Colorado ADMT Act Checklist: What Deployers Need by January 1, 2027

The Colorado ADMT Act (SB 26-189, signed May 14, 2026) takes effect January 1, 2027 and applies to consequential decisions made on or after that date. It repeals and reenacts C.R.S. §§ 6-1-1701 to -1709, replacing the 2024 Colorado AI Act (SB 24-205). If your business uses software that scores, ranks, or recommends outcomes for people in areas like hiring, lending, insurance, or residential real estate, this checklist walks through what the statute requires deployers to do and what records show you did it.

Does the Colorado ADMT Act apply to your business?

The Act applies to a deployer: a person doing business in Colorado that uses a covered ADMT. Covered ADMT is technology that processes personal data and whose output is used to materially influence a consequential decision in one of seven domains (§ 6-1-1701). "Consumer" includes employees, Colorado-resident job applicants, and anyone whose access or eligibility in Colorado is evaluated in a consequential decision.

The seven covered domains

• Education enrollment or an education opportunity
• Employment or an employment opportunity that creates or may create an employer–employee relationship
• The lease or purchase of residential real estate in Colorado
• Financial or lending services
• Insurance, including underwriting, pricing, coverage, and claims
• Health-care services
• Essential government services and public benefits

Legal services, which appeared in the 2024 law, is not on the list.

What does "materially influence" mean?

An output materially influences a decision when it is a non-de minimis factor used in making the decision and it affects the outcome, including by constraining, ranking, scoring, recommending, or classifying (§ 6-1-1701(13)). Incidental, trivial, or clerical uses do not count. The Attorney General is weighing two ways to define "de minimis" in rules: a "trifling, trivial, or incidental" test and a "not a substantial factor" test. Neither is final.

What is excluded?

• Summarize-and-draft tools. A tool used solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing is not ADMT (§ 6-1-1701(2)(b)(II)). Note the full phrase: the exclusion is narrower than any drafting tool.
• General chat tools kept out of decisions. Consumer-facing conversational technology is not ADMT if it is not contracted, marketed, configured, or intended for consequential decisions and is subject to an acceptable use policy that prohibits using its content in one (§ 6-1-1701(2)(b)(III)).
• Routine processes. Routine scheduling, customer service triage, communication of decisions, advertising, and marketing are not consequential decisions (§ 6-1-1701(3)(b)).
• HIPAA entities, except employment. HIPAA covered entities and their business associates are largely exempt, but not for employment decisions; covered entities must still give patients a general notice of advanced technologies (§ 6-1-1708(3), as enacted by SB 26-189).
• Insurers. Insurers subject to § 10-3-1104.9 are deemed compliant in the practice of insurance (§ 6-1-1708(1), as enacted by SB 26-189).

There is no small-business exemption. A ten-person property manager using a tenant-screening score is treated the same as a national lender.

What are the five deployer duties under the ADMT Act?

The statute requires deployers to give notice before use, explain adverse outcomes, honor data and review requests, and keep records. Each duty below lists the section and the artifact that would show you met it.

1. Pre-use notice — § 6-1-1704(1)–(2)

Before using covered ADMT in a consequential decision, a deployer must give a clear and conspicuous notice that it uses or will use covered ADMT, with instructions for getting more information. Subsection (2) says a prominent public notice, reasonably accessible at points of consumer interaction (such as a link near the application), satisfies the duty. Evidence: the notice text, dated screenshots of where it appears, and the approval record.

2. Adverse-outcome disclosure within 30 days — § 6-1-1704(3)

If covered ADMT materially influences a decision that results in an adverse outcome, the deployer must provide, within 30 days: a plain-language description of the decision and the role the ADMT played; a simple process to request more information (including the tool's name, version number, developer, and the types, categories, and sources of personal data used); and an explanation of the consumer's rights. A creditor's ECOA or FCRA adverse-action notice can satisfy this duty if it also covers these elements (§ 6-1-1704(6)). Evidence: a disclosure template, a send log with decision and delivery dates, and the vendor documentation that supplied the version and data details.

3. Data access and correction — § 6-1-1705(1)(a)(I)

After an adverse outcome, a consumer may request instructions for obtaining the personal data used and correcting data that is factually incorrect or materially inaccurate. The duty does not extend to correcting opinions, predictions, or scores (§ 6-1-1705(1)(c)). Evidence: a written intake procedure, a request log with response dates, and a data map showing which inputs feed each tool.

4. Meaningful human review — § 6-1-1705(1)(a)(II)

The consumer may also request meaningful human review and reconsideration "to the extent commercially reasonable." The statute defines the reviewer as someone the deployer designates with authority to approve, modify, or override the decision, who considers relevant primary evidence, is trained, does not default to the system output, and has access to enough information to understand the output's intended use, limitations, inputs, and principal factors (§ 6-1-1701(15)). Evidence: reviewer designations, training records, and a review log. See how to design meaningful human review.

5. Three-year records — § 6-1-1703

Deployers must keep records reasonably necessary to demonstrate compliance for at least three years after each consequential decision. Records may include ADMT version identifiers, changelogs, and documentation of material mitigation changes. Evidence: a retention schedule, a decision log, and a version-and-change log for each tool.

Developers owe deployers documentation under § 6-1-1702: intended uses and uses to avoid, training-data categories to the extent known, known limitations and risks, and monitoring and human-review instructions. Contract clauses that shift liability for a party's own discriminatory acts are void (§ 6-1-1707(7)). Our AI vendor due diligence questions cover what to ask for.

What would the proposed Attorney General rules add?

The Attorney General's proposed rules, 4 CCR 904-6, filed August 11, 2026, would add detail to each duty. They are proposed, not final. The AG said it would post any pre-hearing changes by September 23, 2026; check coag.gov/ai for the current version before relying on any rule number.

• Rule 3.2: every consumer notice in plain language and accessible, following WCAG 2.2 for online content.
• Rule 4.2: a "Midstream Developer" that builds on another company's ADMT would pass upstream documentation down to its customers.
• Rule 6: adverse-outcome disclosures would need specific principal reasons ("internal standards or policies" is expressly insufficient), the effective date, a simple process for more information, and at least two delivery methods where available.
• Rule 7: consumer requests answered within 45 days, at least two request methods, and no requirement to create a new account.
• Rule 7.7: the reviewer would be independent (not the original decision-maker or that person's subordinate, whenever feasible), trained, given meaningful authority, and shielded from steering and retaliation; "ADMT may not assist in the Meaningful Human Review." Review is presumed commercially reasonable when the harm is "a severe and irreversible denial of a basic human need," and the deployer's size and capacity is one factor.

How is the Colorado ADMT Act enforced?

Only the Colorado Attorney General enforces the Act. A violation is a deceptive trade practice under the Colorado Consumer Protection Act, with penalties of up to $20,000 per violation under the Consumer Protection Act (C.R.S. § 6-1-112). Before acting, the Attorney General must send a notice of violation and allow 60 days to cure, but only where the Attorney General deems a cure possible, and not for knowing or repeated violations. The cure provision sunsets January 1, 2030. The Act creates no private right of action (§ 6-1-1709), but existing claims, including under the Colorado Anti-Discrimination Act, remain available, and complying with the Act is not a defense under other law.

The 2024 law's duty of care regarding algorithmic discrimination, impact assessments, risk-management-program mandate, and Attorney General discrimination notices do not carry over.

What should an ADMT Act readiness checklist include?

A readiness checklist pairs each statutory duty with a document you can produce on request. The FAIIR control column shows where each item sits in the FAIIR framework.

What are the key ADMT Act dates?

Written comments go through the Attorney General's comment portal. If your business also runs a customer-facing chatbot, a separate law applies; see our Colorado Chatbot Safety Act guide.

Where FAIIR fits

The FAIIR standard's 41 pass/fail controls are mapped to the ADMT Act's deployer duties and benchmarked to the NIST AI Risk Management Framework, so the evidence above can be organized once and reviewed annually. Colorado law does not require, create, or recognize any third-party AI certification, and FAIIR certification is documented proof of reasonable care, not a guarantee of compliance.

This article is general information from FAIIR, LLC, which is not a law firm, and is not legal advice. Colorado law does not require or recognize any third-party AI certification, and FAIIR certification is not a government approval or a guarantee of compliance. For advice about your situation, consult a licensed attorney.