Colorado AI law: what multi-site groups actually need in writing

August 11, 2026 · Mike Rodgers

If your compliance memo still says SB 24-205, high-risk systems, and February 1 2026, throw it out. The statute was repealed and reenacted in May 2026. The new one is narrower, it is a documentation regime, and the date that matters is January 1, 2027.

Read this first. This is a reading of the signed statute as retrieved on 2026-08-11, not legal advice, and it creates no attorney-client relationship. Colorado's AI statute has been rewritten twice in twenty-four months. Confirm the current text at leg.colorado.gov/bills/sb26-189 before you act on anything below, and have Colorado counsel read your specific facts.

Go find the compliance memo somebody wrote you in late 2024.

If it uses the phrases high-risk artificial intelligence system, algorithmic discrimination, duty of reasonable care, impact assessment, or the date February 1, 2026 — it describes a statute that no longer exists. It was not amended around the edges. It was repealed and reenacted, with different vocabulary and different duties. If your operating plan is built on it, you are preparing for the wrong exam.

Here is the chain, from the legislature's own records.

What happened, in three bills

SB 24-205, "Consumer Protections for Artificial Intelligence," signed 2024-05-17. A high-risk-system regime: a duty of reasonable care against algorithmic discrimination, with rebuttable presumptions earned through impact assessments, risk management programs, annual reviews, consumer notices, appeal rights, and 90-day disclosure to the Attorney General. Obligations were to apply on and after 2026-02-01.

SB 25B-004, passed in the August 2025 extraordinary session, signed 2025-08-28, effective 2025-11-25. Its entire substantive job was to push SB 24-205's effective date to 2026-06-30.

SB 26-189, "Automated Decision-Making Technology," signed 2026-05-14, chapter 131 of the session laws. Section 1 reads: "In Colorado Revised Statutes, repeal and reenact, with amendments, part 17 of article 1 of title 6." The high-risk framework is gone. In its place: Part 17 — Automated Decision-Making Technology in Consequential Decisions.

The timing matters: SB 26-189 was signed 2026-05-14, before SB 24-205's twice-delayed 2026-06-30 date. The high-risk-system duties most Colorado compliance memos were written against never came into operative force in that form.

The date now is January 1, 2027. Section 5: "this act takes effect January 1, 2027," except a handful of rulemaking-authority provisions effective on passage. Section 5(3): "This act applies to consequential decisions made on or after January 1, 2027." It carries a safety clause.

What the new statute actually regulates

Five defined terms do all the work. Get these right and most of the confusion disappears.

ADMT — technology that processes personal data and uses computation to generate output (predictions, recommendations, classifications, rankings, scores) used to make, guide, or assist a decision about an individual.

Consequential decision — a decision relating to a consumer's access to, eligibility for, selection for, or compensation for a covered domain, or one that materially alters differentiated pricing or terms.

Covered domain — a closed list: education; employment or an employment opportunity; lease or purchase of Colorado residential real estate; financial or lending services; insurance (including underwriting, pricing, coverage, and claims adjudication); health-care services; and essential government services and public benefits.

Materially influence — the output is a non-de-minimis factor and it affects the outcome, by constraining, ranking, scoring, recommending, or classifying. Explicitly excluded: "incidental, trivial, or clerical uses."

Covered ADMT — an ADMT used to materially influence a consequential decision. Only covered ADMT triggers the duties.

Note what fell out of scope. "Consequential decision" expressly excludes low-stakes and routine business processes — routine scheduling, administrative routing, customer service triage, communication of decisions, workflow management — plus advertising, marketing, product recommendations, search, and content moderation.

Where multi-site groups actually land

Two provisions determine almost everything for a Colorado group practice or professional firm.

First: employment is the domain you cannot dodge. Part 17 defines "consumer" to expressly include an employee and a job applicant who is a Colorado resident. If your ATS screens, ranks, or scores applicants — or a performance system materially influences compensation — you are a deployer in a covered domain. Nearly every multi-site group hires at volume. That is the exposure.

Second — and most healthcare groups have not read this — there is a HIPAA carve-out with a hole in it. Section 6-1-1708(3)(a) provides that 6-1-1701 through 6-1-1706 do not apply to a HIPAA covered entity, or to its business associates serving that entity, to the extent it does business in Colorado — except for a consequential decision related to employment or an employment opportunity.

Read that twice if you run a DSO, a medical group, or any multi-site clinical operation. Your clinical and patient-facing ADMT use is largely carved out of the core duties. Your hiring is not.

Three riders sit on that carve-out:

• 6-1-1708(3)(b): for a covered entity that is a health-care provider, the carve-out applies only if the provider is operating from a location within Colorado.
• 6-1-1708(3)(c): a covered entity shall provide patients a general notice of use of advanced technologies, including covered ADMT. It may be folded into existing patient-rights notices — but it is not optional.
• 6-1-1708(3)(d): if a covered ADMT determines a patient's eligibility for financial assistance or discounted care, you owe that patient a plain-language description of the decision and the ADMT's role, the information relied on, how to request correction, and how to request meaningful human review — satisfiable by advance general disclosure or by notice within thirty calendar days of the adverse outcome.

Colorado is a concentrated market for exactly this buyer. ADA Health Policy Institute's 2024 data puts 26.9% of Colorado dentists in DSO-affiliated practices, against 16.1% nationally — and 43.7% among Colorado dentists zero to five years out of school. Group-model operators here are over-represented, so the employment-decision exposure is too.

The exclusion most operating AI lives in — and why it is a paperwork exclusion

This is the part worth the price of the article.

Section 6-1-1701(2)(b) carves two things out of the ADMT definition entirely:

• (II) a tool used by an individual solely to summarize, organize, translate, draft, route, or present information for human review or administrative processing; and
• (III) technology that communicates in natural language to provide information, make referrals or recommendations, answer questions, or generate content — if it "is not contracted, advertised, marketed, configured, or intended by a person to be used in a consequential decision" and it "is subject to an acceptable use policy that prohibits generated content to be used in a consequential decision."

Most of what a professional firm actually deploys — a drafting assistant, an internal Q&A layer over your own SOPs — sits inside one of those exclusions. That is genuinely good news.

But look at the shape of exclusion (III). Both conditions are documentary. You do not qualify because of what your tool technically is; you qualify because of what you contracted, advertised, marketed, configured, and intended — and because you have an acceptable use policy that says so. If a regulator asks in 2027 whether your assistant is a covered ADMT, "it's just a chatbot" is not an answer. The policy is. Absent the paperwork, you are arguing an exclusion you cannot evidence.

That is the whole thesis of this article. The Colorado regime is a documentation regime. The compliance artifact is not a model card. It is a filing cabinet.

The six things you actually need in writing

1. An ADMT inventory, by system, mapped to covered domain and to whether the output materially influences a decision. Hiring first, then anything touching patient financial assistance, lending, housing, or insurance.
2. An acceptable use policy that names consequential decisions and prohibits generated content being used in them — the literal statutory hook in 6-1-1701(2)(b)(III). Distributed, acknowledged, dated.
3. Developer documentation, collected. Section 6-1-1702 obliges developers, from 2027-01-01, to give deployers a statement of intended and known harmful uses, training-data categories, known limitations, and instructions for appropriate use and human review. Ask your vendors now. It is also what limits their liability under 6-1-1707(5) — which means it is what fixes yours.
4. Point-of-interaction notice. Section 6-1-1704(1)–(2): clear and conspicuous notice before use, satisfiable by a prominent public posting reasonably proximate to the interaction.
5. A post-adverse-outcome runbook with a thirty-day clock. Section 6-1-1704(3): within thirty days of an adverse outcome, a plain-language description of the decision and the ADMT's role, a simple process to request more information (ADMT name, version, developer, data categories), and an explanation of consumer rights.
6. A meaningful human review roster. Section 6-1-1701(15) defines this precisely: a designated individual with authority to approve, modify, or override; who considers primary evidence; who is trained; who does not default to the system output; and who can see the output's intended use, limitations, input categories, and principal factors. Name them, train them, log it — 6-1-1703 requires keeping compliance records not less than three years after the decision.

Two traps

The vendor indemnity is void. Section 6-1-1707(7)(a): a contract provision that indemnifies, defends, or holds harmless a party against liability for its own acts or omissions under the Colorado Anti-Discrimination Act is "contrary to public policy and void." If your plan is "our vendor indemnifies us," you do not have a plan.

The penalty is per consumer. A Part 17 violation is a deceptive trade practice under the new 6-1-105(1)(uuuu), enforced exclusively by the Attorney General. C.R.S. 6-1-112(1)(a) sets civil penalties at not more than $20,000 per violation — and makes each consumer or transaction a separate violation. For an employer screening a few thousand applicants a year, the multiplier is the story, not the number.

There is real relief: before any enforcement action the AG shall issue a notice of violation and allow sixty days to cure, where a cure is deemed possible — but not for knowing or repeated violations, and that cure provision repeals on 2030-01-01. Part 17 creates no new private right of action.

What we could not verify

Two honest gaps, both of which you should re-check yourself.

Section 6-1-1704(4)(b) requires the Attorney General to adopt rules clarifying the post-adverse-outcome disclosure requirements on or before 2027-01-01. As of 2026-08-11 we did not find a published ADMT rulemaking docket on the AG's rulemaking page; what was posted there related to Colorado Privacy Act rulemaking. That is a negative finding on one page on one day, not a claim that rulemaking has not begun. Watch that page.

And the obvious one: this is a reading of a statute, not legal advice. We read the signed act. Your counsel has to read your facts.

Where to start

The open entry is the free 30-minute assessment. Bring your list of systems; we will tell you which plausibly sit in a covered domain and which are almost certainly excluded.

The written version is the ADMT Opportunity Report — a fixed fee priced after a short conversation, one week: a one-hour discovery of your consequential-decision systems, three prioritized exposures with a duty-by-duty read of notice, explanation, human review and documentation, and a 30-minute live readout. You own the report whether or not you build with us. It is request-only today — no card checkout, deliberately, until the statute-freshness sign-off closes. We would rather tell you that than take an order we cannot yet stand behind.

After that, Professional priced after a short conversation is the keep-alive: the inventory, the policies, the human-review roster, and the three-year record trail stay current instead of aging into the next amendment. There will be a next amendment — this statute has been rewritten twice in twenty-four months.

→ ADMT compliance report · Professional AI Packages · AI readiness assessment · How governed agents work

Citations are to Senate Bill 26-189 as signed 2026-05-14, read in full at leg.colorado.gov, and to C.R.S. 6-1-112. Not legal advice; no attorney-client relationship is created.

Mike Rodgers is the founder of Rodgers Intelligence Group. He builds the systems, agents, and operating procedures that let a one-person company run like a fleet. Learn more →