US buyer guides / 04
Which decisions does Colorado's AI law call consequential, and what record do you need?
Colorado's AI law is about decisions that change a person's life: education, jobs, housing, lending, insurance, health care, essential government services and public benefits. If an automated tool materially influences one of those, the law expects you to tell people, keep the record, and offer a human review. The rewritten law takes effect on January 1, 2027.
The moment.
An HR team buys an AI tool to rank applicants. It is sold as a productivity tool. Under Colorado's definition, a ranking that shapes who gets hired materially influences a consequential decision. So the duties of a deployer apply, and nobody has planned the notice, the record or the human review.
Does this tool score, rank or recommend people for a job, a loan, a home, a school place, care, insurance or a public benefit? If yes, where is our notice to them, our three-year record, and our route to a human review?
What you would see.
Colorado passed its AI law in 2024 as SB 24-205. A 2025 special session moved the start of its duties to June 30, 2026. In May 2026 the legislature repealed and reenacted the law as SB 26-189, which now covers automated decision-making technology in consequential decisions. The new text takes effect on January 1, 2027 and applies to decisions made on or after that date. Until then the 2024 text is the one on the books.
The new text drops the impact assessment and the risk management program. Developers must document what the tool is for, what data trained it, its known limits, and how a person should review its output. Deployers must give clear notice before the tool is used and explain an adverse outcome within 30 days. They must keep records for three years, correct wrong data on request, and offer a meaningful human review where that is commercially reasonable. The attorney general enforces it. Check the current text for dates and amendments before relying on any summary, including this one.
A good answer from a vendor is the documentation the law says a developer must hand you: intended uses, the categories of training data, known limits, and instructions for human review. A bad answer is "the tool is neutral".
The record you would open
| decision type | tool | notice sent (date) | adverse outcome explained within 30 days (yes/no) | human reviewer | record kept until |
|---|---|---|---|---|---|
| [employment decision] | [tool name] | [YYYY-MM-DD] | [yes / no] | [name or role] | [YYYY-MM-DD] |
Primary sources.
One thing to do.
List the decisions the tool will touch. Mark any that fall into the domains above. For each of those, write down the notice people will see, where the three-year record will live, and who does the human review. Do it before the pilot, not after.
The words.
- Consequential decision:
- one about a person's access to, eligibility for, or terms of education, work, housing, lending, insurance, health care or public benefits.
- Covered ADMT:
- automated decision-making technology that materially influences such a decision.
- Deployer:
- the organization using the tool in Colorado.
- Adverse outcome:
- a decision that denies, ends or materially worsens what a person gets.
Free, no email gate.
Download The Agentic AI Procurement Handbook, second edition, version 4.0. The 87-page PDF is free with no email gate.
Download version 4.0See your own exposure scored.
The SecVantages AI security assessment takes ten to twenty minutes, needs no card and no call, and leaves you a scored report.
Start the free assessment