On May 14, 2026, Colorado replaced its earlier AI law before its scheduled implementation. The replacement assigns duties to both developers of covered automated decision-making technology and organizations using it to make consequential decisions. Most requirements begin January 1, 2027.
One part addresses information moving between businesses. Another addresses information reaching the person affected by a decision. The relationship between them is the important story: an organization cannot explain or meaningfully reconsider a system’s contribution if it does not understand what that system did.
Colorado’s framework connects those responsibilities. Whether it works will depend on the information available to the people expected to act on it.
The Replacement Follows the Technology Into the Decision
The legislature’s enacted-law summary describes covered technology as automated decision-making technology that materially influences a consequential decision. Covered domains include employment, education, housing, financial or lending services, insurance, healthcare, and essential government services and public benefits. The statute contains exclusions and sector-specific provisions; coverage requires more than identifying an organization’s industry.
The practical inquiry therefore starts with a particular use. Does the system simply organize material for someone to read, or does its output affect who receives an opportunity or service? The statute draws that line expressly: summarizing, organizing, or presenting information for human review falls outside a consequential decision only where the system produces no score, ranking, or recommendation. A product’s description as an assistant does not explain the weight its recommendations carry.
That distinction matters when a person remains formally responsible for the final decision. A recommendation can narrow the available choices or determine which applications receive attention before anyone approves the result.
The Developer Has Information the Customer Needs
The new developer duties require documentation addressing intended uses, training-data categories, known limitations, and instructions for appropriate use and human review. The enacted section also requires the developer to supply information reasonably necessary for the deployer’s own consumer disclosures and to notify the deployer if information is withheld. Developers must also notify deployers of material updates or modifications.
Consider a hypothetical employer that purchases a tool to rank applicants. A rejected applicant asks whether a gap in employment affected the ranking. The employer can see the score but has little information about the inputs, limitations, or intended interpretation.
The employer’s immediate problem is practical. A score does not explain itself. The person handling the request needs enough information to distinguish a wrong input from a limitation of the tool or a choice the employer made when configuring it.
Developer documentation cannot answer every question about an individual outcome. But it can establish what the product was intended to do and what its customer should understand before relying on it.
The Affected Person Needs More Than Notice That Automation Was Used
The law requires notice of covered use and, after an adverse outcome, a plain-language description of the decision and the technology’s role within 30 days. It also provides a process for requesting further information and explains rights to data correction and reconsideration. See the legislature’s summary and section 6-1-1704.
These disclosures answer different questions. Knowing that automation was involved does not establish how it affected the outcome. Knowing the product’s name does not establish whether the information used about a person was correct.
In the hypothetical, the useful explanation would distinguish the tool’s ranking from any independent screening criterion the employer applied. That would help the applicant identify what to challenge and help the employer determine what requires another look.
A Human Reviewer Needs Authority and Information
The enacted definition of meaningful human review requires a deployer-designated individual with authority to approve, modify, or override the decision. The reviewer considers relevant available primary evidence, is trained to conduct the review, does not default to the output, and has sufficient information to understand the output’s intended use, material limitations, and categories of inputs, along with the principal factors behind it. This does not require disclosure of proprietary source code, model weights, or other trade secrets.
That is a substantive description of review. Sending a complaint to an employee is not enough if that employee can only repeat the score or lacks authority to change the decision.
Return to the applicant. A reviewer could confirm that a system produced the displayed ranking and still leave the underlying concern untouched. To reconsider the result, the reviewer needs to examine relevant evidence and determine whether the decision should stand.
The consumer’s opportunity for meaningful human review is qualified by commercial reasonableness. The correction provision also does not require changing opinions, predictions, scores, or protected evaluations. Those limits appear in section 6-1-1705. Correcting an inaccurate employment date and disputing a prediction are different requests.
Coverage and Implementation Still Require Attention
Healthcare readers should examine section 6-1-1708 before applying the general duties. It provides conditional exemptions for HIPAA covered entities and business associates, excludes employment decisions from that HIPAA exemption, limits the exemption for provider covered entities to those operating from a location in Colorado, and retains particular patient notices. Certain FDA-supervised devices and research are also excluded from specified sections. This is not a uniform rule for every healthcare use.
The Attorney General’s rulemaking page identifies ongoing implementation work. As of October 15, proposed rules and an October 6 interim draft were available, with a hearing scheduled for October 26. The enacted duties should be distinguished from proposals about their implementation.
