The Colorado AI law for small businesses: what SB 26-189 means for you

Where Colorado's AI law stands in November 2026

In May 2024 Colorado passed one of the first broad state AI laws in the country. That law, SB 24-205, would have required a duty of care, risk management programs and impact assessments for "high-risk" AI systems. It never took effect. In an August 2025 special session the legislature passed SB 25B-004, which pushed the start date to June 30, 2026.

Then, on May 14, 2026, Governor Polis signed SB 26-189. It repeals the 2024 provisions and replaces them with a law about "automated decision-making technology," or ADMT. The new law takes effect January 1, 2027 and applies to decisions made on or after that date. The duty of care, the formal risk management program and the impact assessments are gone as explicit requirements. In their place are notices, disclosures, consumer rights and record keeping.

The Colorado Attorney General's office must adopt rules before January 1, 2027. It filed proposed rules on August 11, 2026, released an interim draft on October 6, 2026 and held a public hearing on October 26, 2026. Final rules may still change definitions that matter, such as when a tool "materially influences" a decision. Treat anything you read today, including this page, as provisional until those rules are final.

This page is general information for business owners. It is not legal advice. If any of your tools might be covered, talk to a Colorado employment or privacy lawyer before January 1, 2027.

What the law actually covers, in plain English

Three definitions do most of the work. Automated decision-making technology is software that processes personal data and produces an output, such as a prediction, recommendation, score, ranking or classification, that is used to make or assist a decision about an individual.

A consequential decision is one that affects a person's access to, eligibility for, selection for or pay within one of seven areas: education, employment, housing, financial or lending services, insurance, health care, and essential government services. Covered ADMT is ADMT that "materially influences" one of those decisions, meaning its output is more than a trivial factor and actually affects the outcome.

The exclusions are just as important for a small business. Law-firm summaries of the bill describe these carve-outs:

• Tools used only to summarize, organize, translate, draft, route or present information for a person to review.
• Everyday technology such as calculators, databases, spreadsheets that rely on human analysis, firewalls and antivirus software.
• Chatbots and other conversational tools that are not intended or configured for consequential decisions and are covered by an acceptable use policy that forbids that use.
• Routine operations such as scheduling, administrative routing and workflow management, plus advertising, marketing and fraud prevention.

Will it apply to a 20-person service business?

The definitions in the bill summary turn on how a tool is used, not on how many people you employ. A deployer is simply a person doing business in Colorado that deploys covered ADMT. So the useful question is not "are we big enough" but "do we let software score or screen people in a covered area."

For most service firms, the honest answer is "rarely, and mostly in hiring." Using ChatGPT to draft a proposal, Microsoft 365 Copilot to summarize a meeting, or Zapier to route a web lead into HubSpot is not a consequential decision about a person. The places to look harder are these:

• Hiring: an applicant tracking system or job board feature that ranks, scores or filters candidates before a person reads the application. The law expressly treats Colorado employees and applicants as consumers.
• Pay, promotion and discipline: any tool that scores staff performance and feeds compensation decisions.
• Property management: tenant screening services that return an approve, decline or risk score for a rental application.
• Lending and payment plans: software that decides who is offered financing, for example patient financing at a dental office or payment plans at a contractor.
• Insurance agencies: tools that influence eligibility or pricing for a client. Insurers already regulated under a separate Colorado statute are treated as compliant for insurance practice, but employment decisions are still covered.

Step one: build an AI tool inventory this month

You cannot assess what you have not listed. Most owners undercount, because AI features now arrive inside software they already pay for. Spend an hour with your office manager and list every tool that touches people data. For each one, write down four things:

• The tool and the feature, for example "job board, applicant match score" rather than just the vendor name.
• Who it makes outputs about: clients, applicants, employees or tenants.
• What the output is: a draft or summary a person reads, or a score, rank or recommendation that changes who gets what.
• Whether a person can and does override it, and whether that review is written down anywhere.

Step two: questions to send your vendors

Under SB 26-189, developers of covered ADMT must give deployers documentation describing intended uses, known harmful or inappropriate uses, categories of training data, known limitations and instructions for human review. If a vendor's tool may be covered, ask for that documentation now rather than in December. Useful questions:

• Is this feature marketed or configured to influence hiring, housing, lending, insurance or health care decisions?
• Will you provide the developer documentation SB 26-189 requires, and notify us of material updates?
• What personal data does the score use, and can we export the inputs for a specific decision if a person asks?
• Can we turn the scoring or ranking off and still use the rest of the product?
• Does our contract contain indemnity language? The new law voids clauses that try to shield a party from liability for its own discriminatory use, so ask counsel to review it.

Step three: if a tool is covered, what you would owe

If a tool does materially influence a consequential decision, the deployer duties are specific. They are manageable for a small firm, but they need an owner and a written process.

• A clear notice, before or at the point of interaction, that covered ADMT is or will be used, with a way to get more information. A prominent public notice near the point of interaction can satisfy this.
• Within 30 days of an adverse outcome, such as not hiring someone, a plain-language explanation of the decision and the tool's role, how to request more information, and the person's rights.
• A way for the person to request and correct factually incorrect personal data used in the decision.
• Meaningful human review on request, by a trained person with authority to change the result who does not simply defer to the software.
• Records that show compliance, kept for at least three years, and notices that are accessible to people with disabilities and limited English proficiency.

Enforcement, and a sensible plan for the next 60 days

Only the Colorado Attorney General can enforce SB 26-189, and a violation counts as a deceptive trade practice under the Colorado Consumer Protection Act. The law does not create a new private right of action, although existing anti-discrimination claims remain, with fault split between developer and deployer. Until January 1, 2030, the Attorney General must generally give 60 days' notice and a chance to cure before acting, except for knowing or repeated violations.

A practical plan for a small firm: finish the inventory, switch off any ranking features you do not need, send the vendor questions, draft a short notice and a human review procedure for hiring, and watch for the final rules. Many firms will find nothing covered, and that is a fine result if it is documented.

If you want a second pair of eyes on the inventory, InTheory can run it as part of an AI policy review and hand the legal questions to your counsel. We are not lawyers and do not give legal advice.