Thursday, November 12, 2026 · Boulder, Colorado
Colorado · SB 26-189
Colorado replaced its 2024 AI law with the Automated Decision-Making Technology Act (SB 26-189), signed May 14, 2026 and in effect January 1, 2027. I build the technical pieces Colorado businesses need for it: the inventory, the documentation, the notice and review workflows, and the records.
One boundary, stated plainly: this is technical implementation help, not legal advice. Whether the law covers your business, and what it requires of you specifically, is a question for a Colorado attorney. I work alongside your counsel when you have one. Source: Colorado General Assembly, SB 26-189.
The law covers automated decision-making technology (ADMT) that materially influences a consequential decision: access, eligibility, or compensation related to education, employment, housing, financial or lending services, insurance, health care, or essential government services. For covered ADMT, developers owe deployers technical documentation, and deployers owe consumers notice at the point of interaction, a plain-language description of the system's role within 30 days after an adverse outcome, and a path to meaningful human review. Records are kept for at least three years, and the Attorney General adopts implementing rules by January 1, 2027. Aim to be ready by January 1, 2027: the implementing rules are still pending, and they are the final word when they land.
The law also provides exclusions: advertising, search, security and anti-fraud tools, and tools that only summarise for human review. The inventory is how you tell what falls inside the law from what falls outside. The full checklist is on the Colorado AI Act compliance checklist.
Readiness oversight belongs to a governance owner: see fractional CAIO services. The inventory itself is an architecture job: see architecture review.
A list of every tool in your operation that scores, ranks, classifies, or recommends about people — including features that arrived inside products you bought for other reasons. Most businesses do not have this list, and everything else depends on it.
The technical file the law expects: intended uses, categories of training data, known limitations, and instructions for appropriate use and human review. Written so your team and your counsel can both use it.
The working machinery: notice at the point of interaction, a plain-language description of the system's role within 30 days after an adverse outcome, and a human review queue with reconsideration built in.
Records kept for at least three years, update notifications when a system changes materially, and monitoring that catches drift before it becomes a problem.
It depends on whether you use automated decision-making technology that materially influences a consequential decision — in education, employment, housing, lending, insurance, health care, or essential government services. That coverage call belongs to a Colorado attorney; the inventory on this page is how you get them the facts.
Possibly. If a tool's output materially influences a consequential decision, it can be in scope even if you bought it for something else. The inventory answers that for your specific tools instead of guessing.
The inventory. It is the smallest engagement, it stands on its own, and every later step — documentation, notices, review workflows — is built from it.
The inventory comes first, and scope and timing follow from what it finds. No honest timeline exists before that list does.
Ready to start with the inventory?
Tell me how your business uses AI today and we will scope the inventory from there. I read every message myself and reply within two business days.