Colorado Gov. Jared Polis on May 14 signed into law Senate Bill 26-189, which repeals and replaces Colorado’s controversial AI law that was enacted in 2024 and would have gone into effect June 30. The new law will go into effect Jan. 1, 2027.
SHIFT FROM AI TO ADMT
The focus of the new law is automated decision-making technology (ADMT), and specifically “covered ADMT” which is that used to materially influence consequential decisions affecting consumers. A consequential decision is, in part, “a decision, determination, or action made about a consumer that relates to the provision of or a consumer’s access to, eligibility for, selection for, or compensation for… a financial or lending service.”
DEPLOYER RESPONSIBILITIES
A deployer of covered ADMT must provide notice to a consumer that it used or will use covered ADMT to make a consequential decision affecting the consumer. If use of covered ADMT results in an adverse outcome for a consumer, the deployer must provide:
- A description of the consequential decision and the role played by covered ADMT;
- Instructions for how to request additional information, including inputs and the types, categories, and sources of personal data used;
- Instructions for requesting personal data and correcting incorrect or inaccurate personal data;
- An opportunity for meaningful human review and reconsideration.
“Adverse outcome” is defined, in part, as “a decision that denies, terminates, revokes, or materially reduces or restricts a consumer’s access to, eligibility for, selection for, compensation for, or the provision of an opportunity or service.”
The new law removes the risk management, impact assessment, and annual review requirements for deployers.
ATTORNEY GENERAL ENFORCEMENT
A violation is considered a deceptive trade practice, and the Attorney General has exclusive enforcement authority under the Colorado Consumer Protection Act. If a cure is deemed possible, the Attorney General may provide 60 days to cure the violation. Though the law does not create a new private right of action, it does not preclude actions based on violations of other existing laws, such as the Colorado Anti-Discrimination Act. The Attorney General is granted rulemaking authority and is required to adopt rules relating to specific provisions of the Act by Jan. 1, 2027.
IMPRESSION
This is an improvement over the previous law and demonstrates how outcomes improve with consideration of meaningful stakeholder input and compromise. Some ambiguities in the law remain and hopefully will be addressed through rulemaking.
Photo: Michael Ciaglo/stock.adobe.com
