Colorado's New AI Laws: What Businesses Must Do by 2027

What changed

Colorado repealed and replaced the 2024 Colorado AI Act (SB 24-205) with two laws: the Automated Decision-Making Technology Act (SB 26-189) and the Chatbot Safety Act (HB 26-1263). Both are scheduled to take effect on January 1, 2027, and the Colorado Attorney General is writing implementing rules.

Details may change as rulemaking finishes. Check the Attorney General's AI rulemaking page for current requirements, and get legal advice for your situation.

The ADMT Act: decisions about people

The ADMT Act covers technology that processes personal data and materially influences a consequential decision about a consumer. That includes decisions about access to, eligibility for or the cost of:

employment, such as screening, ranking and promotion;
housing, such as tenant screening;
lending and financial services;
insurance;
education;
health care;
legal services and essential government services.

A tool does not have to make the final decision to be covered; a score or recommendation that people rely on in a meaningful way can count.

What deployers must do

A deployer is a business that uses covered technology, even if a vendor built it. Summaries of the law describe these duties:

Notice before use: a clear notice at the point of interaction that covered technology is used.
Explanation after an adverse outcome: a plain-language description of the technology's role within 30 days of a decision that goes against the consumer.
Consumer rights: to see the personal data used, correct inaccurate data and request meaningful human review and reconsideration, to the extent commercially reasonable.
Records: keep the records needed to show compliance for at least three years.

Developers, the companies that build covered tools, must give deployers documentation on intended uses, training data categories, known limitations and appropriate human review, so vendor contracts matter.

The Chatbot Safety Act: AI that talks to the public

The Chatbot Safety Act covers operators of conversational AI services available to the general public. Operators must tell users they are interacting with AI, not a person, and the law adds duties around minors, including age estimation and safeguards against harmful content. Customer support bots, sales assistants and app chat features can all be in scope.

Our guide on telling customers you used AI has sample disclosure wording, and chatbot liability covers the wider risks.

Enforcement

The Colorado Attorney General enforces both laws; there is no new private right to sue under the ADMT Act. Summaries report that, before 2030, the Attorney General must give a notice and a chance to fix a problem before bringing an action. Do not treat that as a reason to wait; documentation takes time.

First steps before January 1, 2027

Inventory every system that influences decisions about people: applicant tracking, screening, scoring, underwriting, tenant screening and vendor dashboards.
List every chatbot customers can reach: website chat, in-app assistants, text bots and voice agents.
Classify your role for each: developer, deployer, operator or a customer of a vendor.
Ask vendors for the documentation the law expects and who handles consumer requests.
Draft notices people can understand and an adverse-decision explanation template.
Set up a request process for data access, correction and human review, with a named reviewer who can change the outcome.
Start keeping records now.

If you are outside Colorado

Selling to, hiring in or serving people in Colorado can bring you in scope even if you are based elsewhere. Other states and cities have their own rules, such as New York City's hiring-tool audit law; see our guide to AI hiring tools.

Where ASL fits

Auto Secure Login, founded in 2017, works with Colorado businesses. Our AI consulting work starts with the kind of inventory this law needs, and our custom software development team builds notices, request handling and record-keeping into your tools. We are not a law firm; pair us with your counsel. Contact us to talk it through.

Frequently asked questions

Did Colorado repeal its AI Act?

Yes. In 2026 it repealed and replaced the 2024 Colorado AI Act (SB 24-205) with the Automated Decision-Making Technology Act (SB 26-189) and the Chatbot Safety Act (HB 26-1263), both scheduled for January 1, 2027.

What counts as a consequential decision?

A decision about a consumer's access to, eligibility for or cost of employment, housing, lending and financial services, insurance, education, health care, legal services or essential government services.

What must a business tell consumers?

Give notice that covered technology is used, and after an adverse decision, a plain-language explanation of the technology's role within 30 days, plus ways to correct data and request human review.

Does the Chatbot Safety Act apply to my website chat?

It covers conversational AI services offered to the public. Operators must disclose that users are talking to AI and follow added protections for minors. Check the final rules and get legal advice.

Where can I find the official rules?

The Colorado Attorney General's AI rulemaking page at coag.gov/ai and the bill pages on the Colorado General Assembly website.

Related guides

Explore the complete product

Read features, current access and limitations