Legislation to Establish Colorado’s Regulatory Framework on Automated Decision-Making Technology Introduced in Senate

DENVER, CO – Today Senate Majority Leader Robert Rodriguez, D-Denver, and Senate President James Coleman, D-Denver, introduced legislation to establish Colorado’s regulatory framework on automated decision-making technology (ADMT) when it is used to make consequential decisions about an individual.

“Even in the few years since I have been working on AI policy, we have seen it grow from a nascent industry to something that impacts every aspect of our lives,” said Rodriguez. “As AI becomes more widespread, our laws must keep up to ensure transparency and protections against discrimination. If someone is denied housing or a job, loses their healthcare, or sees their insurance rates mysteriously skyrocket at the hands of automated technology, they deserve to know what criteria went into that decision and to have an opportunity to correct mistakes. This bill strikes an appropriate balance of protecting consumers while not being onerous on developers or the businesses who use AI technology.”

“Colorado is leading the way on creating necessary guardrails on AI to protect Coloradans from harm while fostering a vibrant business environment,” said Coleman. “This bill reflects years of work to find the right policy framework for Colorado that protects consumers, requires transparency so that we know how important decisions are being made, and is reasonable for businesses to comply with.”

SB26-189 would update the regulatory framework on ADMT – defined as technology that automatically processes personal data and generates an output used to make, guide, or assist a decision concerning an individual – when such technology is used to make consequential decisions. “Consequential decisions” are defined in the bill as decisions that relate to an individual's access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, healthcare services, or essential government services.

Securing consumer protections

To protect consumers, SB26-189 would require deployers – entities that use an ADMT – to provide a clear notice to consumers when they are interacting with an ADMT covered by the bill. If an ADMT makes a consequential decision that results in an adverse outcome for a consumer, the deployer would be required to provide the consumer with a plain-language description of the technology’s role in the decision and a process to request additional information about the decision within 30 days. In the case of an adverse outcome, consumers would have the right to request correction of factually inaccurate personal data and the right to request meaningful human review.

Implementing and enforcing the new framework

Beginning January 1, 2027, the bill would require ADMT developers to provide a deployer with a description of the technology’s intended uses, categories of data used to train the ADMT, known limitations and risks, and instructions for appropriate use and human review, as well as updates or modifications to the ADMT as they are made.

The legislation requires the Attorney General (AG) to adopt rules that clarify disclosure requirements after an adverse outcome by December 31, 2026. The AG would have exclusive authority to enforce the bill through the "Colorado Consumer Protection Act" and a violation of the bill would be deemed a deceptive trade practice. In the case of an alleged violation, the AG would be required to provide the developer or deployer with a 60 day notice and an opportunity to cure the violation, if a cure is deemed possible. The bill does not create a new private right of action. 

Ensuring balanced responsibility and liability

Under the bill, a developer or deployer of an ADMT may be liable for a violation of existing anti-discrimination law, including the Colorado Anti-Discrimination Act (CADA). It further specifies that any fault in a violation of anti-discrimination law should be allocated based on the relative fault shared between the developer and deployer.

The liability section of SB26-189 establishes that a contract between a developer and deployer cannot indemnify against any liability under the CADA that arises solely from their own actions. The bill is structured to ensure that developers and deployers only have responsibility and liability with regards to the intended use of an ADMT in a consequential decision.

In 2024, Rodriguez passed first-of-its-kind legislation to implement consumer protections in interactions with high-risk artificial intelligence systems. Over the past six months, a task force convened by the governor met to develop and publish a new policy framework. SB26-189 would repeal the 2024 legislation and enact many of the recommendations developed by the task force.

SB26-189 was assigned to the Senate Business, Labor and Technology Committee and will be scheduled for its committee hearing in the coming days. Track its progress here.