Thursday, November 12, 2026 · Boulder, Colorado
Colorado AI Act Readiness · SB 26-189
SB 26-189, the Automated Decision-Making Technology Act, takes effect January 1, 2027. This is the technical checklist for getting ready: what to inventory, what to document, what to tell people, and what to keep.
One boundary, stated plainly: this is technical implementation help, not legal advice. Whether the law covers your business, and what it requires of you specifically, is a question for a Colorado attorney. I work alongside your counsel when you have one. Aim to be ready by January 1, 2027; the Attorney General’s implementing rules are still pending, and they are the final word when they land. Source: Colorado General Assembly, SB 26-189.
List every tool in your operation that scores, ranks, classifies, or recommends about people, including features that arrived inside products you bought for other reasons. Most businesses do not have this list, and everything else depends on it.
The law covers automated decision-making technology that materially influences a consequential decision in education, employment, housing, financial or lending services, insurance, health care, or essential government services. Screen each inventoried system against these domains.
The law provides exclusions: advertising, search, security and anti-fraud tools, and tools that only summarise for human review. The inventory is how you tell what falls inside the law from what falls outside.
For covered systems, collect the developer documentation: intended uses, categories of training data, known limitations, and instructions for appropriate use and human review, plus notice when a system changes materially.
Notice at the point of interaction, a plain-language description of the system’s role within 30 days after an adverse outcome, and a process for correcting the data behind a decision.
A human review queue with reconsideration built in: a person who can look at the case, the data, and the system’s role, and change the outcome. Review is a working process, not a statement.
Records kept for at least three years, with monitoring that catches drift before it becomes a problem, and contracts that allocate who owes what between developer and deployer.
It depends on whether you use automated decision-making technology that materially influences a consequential decision in one of the seven domains. That coverage call belongs to a Colorado attorney; the inventory is how you get them the facts.
Possibly. If a tool’s output materially influences a consequential decision, it can be in scope even if you bought it for something else. The inventory answers that for your specific tools instead of guessing.
The inventory. It is the smallest engagement, it stands on its own, and every later step (documentation, notices, review workflows) is built from it.
Ready to start with the inventory?
Tell me how your business uses AI today and we will scope the inventory from there. I read every message myself and reply within two business days.