Regulon — CO-SB-189 · CO SB 189 (Automated Decision-Making Technology)

WHAT THIS BILL REGULATES · 4 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Enforced exclusively by the Colorado Attorney General through the Colorado Consumer Protection Act. Before initiating an enforcement action, the attorney general must issue a notice of violation and provide a 60-day cure period if a cure is deemed possible. The cure period is not required for knowing or repeated violations. Beginning January 2028, the attorney general must annually report on enforcement actions and cure periods offered.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

Violations are deceptive trade practices under the Colorado Consumer Protection Act, subject to the remedies available under that act including civil penalties and injunctive relief. A court may consider a 60-day cure as a mitigating factor in determining civil penalties or other monetary relief. No new private right of action is created. The bill does not specify statutory minimum or maximum penalties; penalties are governed by the existing Colorado Consumer Protection Act framework.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

C.R.S. § 6-1-1701

Definitions

(1)–(17) As used in this part 17, unless the context otherwise requires: (1) "Adverse outcome" means: (a) A decision that denies, terminates, revokes, or materially reduces or restricts a consumer's access to, eligibility for, selection for, compensation for, or the provision of an opportunity or service; or (b) A decision that results in materially less favorable differentiated price, cost, compensation, or other material terms that are reasonably likely to materially limit, delay, or effectively deny, or otherwise fundamentally alter, a consumer's access to, eligibility for, selection for, compensation for, or the provision of an opportunity or service compared to terms offered to similarly situated consumers. If a decision outcome imposes materially less favorable differentiated pricing or terms, the decision outcome materially influences price, cost sharing, compensation, or material terms. (2)(a) "Automated decision-making technology" or "ADMT" means a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual. (b) "Automated decision-making technology" or "ADMT" does not include: [extensive carve-outs]. (3)(a) "Consequential decision" means: [definition with covered domains]. (b) "Consequential decision" does not include: [extensive carve-outs]. (4) "Consumer" has the meaning set forth in section 6-1-1303(6)(a). "Consumer" includes an employee, a job applicant who is a Colorado resident, and any individual whose access to, eligibility for, or opportunity in Colorado is evaluated in a consequential decision by a person doing business in Colorado. (5) "Covered ADMT" means automated decision-making technology that is used to materially influence a consequential decision. (6) "Covered domain" means: [seven enumerated domains]. (7) "Deployer" means a person doing business in Colorado that deploys a covered ADMT. (8) "Developer" means a person doing business in Colorado that: [definition with carve-outs]. (9)–(17) [Additional definitions including Employee, Employer, FERPA, Intentional and substantial modification, Materially influence, Material update, Meaningful human review, Personal data, Trade secret].

Section 6-1-1701 establishes the definitional framework for the entire Part 17. Key defined terms include automated decision-making technology (ADMT), consequential decision, covered ADMT, covered domain, developer, deployer, consumer, materially influence, and meaningful human review. The ADMT definition is broad — any technology processing personal data and using computation to generate outputs used in decisions about individuals — but is significantly narrowed by extensive carve-outs for common business technologies, administrative tools, and conversational AI with acceptable use policies. The consequential decision definition is similarly scoped by covered domains (education, employment, housing, financial services, insurance, healthcare, government services) and excludes low-stakes, routine, fraud prevention, cybersecurity, and compliance activities.

The consumer definition is notably expansive: it includes employees, Colorado-resident job applicants, and any individual whose access or eligibility in Colorado is evaluated in a consequential decision by a person doing business in Colorado.

C.R.S. § 6-1-1702

Developer responsibilities — documentation

Developer

(1)(a)–(e) 1 On and after January 1, 2027, a developer shall make available to each deployer of a covered ADMT developed by the developer, in a form and manner that is reasonably understandable to a deployer and that protects trade secrets or information protected from disclosure by state or federal law: (a) A general statement describing the intended uses and known harmful or inappropriate uses of the covered ADMT; (b) A description of the categories of data, including personal data, used to train the covered ADMT, to the extent known; (c) Known limitations of the covered ADMT, including known risks and circumstances in which the covered ADMT should not be used; (d) Instructions for the deployer's appropriate use, monitoring, and meaningful human review, where applicable; (e) Information reasonably necessary for the deployer to comply with section 6-1-1704. If information is withheld, the developer shall notify the deployer.

(2)(a)–(b) 2 A developer shall provide to each deployer of a covered ADMT developed by the developer a notice of material updates, intentional and substantial modifications, and changes to the intended use of, limitations for, or risk mitigation for the covered ADMT within a reasonable time. (b) A developer may use public release notes containing the information required by subsection (2)(a) of this section to comply with this subsection (2) if the developer provides direct notice of the public release to each deployer of the covered ADMT.

(3) A developer is subject to the disclosure requirements described in subsections (1) and (2) of this section only for a deployer's use of a covered ADMT where the ADMT was marketed, advertised, configured, contracted, sold, or licensed to be used to materially influence a consequential decision.

(4) 3 A developer shall retain, for not less than three years after the creation of a record required or created under this section or for a longer period if required by applicable state or federal law, records reasonably necessary to demonstrate compliance with this section. Records include system version identifiers, changelogs, and documentation and notices of material updates provided to deployers pursuant to subsection (2) of this section.

(5) This section applies when a developer creates a covered ADMT that is intended, documented, marketed, advertised, configured, or contracted to be used to make consequential decisions or when the developer becomes aware that the covered ADMT is being used to make consequential decisions in a manner consistent with the intended and contracted uses.

Section 6-1-1702 imposes the bill's core developer-side obligations, effective January 1, 2027. Developers must provide deployers with technical documentation covering intended uses, harmful uses, training data categories, known limitations, appropriate use instructions, and information necessary for deployers to comply with their own disclosure obligations. Developers must also notify deployers of material updates, intentional modifications, and changes to intended use or risk mitigation within a reasonable time — public release notes with direct deployer notification suffice.

The section includes a knowledge-scoping provision: developer obligations attach only when the ADMT was marketed, configured, or contracted for use in consequential decisions, or when the developer becomes aware of such use in a manner consistent with intended uses. Developers must retain compliance records for at least three years.

Compliance actions 3 items

Developers must, on and after January 1, 2027, make available to each deployer of a covered ADMT technical documentation that is reasonably understandable and that protects trade secrets, including: (1) a general statement of intended uses and known harmful or inappropriate uses; (2) a description of the categories of data, including personal data, used to train the ADMT (to the extent known); (3) known limitations, risks, and circumstances in which the ADMT should not be used; (4) instructions for the deployer's appropriate use, monitoring, and meaningful human review; and (5) information reasonably necessary for the deployer to comply with its disclosure obligations under § 6-1-1704. If any information is withheld, the developer must notify the deployer.

T-03.3

Developers must provide each deployer of a covered ADMT with notice of material updates, intentional and substantial modifications, and changes to intended use, limitations, or risk mitigation within a reasonable time. Public release notes containing the required information satisfy this obligation if the developer also provides direct notice of the public release to each deployer.

G-01.2

Developers must retain records reasonably necessary to demonstrate compliance with § 6-1-1702 for at least three years after the creation of each record (or longer if required by other law). Records include system version identifiers, changelogs, and documentation and notices of material updates provided to deployers.

G-01.3

C.R.S. § 6-1-1703

Deployer record keeping

Deployer

4 A deployer shall retain, for not less than three years after the date of a consequential decision or for a longer period if required by applicable state or federal law, records reasonably necessary to demonstrate compliance with this part 17. Records may include, as applicable, covered ADMT version identifiers, changelogs, and documentation of material mitigation changes.

Section 6-1-1703 imposes a parallel record-retention obligation on deployers. Deployers must retain records reasonably necessary to demonstrate compliance with Part 17 for at least three years after the date of each consequential decision (or longer if required by other law). Records may include ADMT version identifiers, changelogs, and documentation of material mitigation changes.

Compliance actions 1 item

Deployers must retain records reasonably necessary to demonstrate compliance with Part 17 for at least three years after the date of each consequential decision (or longer if required by other law). Records may include covered ADMT version identifiers, changelogs, and documentation of material mitigation changes.

G-01.3

C.R.S. § 6-1-1704

Deployer disclosures — point-of-interaction notice — post-adverse outcome disclosures

Deployer

(1)–(2) 5 Prior to a deployer using a covered ADMT to materially influence a consequential decision, the deployer shall provide a clear and conspicuous notice to a consumer that the deployer used or will use a covered ADMT in a consequential decision affecting the consumer and instructions regarding how the consumer may obtain the additional information described in this section. (2) A deployer complies with subsection (1) of this section by maintaining a prominent public notice that is reasonably accessible at points of consumer interaction, including through a link or posting that is reasonably proximate to the interaction or transaction in which a consequential decision may occur.

(3)(a)–(c) 6 If a deployer uses a covered ADMT to materially influence a consequential decision that results in an adverse outcome for a consumer, the deployer shall provide within thirty days after making the decision: (a) A plain language description of the consequential decision and the role the covered ADMT played in the consequential decision; (b) Instructions and a simple-to-follow process to request additional information about the covered ADMT and the inputs, including the name of the covered ADMT, the covered ADMT version number, if applicable, the covered ADMT developer, and the types, categories, and sources of personal data used, to the extent the deployer receives the necessary information from the developer in compliance with section 6-1-1702; and (c) An explanation of the consumer rights described in section 6-1-1705 and how to exercise them.

(4)(a)–(b) The general assembly finds that the specific content and format of post-adverse outcome disclosures may vary across consequential decision domains. The general assembly intends that the specific elements of post-adverse outcome disclosures be further clarified through rule-making that accounts for sector-specific practices while ensuring that consumers receive meaningful and understandable information about consequential decisions. (b) On or before January 1, 2027, the attorney general shall adopt rules to clarify and implement the post-adverse outcome disclosure requirements set forth in subsection (3) of this section. Rules adopted pursuant to this subsection (4) may include, as appropriate: (I) Rules clarifying the content of required disclosures related to the types, sources, or categories of personal data that a deployer must provide to a consumer following an adverse outcome involving a covered ADMT pursuant to subsection (3) of this section; (II) Sector-specific guidance or illustrative examples tailored to different covered domains; (III) Standards for describing the role of the covered ADMT in a consequential decision in a manner that is reasonably understandable to a consumer; and (IV) Guidance addressing how the disclosure requirements described in this section interact with federal or state laws that require or govern notices, explanations, or adverse outcome disclosures.

(5) Nothing in this section requires a deployer to disclose a trade secret or information protected from disclosure by state or federal law. If a deployer withholds information pursuant to this subsection (5), the deployer shall notify the consumer.

(6)(a)–(d) A creditor, with respect to a consequential decision involving the offering, the denial, the pricing, the servicing, or other material terms of credit, that is required to provide and that provides a notice to a consumer pursuant to the federal "Equal Credit Opportunity Act", 15 U.S.C. sec. 1691 et seq., and its implementing regulations, including Regulation B, 12 CFR 1002, and, when applicable, the federal "Fair Credit Reporting Act", 15 U.S.C. sec. 1681 et seq., complies with the notice or disclosure requirements of this section that relate to the same decision or adverse outcome if the notice provided to the consumer pursuant to the federal laws and regulations described in this subsection (6)(a) also satisfies the notice or disclosure requirements of this section. (b) If a creditor complies with the federal laws and regulations described in subsection (6)(a) of this section and complies with subsection (6)(a) of this section, the creditor is not required to provide a separate or duplicative notice pursuant to this section. (c) Nothing in this subsection (6) shall be construed to require a creditor to provide any notice or disclosure in a manner that is prohibited by federal law. (d) For purposes of this subsection (6), a notice that complies with the federal laws and regulations described in subsection (6)(a) of this section and complies with subsection (6)(a) of this section may include a brief statement indicating that a covered ADMT was used to materially influence the consequential decision and instructions for how the consumer may obtain any additional information or exercise any rights provided under this part 17.

(7)–(9) This part 17 shall not be construed to require a person to make a disclosure, provide an explanation, or furnish information to a consumer to the extent doing so would be prohibited by federal law or would compromise the confidentiality or integrity of cybersecurity, fraud prevention, anti-money laundering, counter-terrorist financing, or economic sanctions compliance programs required by law. (8) A deployer or developer shall provide the notices and disclosures required by this part 17 in a manner that is reasonably accessible to consumers with disabilities and consumers with limited English proficiency, consistent with applicable state and federal law. (9)(a) For a consequential decision relating to education, a deployer that is subject to FERPA satisfies the notice and disclosure requirements of this section by providing notice and disclosures through processes and channels that are consistent with FERPA and the deployer's FERPA notices and student record access procedures, including, where applicable, notice to a parent or guardian or an eligible student. (b) A deployer that is subject to FERPA is not required to establish a separate or duplicative notice or disclosure process if the deployer has established a notice or disclosure process to comply with FERPA.

Section 6-1-1704 establishes the bill's consumer-facing disclosure obligations on deployers. There are two tiers: (1) a pre-interaction notice that the deployer uses or will use a covered ADMT in a consequential decision, which may be satisfied by maintaining a prominent public notice reasonably accessible at consumer interaction points; and (2) post-adverse-outcome disclosures within 30 days, including a plain-language description of the decision and the ADMT's role, instructions for requesting additional information (including ADMT name, version, developer, and data categories), and an explanation of consumer rights under § 6-1-1705.

The attorney general must adopt implementing rules by January 1, 2027. The section includes safe harbors for creditors complying with ECOA/FCRA and deployers subject to FERPA, a trade-secret protection with consumer notification, and a carve-out for disclosures that would compromise cybersecurity or financial compliance programs. All notices must be accessible to consumers with disabilities and limited English proficiency.

Compliance actions 2 items

Deployers must provide consumers with clear and conspicuous notice, prior to using a covered ADMT to materially influence a consequential decision, that the deployer uses or will use a covered ADMT in a consequential decision affecting the consumer, along with instructions on how to obtain additional information. A deployer satisfies this requirement by maintaining a prominent public notice reasonably accessible at points of consumer interaction, including through a link or posting reasonably proximate to the interaction or transaction.

H-01.3

Deployers must, within 30 days after a covered ADMT materially influences a consequential decision resulting in an adverse outcome, provide the affected consumer with: (1) a plain-language description of the consequential decision and the role the covered ADMT played; (2) instructions and a simple-to-follow process to request additional information about the covered ADMT and inputs, including the ADMT name, version number (if applicable), developer, and the types, categories, and sources of personal data used (to the extent the deployer received the necessary information from the developer); and (3) an explanation of consumer rights under § 6-1-1705 and how to exercise them. Trade secrets and information protected by federal law need not be disclosed, but the deployer must notify the consumer if information is withheld. Creditors complying with ECOA and FCRA notice requirements satisfy this obligation for the same decision if the federal notice also meets the requirements of this section. FERPA-subject deployers may use existing FERPA processes.

H-01.1

C.R.S. § 6-1-1705

Consumer rights — correction — human review and reconsideration

Deployer

(1)(a)(I) 7 When a consumer experiences an adverse outcome resulting from a consequential decision in which a covered ADMT materially influences the consequential decision, the consumer may request and the deployer shall provide in response to the request: (I) Instructions for requesting personal data and correcting factually incorrect or materially inaccurate personal data used in a consequential decision that used a covered ADMT consistent with section 6-1-1306.

(1)(a)(II) 8 When a consumer experiences an adverse outcome resulting from a consequential decision in which a covered ADMT materially influences the consequential decision, the consumer may request and the deployer shall provide in response to the request: (II) An opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable.

(1)(b)–(c) For the purposes of this subsection (1), the exceptions to the definition of "consumer" in section 6-1-1303(6)(b) and the exceptions in section 6-1-1304(2)(k), (2)(n), and (2)(o) do not apply to the right to request correction of factually incorrect or materially inaccurate personal data pursuant to this subsection (1). (c) Subsection (1)(a) of this section does not require correction of opinions, predictions, scores, or protected evaluations.

(2)(a)–(b) For a consequential decision relating to education, a deployer that is subject to FERPA complies with the requirements of subsection (1) of this section through the deployer's existing student record inspection, review, and amendment procedures and any applicable district complaint or appeal process, if the deployer offers a reasonable mechanism for a parent, guardian, or eligible student to request correction of materially inaccurate personal data and reconsideration where applicable under this part 17. (b) A deployer that is subject to FERPA is not required to establish a separate or duplicative correction or human review and reconsideration process if the deployer has established a correction or human review and reconsideration process to comply with FERPA.

(3) On or before January 1, 2027, the attorney general shall adopt rules to clarify and implement the requirements of this section.

Section 6-1-1705 grants consumers two post-adverse-outcome rights: (1) the right to request personal data and correction of factually incorrect or materially inaccurate personal data used in a consequential decision, consistent with the Colorado Privacy Act's correction procedures; and (2) the right to meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable. The correction right explicitly does not extend to opinions, predictions, scores, or protected evaluations. The consumer definition exceptions in § 6-1-1303(6)(b) and certain CPA exceptions do not apply to the data correction right, broadening its reach.

FERPA-subject deployers may comply through existing student record amendment procedures and complaint/appeal processes. The attorney general must adopt implementing rules by January 1, 2027.

Compliance actions 2 items

Deployers must, upon request from a consumer who experienced an adverse outcome from a consequential decision materially influenced by a covered ADMT, provide instructions for requesting personal data and for correcting factually incorrect or materially inaccurate personal data used in the consequential decision, consistent with § 6-1-1306. The correction right does not extend to opinions, predictions, scores, or protected evaluations. The consumer-definition exceptions in § 6-1-1303(6)(b) and certain CPA exceptions do not apply to this data-correction right.

D-01.2

Deployers must, upon request from a consumer who experienced an adverse outcome from a consequential decision materially influenced by a covered ADMT, provide an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable. Meaningful human review requires a reviewer designated by the deployer who has authority to approve, modify, or override the decision; considers relevant primary evidence; is trained to conduct the review; does not default to the system output; and has access to sufficient information to understand the output's intended use, material limitations, categories of inputs, and principal factors used to generate the output. FERPA-subject deployers may comply through existing student record amendment and appeal processes.

H-01.4

C.R.S. § 6-1-1706

Enforcement by the attorney general — deceptive trade practice — right to cure — no private right of action

(1)–(2) The attorney general shall enforce this part 17 through the "Colorado Consumer Protection Act", this article 1. (b) Violations of the disclosure requirements and consumer rights described in sections 6-1-1702, 6-1-1703, 6-1-1704, and 6-1-1705 are enforceable exclusively by the attorney general without regard to any other provision in this title 6. (2)(a) A violation of this part 17 is a deceptive trade practice and is subject to the provisions of the "Colorado Consumer Protection Act", this article 1. (b) Any provision of the "Colorado Consumer Protection Act", this article 1, that is inconsistent with the exclusive enforcement authority granted to the attorney general in this section for a violation of this part 17 does not apply to any such violation.

(3)(a)–(f) Prior to any enforcement action for a violation of this part 17, the attorney general shall issue a notice of violation to a developer or deployer if a cure is deemed possible by the attorney general. (b) If the developer or deployer fails to cure a violation within sixty days after receipt of a notice of violation, the attorney general may bring an action pursuant to this section. (c) If the attorney general finds and can demonstrate that a developer or deployer knowingly violated this part 17 or a developer or deployer repeatedly violated this part 17, the attorney general is not required to provide a cure period before seeking penalties or other relief. (d) If a violation is discovered in the course of an enforcement action, a court may consider that a developer or deployer cured the violation within sixty days after receipt of written notice as a mitigating factor in determining civil penalties or other monetary relief, if any. (e) Beginning in January 2028, and in January every year thereafter, the attorney general shall include, as part of the department of law's presentation during its "SMART Act" hearing required by section 2-7-203, a report concerning enforcement actions brought and cure periods offered by the attorney general related to violations of this part 17, including: (I) The number of actions filed by the attorney general against developers and deployers, respectively; (II) The number of actions filed by the attorney general against developers and deployers, respectively, that were completed; (III) The number of cure periods offered by the attorney general to developers and deployers, respectively; (IV) The number of cure periods offered by the attorney general that were not met by developers and deployers, respectively; and (V) The number of violations filed by the attorney general against developers and deployers, respectively, where a cure period was not deemed possible. (f) This subsection (3) is repealed, effective January 1, 2030.

(4) Nothing in this part 17 creates a new private right of action. Nothing in this part 17 limits or reduces any existing rights or remedies available under state or federal law, including the "Colorado Anti-Discrimination Act", parts 3 to 8 of article 34 of title 24; the "Colorado Consumer Protection Act", this article 1; product liability law; or other applicable law.

(5)(a)–(c) The attorney general may adopt rules as necessary to implement and clarify this part 17. (b) The attorney general may adopt rules to clarify the application of the definition of "materially influence", as defined in section 6-1-1701(13), including presumptions, illustrative examples, and objective indicators. (c) In adopting rules pursuant to this part 17, the attorney general shall utilize a process that meaningfully engages stakeholders, including consumer advocates, deployers, developers, and sector regulators, through public notice, opportunity for written comment, and at least one public hearing and shall adopt rules in accordance with section 24-4-103.

(6) Nothing in this part 17 limits the ability of a party to join necessary or permissive parties under the Colorado Rules of Civil Procedure, including Rules 19 and 20 of the Colorado Rules of Civil Procedure, in any action arising under other law.

Section 6-1-1706 establishes the enforcement framework. The attorney general has exclusive enforcement authority through the Colorado Consumer Protection Act, and violations are classified as deceptive trade practices. A 60-day cure period is required before enforcement unless the violation was knowing or repeated. Courts may treat timely cures as mitigating factors in determining penalties. The attorney general must report annually on enforcement actions beginning January 2028. The section explicitly states that no new private right of action is created but preserves all existing rights under the Colorado Anti-Discrimination Act, product liability law, and other applicable law. The cure provision sunsets January 1, 2030.

C.R.S. § 6-1-1707

Liability — fault allocation — no joint and several liability — indemnification prohibited

(1)–(6) 9 A developer or deployer may be held liable in an action alleging unlawful discrimination under state anti-discrimination laws, including the "Colorado Anti-Discrimination Act", parts 3 to 8 of article 34 of title 24, arising from a consequential decision materially influenced by a covered ADMT. (2) In an action described in subsection (1) of this section, fault shall be allocated among deployers and developers based on their relative fault for the violation. (3) Nothing in this section shall be construed to apportion liability to a claimant where such apportionment is not provided for under other law. (4) Nothing in this section shall be construed to create joint and several liability, except to the extent permitted under other law. (5)(a) A developer is liable in an action described in subsection (1) of this section only to the extent that: (I) The developer's covered ADMT was used by a deployer in a manner that was intended, documented, marketed, advertised, configured, or contracted for by the developer; and (II) The developer's covered ADMT materially influenced a consequential decision that gave rise to the violation of other law. (b) A developer is not liable under this section for violations of other law arising from a deployer's use of a covered ADMT in a manner that was not intended, documented, marketed, advertised, configured, or contracted for by the developer. (6) Nothing in this section shall be construed to limit the liability of a deployer for the deployer's independent acts or omissions in a consequential decision materially influenced by a covered ADMT, including using an ADMT in a manner that was not intended, documented, marketed, advertised, configured, or contracted for by the developer if the developer of the covered ADMT complied with section 6-1-1702.

(7)(a)–(d) 10 Notwithstanding any other provision of law, if a provision of a contract for the use of automated decision-making technology in making a consequential decision or any other contract between a developer and deployer purports to indemnify, defend, or hold harmless or has the effect of indemnifying, defending, or holding harmless the indemnitee from or against any liability for damages pursuant to this section resulting from the developer's or deployer's own acts or omissions related to the use of automated decision-making technology in making consequential decisions in violation of the "Colorado Anti-Discrimination Act", parts 3 to 8 of article 34 of title 24, or other Colorado anti-discrimination law, the provision is contrary to public policy and void. (b) The limitations of subsection (7)(a) of this section do not apply to a developer where the use of the covered ADMT in making a consequential decision was not intended, documented, marketed, advertised, configured, or contracted for by the developer if the developer of the covered ADMT complied with section 6-1-1702. (c) This subsection (7) does not otherwise limit the enforceability of contract terms between parties acting in a commercial or business capacity, except to the extent otherwise provided by applicable law. (d) This subsection (7) does not prohibit or limit any person from obtaining or making a claim on applicable insurance for any applicable alleged liabilities or related losses.

(8)–(9) Nothing in this section shall be construed to limit, displace, or otherwise affect any liability that a developer or a deployer may have, separate and apart from liability under this section, for a violation of state law. Compliance with the requirements of this part 17 is not a defense to and does not otherwise excuse noncompliance with any applicable law. (9) The use of an ADMT in a consequential decision does not excuse, justify, or provide a defense to any obligation or liability under state or federal law, including obligations and liability related to discrimination or consumer protection.

Section 6-1-1707 establishes the liability framework for discrimination claims arising from covered ADMT. Both developers and deployers may be liable in anti-discrimination actions, with fault allocated based on relative fault. The section does not create joint and several liability beyond what other law permits. A developer's liability is limited to situations where the ADMT was used in a manner consistent with the developer's intended, documented, or contracted use. The section voids indemnification clauses between developers and deployers for discrimination liability arising from their own acts or omissions related to ADMT use — a significant contractual restriction. Compliance with Part 17 is not a defense to other law violations, and use of ADMT does not excuse discrimination or consumer protection obligations.

C.R.S. § 6-1-1708

Compliance with other legal obligations — insurers — covered entities — disclosures

Deployer

(1)(a)–(b) An insurer, as defined in section 10-1-102(13), and any affiliated entities are in compliance with this part 17 regarding the practice of insurance if the insurer and any affiliated entities are subject to the requirements of section 10-3-1104.9. (b) If an insurer is not deemed in compliance pursuant to subsection (1)(a) of this section, the insurer shall provide notice and disclosure of its use of a covered ADMT in materially influencing a consequential decision regarding the practice of insurance pursuant to the disclosure requirements of section 6-1-1704(3), to the extent applicable.

(2) This section does not limit the applicability of this part 17 to uses of covered ADMT related to insurer employment or insurer employment opportunities by insurers and affiliated entities that are subject to the requirements of section 10-3-1104.9.

(3)(a)–(e) 11 Sections 6-1-1701, 6-1-1702, 6-1-1703, 6-1-1704, 6-1-1705, and 6-1-1706 do not apply to a covered entity within the meaning of the federal "Health Insurance Portability and Accountability Act of 1996", 42 U.S.C. secs. 1320d to 1320d-9, and the regulations promulgated under the federal act, or a covered entity's business associates for any services rendered to a covered entity, to the extent the covered entity is doing business in Colorado, except for a consequential decision related to employment or an employment opportunity. (b) Notwithstanding subsection (3)(a) of this section, for a covered entity that is a health-care provider, as defined in 45 CFR 160.103, this subsection (3) applies only if the health-care provider is operating from a location within Colorado. (c) A covered entity shall provide patients with a general notice of use of advanced technologies, including a covered ADMT. The notice may be incorporated with other notices describing patient rights and how the covered entity provides care. (d) Notwithstanding subsection (3)(a) of this section, a covered entity that uses a covered ADMT to determine a patient's eligibility for financial assistance, including discounted care as described in section 25.5-3-502, shall provide a patient the following disclosures: (I) A plain language description of the consequential decision and the role of the covered ADMT in the consequential decision; (II) The types of information about the individual the covered entity relied upon in making its determination of eligibility, except for trade secrets and other confidential or legally protected information; (III) Information on how to request correction of materially inaccurate personal data held by the covered entity consistent with the federal "Health Insurance Portability and Accountability Act of 1996", 42 U.S.C. secs. 1320d to 1320d-9 and section 25.5-3-502; and (IV) Information on how to request meaningful human review or reconsideration, where applicable. (e) A covered entity may comply with subsection (3)(d) of this section through either an advance general disclosure of the information required by subsection (3)(d) of this section or through a notice provided within thirty calendar days after an adverse outcome. This section does not create a separate and duplicative disclosure process or appeal process if the review opportunities and information described in subsection (3)(d) of this section are provided.

(4) Sections 6-1-1701, 6-1-1702, 6-1-1703, 6-1-1704, 6-1-1705, and 6-1-1706 do not apply to a medical device subject to oversight by the United States Food and Drug Administration or a pharmaceutical or medical device manufacturer's research and development activities that are subject to oversight by the United States Food and Drug Administration, including clinical investigations conducted under 21 CFR 312.

(5)–(6) Nothing in this part 17 requires a covered entity or business associate, as those terms are defined under the federal "Health Insurance Portability and Accountability Act of 1996", 42 U.S.C. secs. 1320d to 1320d-9, to disclose protected health information or other information in a manner that would violate federal law. To the extent compliance with section 6-1-1704 or 6-1-1705 would conflict with federal health privacy requirements, the deployer shall comply with applicable federal law and provide disclosures and access consistent with that law. (6) This part 17 does not require a person to disclose nonpublic personal information in a manner that would violate the federal "Gramm-Leach-Bliley Act", 15 U.S.C. sec. 6801 et seq., or its implementing regulations.

Section 6-1-1708 establishes safe harbors and carve-outs for regulated entities. Insurers subject to § 10-3-1104.9 are deemed in compliance for insurance-practice uses of ADMT, though insurer employment decisions remain covered. HIPAA-covered entities and business associates are exempt from §§ 6-1-1701 through 6-1-1706 except for employment decisions, with a location-within-Colorado requirement for healthcare providers. However, HIPAA-covered entities must provide patients with a general notice of use of advanced technologies including ADMT, and those using ADMT for financial-assistance eligibility must provide specific post-adverse-outcome disclosures. FDA-regulated medical devices and pharma/device manufacturer R&D activities are fully exempt. Gramm-Leach-Bliley protected information need not be disclosed.

Compliance actions 1 item

HIPAA-covered entities that use a covered ADMT to determine a patient's eligibility for financial assistance (including discounted care) must provide patients with: (1) a plain-language description of the consequential decision and the role of the covered ADMT; (2) the types of information relied upon in the eligibility determination (except trade secrets and legally protected information); (3) information on how to request correction of materially inaccurate personal data consistent with HIPAA and § 25.5-3-502; and (4) information on how to request meaningful human review or reconsideration, where applicable. Compliance may be through advance general disclosure or a notice within 30 calendar days after an adverse outcome. Additionally, all HIPAA-covered entities must provide patients with a general notice of use of advanced technologies, including covered ADMT, which may be incorporated with existing patient-rights notices.

H-01.1

C.R.S. § 6-1-1709

No new private right of action — application of other law

(1)–(2) Nothing in this part 17 creates a new private right of action. (2) Compliance with this part 17 does not constitute a defense to and does not excuse noncompliance with any applicable law.

Section 6-1-1709 restates that Part 17 creates no new private right of action and that compliance with Part 17 does not constitute a defense to or excuse noncompliance with any other applicable law. This is a savings clause that reinforces the enforcement exclusivity established in § 6-1-1706.

C.R.S. § 6-1-105(1)(qqqq)

Unfair or deceptive trade practices — ADMT violations

(1)(qqqq) A person engages in a deceptive trade practice when, in the course of the person's business, vocation, or occupation, the person: (qqqq) Violates part 17 of this article 1.

Section 2 of the bill amends the Colorado Consumer Protection Act's enumerated deceptive trade practices list to add violations of Part 17 (the ADMT provisions). This is the statutory hook that makes Part 17 violations enforceable as deceptive trade practices under the existing CCPA enforcement framework.

C.R.S. § 10-3-1104.9(3)(e)

Insurance commissioner rulemaking authority — consumer disclosures

(3)(e) The commissioner may adopt new rules or update existing rules regarding notice and disclosures from insurers to consumers.

Section 3 of the bill adds a new subsection to the existing insurer AI regulation statute (§ 10-3-1104.9) granting the insurance commissioner authority to adopt or update rules regarding notice and disclosures from insurers to consumers. This is an enabling provision that does not impose a direct compliance obligation on regulated entities.

Transparency AI identity disclosure · periodic reminders

1 item

T-03.3

Beginning Jan 1, 2027 Developers must, on and after January 1, 2027, make available to each deployer of a covered ADMT technical documentation that is reasonably understandable and that protects trade secrets, including: (1) a general statement of intended uses and known harmful or inappropriate uses; (2) a description of the categories of data, including personal data, used to train the ADMT (to the extent known); (3) known limitations, risks, and circumstances in which the ADMT should not be used; (4) instructions for the deployer's appropriate use, monitoring, and meaningful human review; and (5) information reasonably necessary for the deployer to comply with its disclosure obligations under § 6-1-1704. If any information is withheld, the developer must notify the deployer.

Data Controls Data sale restrictions · deidentification

1 item

D-01.2

Human Oversight Decision review · appeal pathways

4 items

H-01.3

H-01.1

H-01.4

H-01.1

Governance Risk management · accountability programs

3 items

G-01.2

Beginning Jan 1, 2027 Developers must provide each deployer of a covered ADMT with notice of material updates, intentional and substantial modifications, and changes to intended use, limitations, or risk mitigation within a reasonable time. Public release notes containing the required information satisfy this obligation if the developer also provides direct notice of the public release to each deployer.

G-01.3

Beginning Jan 1, 2027 Developers must retain records reasonably necessary to demonstrate compliance with § 6-1-1702 for at least three years after the creation of each record (or longer if required by other law). Records include system version identifiers, changelogs, and documentation and notices of material updates provided to deployers.

G-01.3

Passage Likelihood

Enacted

Status Enacted

Legislative History

2026-05-01 Introduced In Senate - Assigned to Business, Labor, & Technology

2026-05-05 Senate Committee on Business, Labor, & Technology Refer Amended to Appropriations

2026-05-06 Senate Committee on Appropriations Refer Amended to Senate Committee of the Whole

2026-05-06 Senate Second Reading Special Order - Passed with Amendments - Committee, Floor

2026-05-07 Senate Third Reading Passed - No Amendments

2026-05-07 Introduced In House - Assigned to Judiciary

2026-05-08 House Committee on Judiciary Refer Amended to Appropriations

2026-05-08 House Committee on Appropriations Refer Unamended to House Committee of the Whole

2026-05-08 House Second Reading Special Order - Passed with Amendments - Committee

2026-05-09 House Third Reading Passed - No Amendments

2026-05-12 Senate Considered House Amendments - Result was to Concur - Repass

2026-05-12 Signed by the President of the Senate

2026-05-12 Signed by the Speaker of the House

2026-05-12 Sent to the Governor

2026-05-14 Governor Signed

Sources

Full Text ↗

Entry Last Reviewed

2026-06-01

AI generated