Colorado's Automated Decision-Making Technology Act (SB 26-189) has reached its decisive moment: on October 26, 2026, the Colorado Attorney General's Office holds a public hearing on the law's implementing rules, and written comments close at 11:59 p.m. Mountain Time the same day. If the hearing runs past October 26, the comment period stays open through its final day. The law applies to consequential decisions made on or after January 1, 2027, leaving businesses just over two months to prepare.
What exactly does this law cover?
First, the boundary: this is a single U.S. state law from Colorado, not a nationwide rule and certainly not a global standard. It covers automated decision-making technology that materially influences consequential decisions in education, employment, housing, lending and other financial services, insurance, health care, and essential government services. The Chatbot Safety Act (HB 26-1263), passed alongside it, is moving through the same rulemaking and covers conversational AI services, including safeguards for minors and annual reports to the Attorney General.
There is also a history trap: SB 24-205, passed in 2024 and originally due to take effect June 30, 2026, was repealed and replaced by SB 26-189, signed May 14, 2026. A compliance program still built around the old law's impact-assessment model now has to be rebuilt, because the new law sits closer to each individual decision, and some of its duties are harder to operationalize.
The October 6 interim draft: a workable test for material influence
The Attorney General's Office filed proposed rules on August 11, 2026, and published an interim revised draft on October 6. Its most important addition is a workable presumption: when a decision-maker reviews an output about the individual, such as a score, ranking, recommendation, or threshold, and that output is consistent with the final outcome, the system is presumed to have materially influenced the decision. A deployer may rebut the presumption by showing the output was only a de minimis factor. Conversely, tools used solely to summarize, organize, or present information for human review fall outside the technology's definition.
The draft's example is blunt: a credit union denying loans to applicants scoring below a risk-score threshold counts as materially influenced. Equally important, outsourcing the system does not outsource responsibility: a deployer that uses a third party's output to make a decision remains responsible for it.
What developers and deployers each owe
Developers owe documentation: intended uses, training-data categories, known limitations, and appropriate human-review methods must reach downstream users, and compliance records must be kept for at least three years. Deployers owe what comes after the decision: notice before the system is used; a plain-language explanation within 30 days after an adverse consequential decision; a chance for the individual to correct inaccurate personal data; and meaningful human review and reconsideration.
Where the risk sits: an enforcement pause is not a work stoppage
A federal court order, based on the parties' joint motion, currently bars the Attorney General from initiating enforcement for the period specified in the order. That does not change January 1, 2027 as the statutory compliance date, and the rulemaking aims to have rules in place before then. More importantly, the pause covers the Attorney General's enforcement, not other legal exposure such as discrimination claims, and a contract clause making the customer fully responsible cannot transfer a developer's own share of responsibility.
Three things to do now: first, inventory which systems materially influence consequential decisions about Colorado residents, with hiring, lending, and insurance underwriting at the top of the list; second, close the gaps in output logging, notice templates, and human-review workflows, since record gaps cannot be filled in a week or two; third, file comments before the October 26 deadline on the material-influence test and third-party responsibility, because changing a finalized rule costs far more than shaping a draft.
