Colorado's AI Act and the Consequential Decision: What the Reenacted Part 17 Says

The Statute That Defined the Term Was Repealed Before It Applied

Senate Bill 24-205, approved in May 2024, was the first American statute to build a general regulatory scheme around artificial intelligence, and it did so by defining a class of decisions worth regulating. It never took effect in that form. Its obligations were originally keyed to February 1, 2026. Senate Bill 25B-004, enacted in the 2025 special session, struck that date and substituted "JUNE 30, 2026" in each place it appeared, under a title concerning "MEASURES EFFECTIVE NO LATER THAN JUNE 30, 2026."

The second intervention was structural rather than calendrical. Senate Bill 26-189, titled "CONCERNING THE USE OF AUTOMATED DECISION-MAKING TECHNOLOGY IN CONSEQUENTIAL DECISIONS, AND, IN CONNECTION THEREWITH, MAKING AN APPROPRIATION," was signed on May 14, 2026. Its section 1 reads: "In Colorado Revised Statutes, repeal and reenact, with amendments, part 17 of article 1 of title 6." The part that replaces it is headed "AUTOMATED DECISION-MAKING TECHNOLOGY IN CONSEQUENTIAL DECISIONS."

Section 5 of the act sets the timing. Except for a handful of provisions taking effect on passage — sections 6-1-1704(4), 6-1-1705(3) and 6-1-1706(6), a subsection of the insurance provisions, the appropriation, the effective-date section itself and the safety clause — "this act takes effect January 1, 2027." Subsection (3) adds that the act "applies to consequential decisions made on or after January 1, 2027."

What a Consequential Decision Now Means

The 2024 statute defined a consequential decision as one having "A MATERIAL LEGAL OR SIMILARLY SIGNIFICANT EFFECT ON THE PROVISION OR DENIAL TO ANY CONSUMER OF, OR THE COST OR TERMS OF" eight enumerated items. The reenacted definition at section 6-1-1701(3)(a) is built differently. It reaches a decision, determination or action made about a consumer "THAT RELATES TO THE PROVISION OF OR A CONSUMER'S ACCESS TO, ELIGIBILITY FOR, SELECTION FOR, OR COMPENSATION FOR A COVERED DOMAIN," and separately reaches decisions about differentiated price, cost sharing, compensation or other material terms in a manner "REASONABLY LIKELY TO MATERIALLY LIMIT, DELAY, EFFECTIVELY DENY, OR OTHERWISE FUNDAMENTALLY ALTER" the consumer's access, eligibility or opportunity for a covered domain.

"Covered domain" is itself defined, at section 6-1-1701(6), by a list of seven: education enrollment or an education opportunity; employment or an employment opportunity "THAT CREATES OR MAY CREATE AN EMPLOYER-EMPLOYEE RELATIONSHIP"; the lease or purchase of residential real estate in Colorado; a financial or lending service; insurance, "INCLUDING UNDERWRITING, PRICING, COVERAGE, CLAIMS ADJUDICATION, OR OTHER DETERMINATIONS THAT MATERIALLY AFFECT ACCESS TO BENEFITS"; health-care services; and essential government services and public benefits, "INCLUDING ELIGIBILITY AND RENEWAL DETERMINATIONS."

Two of those are narrower than the 2024 list they replace. The employment entry now turns on an employer-employee relationship, and the housing entry has become the lease or purchase of residential real estate in Colorado, where the earlier statute said only "HOUSING." The 2024 list's standalone entry for "A LEGAL SERVICE" has no counterpart in the covered domains.

What the Definition Excludes

Section 6-1-1701(3)(b) carries an exclusion list that has no analogue in the 2024 text, and it does substantial work. A consequential decision does not include low-stakes or routine decisions, actions and business processes that do not materially influence eligibility, selection, denial, compensation, pricing or access for a covered domain, and the paragraph names examples: "ROUTINE SCHEDULING, CLASSROOM PERSONALIZATION, ADMINISTRATIVE ROUTING, CUSTOMER SERVICE TRIAGE, COMMUNICATION OF DECISIONS, OR WORKFLOW MANAGEMENT."

The remaining exclusions are: "ADVERTISING, MARKETING, DIFFERENTIATED PRODUCT RECOMMENDATIONS, SEARCH, OR CONTENT MODERATION"; spreadsheets requiring manual human analysis that do not use machine learning, foundation models or large language models; uses in which an ADMT summarises, organises or presents information for human review without producing "A SCORE, RANKING, RECOMMENDATION, CLASSIFICATION, PREDICTION, OR OTHER INFERENCE THAT MATERIALLY INFLUENCES AN OUTCOME OR A DECISION"; narrow procedural tasks or data-processing functions that generate no prediction or inference about a consumer; technologies used for cybersecurity, spam and robocall filtering, system reliability, and anti-money-laundering and counter-terrorist-financing controls; and technologies used for economic sanctions compliance, with facial recognition excluded from that carve-out unless its sole purpose is confirming identity.

Covered ADMT, Developers and Deployers

The regulated object has been renamed and redefined. Section 6-1-1701(2)(a) defines automated decision-making technology as "A TECHNOLOGY THAT PROCESSES PERSONAL DATA AND USES COMPUTATION TO GENERATE OUTPUT, INCLUDING PREDICTIONS, RECOMMENDATIONS, CLASSIFICATIONS, RANKINGS, SCORES, OR OTHER INFORMATION THAT IS USED TO MAKE, GUIDE, OR ASSIST A DECISION, JUDGMENT, OR DETERMINATION CONCERNING AN INDIVIDUAL," and subsection (b) excludes a named list including anti-malware, anti-virus, calculators, databases, data storage, firewalls, internet domain registration, website loading, networking, and spam and robocall filtering.

Obligations attach only one level up. Section 6-1-1701(5) defines a "COVERED ADMT" as automated decision-making technology "USED TO MATERIALLY INFLUENCE A CONSEQUENTIAL DECISION." A deployer, under subsection (7), is "A PERSON DOING BUSINESS IN COLORADO THAT DEPLOYS A COVERED ADMT." A developer, under subsection (8)(a), is a person doing business in Colorado that develops, offers, sells, leases, licenses or otherwise makes a covered ADMT commercially available, develops a component contracted to be used as part of one, or intentionally and substantially modifies an ADMT so that it becomes a covered ADMT. Subsection (8)(b) excludes persons who develop and use an ADMT solely for research not involving a consequential decision, or for internal purposes without making it available to another person for use in a consequential decision.

The Duty That Did Not Survive

The centrepiece of the 2024 statute was a duty of reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination, imposed on developers and deployers alike, with a rebuttable presumption of care attached to compliance. The phrase "algorithmic discrimination" does not appear anywhere in part 17 as reenacted by SB 26-189. Neither the defined term nor the duty built on it is carried forward.

What replaces it is a disclosure and process architecture. Section 6-1-1702 requires a developer, on and after January 1, 2027, to make available to each deployer of its covered ADMT — in a form reasonably understandable to a deployer, and protecting trade secrets and information protected from disclosure by law — a general statement of intended uses and known harmful or inappropriate uses; a description of the categories of data used to train it, to the extent known; known limitations, including known risks and circumstances in which it should not be used; instructions for appropriate use, monitoring and meaningful human review; and information reasonably necessary for the deployer to comply with section 6-1-1704. Where information is withheld, the developer notifies the deployer. Section 6-1-1703 imposes deployer record keeping.

Notice, Adverse Outcomes and Consumer Rights

Section 6-1-1704(1) requires a deployer, before using a covered ADMT to materially influence a consequential decision, to give the consumer a clear and conspicuous notice that it used or will use one, together with instructions for obtaining the further information the section describes. Subsection (2) allows that to be discharged by "MAINTAINING A PROMINENT PUBLIC NOTICE THAT IS REASONABLY ACCESSIBLE AT POINTS OF CONSUMER INTERACTION," including through a link or posting reasonably proximate to the interaction in which a consequential decision may occur.

The heavier disclosure is triggered by outcome. Where a covered ADMT materially influences a consequential decision resulting in an adverse outcome, section 6-1-1704(3) requires the deployer, within thirty days after making the decision, to provide a plain-language description of the decision and the role the covered ADMT played; instructions and a simple-to-follow process to request further information about the technology and its inputs, including its name, version number where applicable, its developer, and the types, categories and sources of personal data used, to the extent the deployer received that information from the developer; and an explanation of the section 6-1-1705 rights and how to exercise them. "Adverse outcome" is defined at section 6-1-1701(1) to cover both a decision denying, terminating, revoking or materially reducing access, eligibility, selection, compensation or provision of an opportunity or service, and one producing materially less favourable differentiated terms than those offered to similarly situated consumers.

Section 6-1-1705(1)(a) gives a consumer who experiences such an adverse outcome the right to request, and obliges the deployer to provide, instructions for requesting personal data and correcting factually incorrect or materially inaccurate personal data consistent with section 6-1-1306, and "AN OPPORTUNITY FOR MEANINGFUL HUMAN REVIEW AND RECONSIDERATION OF THE CONSEQUENTIAL DECISION, TO THE EXTENT COMMERCIALLY REASONABLE." Subsection (1)(c) provides that this does not require correction of "OPINIONS, PREDICTIONS, SCORES, OR PROTECTED EVALUATIONS." Subsection (2)(a) lets a deployer subject to FERPA satisfy the requirement through existing student record inspection, review and amendment procedures.

Enforcement, Cure, and No Private Right of Action

Section 6-1-1706(1)(a) provides that the Attorney General "SHALL ENFORCE THIS PART 17 THROUGH THE 'COLORADO CONSUMER PROTECTION ACT'," and subsection (1)(b) makes violations of the disclosure requirements and consumer rights in sections 6-1-1702 through 6-1-1705 "ENFORCEABLE EXCLUSIVELY BY THE ATTORNEY GENERAL WITHOUT REGARD TO ANY OTHER PROVISION IN THIS TITLE 6." Subsection (2)(a) makes a violation a deceptive trade practice, and section 2 of the act adds a corresponding paragraph to the list in section 6-1-105(1).

A cure period is built in. Under subsection (3)(a) the Attorney General issues a notice of violation before any enforcement action "IF A CURE IS DEEMED POSSIBLE BY THE ATTORNEY GENERAL," and under subsection (3)(b) may bring an action if the developer or deployer fails to cure within sixty days of receipt. Subsection (3)(c) removes that step where the Attorney General finds and can demonstrate a knowing or repeated violation.

Section 6-1-1709 closes the question of who else may sue: "NOTHING IN THIS PART 17 CREATES A NEW PRIVATE RIGHT OF ACTION," and subsection (2) adds that compliance with part 17 "DOES NOT CONSTITUTE A DEFENSE TO AND DOES NOT EXCUSE NONCOMPLIANCE WITH ANY APPLICABLE LAW." Section 4 appropriates $46,190 to the department of law for the 2026-27 fiscal year, on an assumption of an additional 0.4 FTE.

The Chronology in One Place

One consequence of this sequence is worth stating plainly: no version of Colorado's artificial intelligence statute has yet imposed an operative obligation on anyone. The 2024 framework was postponed past its original date and then repealed before the substituted date arrived, and the framework that replaced it attaches prospectively to decisions made on or after January 1, 2027. Commentary written between 2024 and early 2026 describes a statute that was superseded before it applied.

Frequently Asked Questions