Download Framework
Colorado - Automated Decision-Making Technology (SB 26-189)
Colorado law, replacing the Colorado AI Act (SB 24-205), that governs automated decision-making technology (ADMT) used to materially influence consequential decisions in education, employment, housing, financial services, insurance, health care and government services. It requires developer documentation, record keeping, consumer notices, post-adverse outcome disclosures, data correction and meaningful human review.
Type:
RegulationIndustry:
Cross-sector
Domain:
TransparencyAccountability & GovernancePrivacy & DataBias & FairnessLegal & Compliance
Region:
US / Colorado
Content:
5 Risks18 Controls
Version: 2026
Framework Definition
Risks and controls associated with the framework
Assessment Layer
Concrete evaluations linked to controls to assess pass or fail
No evaluation mapping defined yet.
RISK
Inadequate developer documentation and change transparency
Risk that a developer of a covered ADMT does not give deployers the documentation, change notices and records they need to use the ADMT appropriately and to meet their own obligations.
CONTROL
Intended and Harmful Uses Statement
Provide deployers with a statement of the intended uses and the known harmful or inappropriate uses of the covered ADMT.
CONTROL
Training Data Description
Describe to deployers the categories of data, including personal data, used to train the covered ADMT.
CONTROL
Known Limitations and Risks
Document the known limitations and risks of the covered ADMT and the circumstances in which it should not be used.
CONTROL
Use, Monitoring and Human Review Instructions
Provide deployers with instructions for appropriate use, monitoring and meaningful human review of the covered ADMT.
CONTROL
Deployer Compliance Information
Provide deployers with the information they need to make their consumer disclosures, and notify them when information is withheld.
CONTROL
Material Update Notices
Notify deployers within a reasonable time of material updates, substantial modifications and changes to the intended use, limitations or risk mitigation of the covered ADMT.
CONTROL
Developer Record Retention
Retain records demonstrating developer compliance, including version identifiers, changelogs and update notices, for at least three years.
RISK
Insufficient deployer record keeping
Risk that a deployer cannot demonstrate compliance for consequential decisions materially influenced by a covered ADMT.
CONTROL
Deployer Record Retention
Retain records demonstrating deployer compliance, such as ADMT version identifiers, changelogs and mitigation changes, for at least three years after each consequential decision.
RISK
Inadequate consumer transparency
Risk that consumers are not told that a covered ADMT is used in consequential decisions about them, or do not receive an understandable explanation after an adverse outcome.
CONTROL
Pre-use Consumer Notice
Before using a covered ADMT in a consequential decision, give consumers a clear and conspicuous notice and instructions for obtaining more information.
CONTROL
Adverse Outcome Explanation
Within thirty days of an adverse outcome, give the consumer a plain-language description of the decision and of the role the covered ADMT played in it.
CONTROL
ADMT and Input Information Requests
Give consumers a simple process to request the name, version and developer of the covered ADMT and the types, categories and sources of personal data used.
CONTROL
Consumer Rights Explanation
Explain to the consumer their rights to data correction and human review, and how to exercise them.
CONTROL
Withheld Information Notice
Notify the consumer when information is withheld as a trade secret or as legally protected.
CONTROL
Accessible Notices
Make notices and disclosures accessible to consumers with disabilities and consumers with limited English proficiency.
CONTROL
Health-Care ADMT Notices
For HIPAA covered entities, give patients a general notice of the use of advanced technologies, and specific disclosures when a covered ADMT determines eligibility for financial assistance.
RISK
Lack of consumer recourse
Risk that a consumer who experiences an adverse outcome cannot correct inaccurate personal data or obtain meaningful human review of the consequential decision.
CONTROL
Personal Data Correction
On request after an adverse outcome, give the consumer instructions for accessing and correcting inaccurate personal data used in the decision.
CONTROL
Meaningful Human Review and Reconsideration
On request after an adverse outcome, offer review and reconsideration by a trained reviewer who has authority to override the decision, considers the primary evidence, does not default to the system output and understands the output's intended use, limitations, inputs and principal factors.
RISK
Algorithmic discrimination
Risk that a consequential decision materially influenced by a covered ADMT results in unlawful discrimination, for which developers and deployers may be held liable under state anti-discrimination law.
CONTROL
Non-discriminatory Consequential Decisions
Ensure that consequential decisions materially influenced by a covered ADMT do not result in unlawful discrimination under the Colorado Anti-Discrimination Act or other state anti-discrimination law.