Colorado's New AI Law: What Small Businesses Owe in 2027

Starting January 1, 2027, a business that uses software to score, rank or screen people in Colorado for a job, housing, a loan, insurance, health care or education has to tell them up front. If the decision goes against someone, the business has to explain the software's role within 30 days and, on request, let them correct their data and get a human review where that's commercially reasonable. That's Colorado Senate Bill 26-189, signed May 14, 2026, and it has no exemption based on company size.

The Attorney General's office released interim draft rules on October 6, 2026 and scheduled its public hearing for October 26. The law says final rules must be adopted on or before January 1, 2027.

Does it apply to my business?

It applies if you do business in Colorado and use a covered tool in one of seven areas the act calls "covered domains": education, employment, buying or renting a home in Colorado, financial or lending services, insurance, health care, and essential government services and public benefits. The act calls you a "deployer".

The Attorney General's regulatory analysis, published October 21, says the act and rules apply to entities in covered domains "regardless of size or where they are located." The signed act contains no headcount exemption, so check any summary that mentions one against the text.

Employees and job applicants who are Colorado residents count as consumers, so a ten-person firm whose applicant tracking system screens Colorado applicants can be in scope.

HIPAA covered entities are exempt from the core duties except for employment decisions, though they owe patients a general notice. A creditor whose federal Equal Credit Opportunity Act notice also covers what Colorado asks for doesn't have to send a second one.

What counts as a covered tool?

Automated decision-making technology (ADMT) is technology that processes personal data and computes an output, such as a score, ranking or recommendation, used to make, guide or assist a decision about a person. It is "covered" when its output is a non-de minimis factor in a consequential decision and affects the outcome.

Spreadsheets that need human analysis and don't use machine learning or large language models are excluded. So is a tool someone uses only to summarize, organize, translate, draft, route or present information for human review. Advertising, marketing, routine scheduling and customer service triage are not consequential decisions.

General chatbots get a conditional exclusion. They're out only if nobody sells, configures or intends them for these decisions, and they're subject to an acceptable use policy that bars using their output in a consequential decision. If your team pastes résumés into a chatbot and asks it to pick the best three, that condition is hard to meet.

Under draft Rule 6.1, an output is presumed to materially influence a decision if it "constrains an option set, sets a threshold, or produces a rank, score, classification, recommendation, prediction, or other inference" about the person, the decision maker sees it or it screens what they see, and it matches the outcome. You can rebut that with evidence, such as a decision that went against the tool's output or a reviewer who did an independent analysis. Several commenters objected to the presumption, and the Attorney General's October 6 cover letter asks for alternatives, so this part may change.

What do you have to do from January 2027?

The act defines meaningful human review. The reviewer is someone you designate who can approve, change or override the decision, is trained, considers the relevant evidence, and "does not default to the system output".

Your vendors have duties too. A developer has to give you documentation, including intended uses, known limitations and what you need for your own disclosures, and tell you about material updates. A contract clause that indemnifies either party for its own violations of Colorado anti-discrimination law is void, with a narrow exception for developers whose tool was used in ways they never intended.

Who enforces it?

Only the Attorney General enforces it, and a violation is a deceptive trade practice under the Colorado Consumer Protection Act. Where a fix is possible, the office must send a notice of violation first and give you 60 days to cure it, unless the violation was knowing or repeated. That cure rule is repealed on January 1, 2030. The act creates no new private right of action, but people keep their existing rights under the Colorado Anti-Discrimination Act.

Section 6-1-1707(9) also rules out blaming the software: "The use of an ADMT in a consequential decision does not excuse, justify, or provide a defense to any obligation or liability under state or federal law."

On timing, the cover letter says the Attorney General's policy has been "to focus on egregious and intentional violations of the law" and that the office will use discretion while companies come into compliance.

A real case: Earnest's knockout rule and decline reasons

This is a public case, not one of our engagements.

In July 2025 the Massachusetts Attorney General settled with Earnest Operations LLC, a student loan company, through an assurance of discontinuance filed in Suffolk County Superior Court. Earnest denied the allegations and agreed to pay $2,500,000.

The first allegation that maps onto Colorado's law was a knockout rule. Until June 30, 2023, according to the assurance, "if the applicant did not have at least a green card, the applicant would be automatically denied," before a full application and "without any determination of creditworthiness or ability to repay."

The second was the notices sent to declined applicants. Staff picked decline reasons from a hard-coded drop-down menu that, in some versions, left out educational variables the models used. The assurance says: "When an Earnest employee declined an application for a reason that was unavailable in the drop-down menu, the employee would select another reason that was available." When a model that wrote decline reasons failed to produce one, an employee had to work out why the model declined the application, without insight into why.

The Attorney General also alleged that "Earnest failed to test its Models for disparate impact." The settlement requires a written governance program, an inventory of underwriting models and knockout rules, annual fair lending testing, interpretable models, validated decline reasons, four years of decision records and compliance reports.

Colorado's 30-day disclosure asks for the role the tool played in each decision. If your staff can't say why the software said no, you can't write that letter. Colorado's draft rules also let a consistently applied hard cut-off count as evidence against material influence, but Earnest's knockout rule was exactly that kind of cut-off, denying every applicant without at least a green card, and it still drew a discrimination allegation. Falling outside the notice duty doesn't put a tool outside anti-discrimination law.

What should a small business do before January 1?

• List every tool that scores, ranks, filters or recommends people in the seven domains. Include the knockout questions in your applicant tracking system, tenant screening reports and any automated credit or insurance decisioning.
• For each one, write down whether it materially influences the decision, and why. Assume the draft presumption applies unless you can show otherwise.
• Ask each vendor for the documentation the act requires, and read your contract for indemnity terms Colorado will void.
• If staff use a general chatbot, make sure your AI acceptable use policy bars its output from these decisions.
• Draft the public notice and the 30-day adverse outcome letter. If you can't explain the tool's role in a real past decision, fix that first.
• Name your reviewers, train them, and give them authority to override.
• Keep decision records for at least three years.

This is a summary of the statute and draft rules, not legal advice. Have Colorado counsel confirm how it applies to you.

If you want help with the governance side of this, our AI solutions page covers the AI governance, policy and documentation work we do.

Sources

• Colorado General Assembly, SB26-189, Automated Decision-Making Technology (bill page; history shows Governor Signed 05/14/2026).
• Colorado General Assembly, Senate Bill 26-189, signed act (PDF). C.R.S. 6-1-1701 to 6-1-1709 as reenacted; section 5 (effective date January 1, 2027; applies to consequential decisions made on or after that date).
• Colorado Department of Law, Automated Decision-Making Technology & Chatbot Safety Rulemaking (interim draft October 6, 2026; regulatory analysis October 21, 2026; hearing October 26, 2026).
• Colorado Department of Law, ADMT & Chatbot Act Rules, 4 CCR 904-6, interim draft redline (PDF), October 6, 2026. Rule 6.1.
• Colorado Department of Law, Interim Draft Rules cover letter (DOCX), October 6, 2026.
• Colorado Department of Law, Regulatory Analysis for Rules Governing the ADMT and Chatbot Safety Acts (PDF), October 21, 2026.
• Massachusetts Attorney General, Assurance of Discontinuance, In the matter of Earnest Operations LLC (mass.gov PDF, archived copy), paras. 5, 7, 45, 46, 52, 58, 64, 67, 75, 76, 78, 86.
• Massachusetts Attorney General, AG Campbell Announces $2.5 Million Settlement With Student Loan Lender For Unlawful Practices Through AI Use (archived copy), July 10, 2025.