLAIN LANGUAGE DESCRIPTION OF THE CONSEQUENTIAL DECISION AND THE ROLE OF THE COVERED ADMT IN THE CONSEQUENTIAL DECISION; (II) THE TYPES OF INFORMATION ABOUT THE INDIVIDUAL THE COVERED ENTITY RELIED UPON IN MAKING ITS DETERMINATION OF ELIGIBILITY, EXCEPT FOR TRADE SECRETS AND OTHER CONFIDENTIAL OR LEGALLY PROTECTED INFORMATION; (III) INFORMATION ON HOW TO REQUEST CORRECTION OF MATERIALLY INACCURATE PERSONAL DATA HELD BY THE COVERED ENTITY CONSISTENT WITH THE FEDERAL "HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996", 42 U.S.C. SECS. 1320d TO 1320d-9 AND SECTION 25.5-3-502; AND (IV) INFORMATION ON HOW TO REQUEST MEANINGFUL HUMAN REVIEW OR RECONSIDERATION, WHERE APPLICABLE. (e) A COVERED ENTITY MAY COMPLY WITH SUBSECTION (3)(d) OF THIS SECTION THROUGH EITHER AN ADVANCE GENERAL DISCLOSURE OF THE INFORMATION REQUIRED BY SUBSECTION (3)(d) OF THIS SECTION OR THROUGH A NOTICE PROVIDED WITHIN THIRTY CALENDAR DAYS AFTER AN ADVERSE OUTCOME. THIS SECTION DOES NOT CREATE A SEPARATE AND DUPLICATIVE DISCLOSURE PROCESS OR APPEAL PROCESS IF THE REVIEW OPPORTUNITIES AND INFORMATION DESCRIBED IN SUBSECTION (3)(d) OF THIS SECTION ARE PROVIDED.

Other · Automated Decisionmaking

C.R.S. § 6-1-1709(1)-(2)

Plain Language

This provision confirms two things: (1) the bill creates no private right of action — only the attorney general can enforce it; and (2) complying with this bill is not a defense against violations of other applicable law. This is a savings clause that creates no new obligation.

Statutory Text

(1) NOTHING IN THIS PART 17 CREATES A NEW PRIVATE RIGHT OF ACTION. (2) COMPLIANCE WITH THIS PART 17 DOES NOT CONSTITUTE A DEFENSE TO AND DOES NOT EXCUSE NONCOMPLIANCE WITH ANY APPLICABLE LAW.

R-03 Operational Performance Reporting · Government · Automated Decisionmaking

C.R.S. § 6-1-1706(3)(e)

Plain Language

Beginning January 2028, the attorney general must annually report to the legislature on enforcement activity under this Part 17, including actions filed, actions completed, cure periods offered, cure periods unmet, and violations where no cure period was provided. This is a government reporting obligation on the AG — not on developers or deployers. It sunsets January 1, 2030.

Statutory Text

(e) BEGINNING IN JANUARY 2028, AND IN JANUARY EVERY YEAR THEREAFTER, THE ATTORNEY GENERAL SHALL INCLUDE, AS PART OF THE DEPARTMENT OF LAW'S PRESENTATION DURING ITS "SMART ACT" HEARING REQUIRED BY SECTION 2-7-203, A REPORT CONCERNING ENFORCEMENT ACTIONS BROUGHT AND CURE PERIODS OFFERED BY THE ATTORNEY GENERAL RELATED TO VIOLATIONS OF THIS PART 17, INCLUDING: (I) THE NUMBER OF ACTIONS FILED BY THE ATTORNEY GENERAL AGAINST DEVELOPERS AND DEPLOYERS, RESPECTIVELY; (II) THE NUMBER OF ACTIONS FILED BY THE ATTORNEY GENERAL AGAINST DEVELOPERS AND DEPLOYERS, RESPECTIVELY, THAT WERE COMPLETED; (III) THE NUMBER OF CURE PERIODS OFFERED BY THE ATTORNEY GENERAL TO DEVELOPERS AND DEPLOYERS, RESPECTIVELY; (IV) THE NUMBER OF CURE PERIODS OFFERED BY THE ATTORNEY GENERAL THAT WERE NOT MET BY DEVELOPERS AND DEPLOYERS, RESPECTIVELY; AND (V) THE NUMBER OF VIOLATIONS FILED BY THE ATTORNEY GENERAL AGAINST DEVELOPERS AND DEPLOYERS, RESPECTIVELY, WHERE A CURE PERIOD WAS NOT DEEMED POSSIBLE.

G-01 AI Governance Program & Documentation · Automated Decisionmaking

C.R.S. § 6-1-1702(3), (5)

Plain Language

These provisions scope the developer's obligations under § 6-1-1702. The developer's documentation and notification duties apply only when the ADMT was marketed, advertised, configured, contracted, sold, or licensed for use in consequential decisions — or when the developer becomes aware the system is being used for such decisions in a manner consistent with its intended and contracted uses. Developers are not responsible for deployers' unintended or off-label uses. This is a scoping limitation on other obligations, not an independent compliance requirement.

Statutory Text

(3) A DEVELOPER IS SUBJECT TO THE DISCLOSURE REQUIREMENTS DESCRIBED IN SUBSECTIONS (1) AND (2) OF THIS SECTION ONLY FOR A DEPLOYER'S USE OF A COVERED ADMT WHERE THE ADMT WAS MARKETED, ADVERTISED, CONFIGURED, CONTRACTED, SOLD, OR LICENSED TO BE USED TO MATERIALLY INFLUENCE A CONSEQUENTIAL DECISION. (5) THIS SECTION APPLIES WHEN A DEVELOPER CREATES A COVERED ADMT THAT IS INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED TO BE USED TO MAKE CONSEQUENTIAL DECISIONS OR WHEN THE DEVELOPER BECOMES AWARE THAT THE COVERED ADMT IS BEING USED TO MAKE CONSEQUENTIAL DECISIONS IN A MANNER CONSISTENT WITH THE INTENDED AND CONTRACTED USES.