My business uses an AI model or vendor tool that scores, ranks or screens people for jobs, loans, housing, insurance, school, healthcare or government benefits in Colorado. Colorado replaced its AI Act with SB 26-189. What records does the new law make me keep for each AI-influenced decision from January 1, 2027, and for how long?

What should I check, step by step?

1. List each decision in a covered domain (education, employment, Colorado residential real estate, financial or lending services, insurance, health-care services, essential government services and public benefits) where an ADMT output is a non-de minimis factor that affects the outcome. Include vendor tools built into HR, lending or claims platforms.

2. Check the exclusions honestly: tools used solely to summarize, organize, translate, draft, route or present information for human review are not ADMT, and customer service triage, routine scheduling, advertising, product recommendations, search and content moderation are not consequential decisions. A summary that also produces a score or ranking that influences the outcome doesn't fit those carve-outs.
3. For every consequential decision, save at the time it's made: a decision reference, the ADMT name and version, the developer, the pre-use notice version in force, the output, and whether it was the only factor or one of several. The 30-day adverse-outcome explanation and any later dispute both depend on these.
4. Keep each record for at least three years after the decision date, or longer where another law requires it (for example employment or lending record rules).
5. Ask each vendor (developer) for its documentation: intended and known harmful uses, categories of training data, known limitations, instructions for monitoring and human review, and direct notice of material updates. File the version you received with a date, because the law ties what you must tell consumers to what the developer gave you.
6. Keep a changelog of your own: when you switched model versions, thresholds, prompts or vendors, and any mitigation changes made after a problem was found.
7. Build the human-review record now. For each review, log the reviewer (by staff reference), their authority to approve, modify or override, their training, start and end timestamps, the evidence they had, including anything the consumer sent, and a written reason that is specific to the case rather than a description of how the model works.
8. Under the interim draft rules, acknowledge a review request within 10 days and complete the review within 45 days. Track both dates per request.
9. Keep the evidence that would rebut a presumption of material influence where it applies, such as a decision-maker's independent analysis or a decision that went against the model's output. The interim draft rules make that evidence matter.

What records does Colorado's SB 26-189 require AI developers and deployers to keep, and for how long?

Section 6-1-1703, added by SB 26-189, is short: a deployer shall retain, for not less than three years after the date of a consequential decision (or longer if another state or federal law requires), records reasonably necessary to demonstrate compliance with part 17, and those records may include covered ADMT version identifiers, changelogs and documentation of material mitigation changes.

• Section 6-1-1702(4) sets the developer's duty: keep records reasonably necessary to demonstrate compliance with the developer section for at least three years after each record is created, including system version identifiers, changelogs and the documentation and notices of material updates provided to deployers. A material update is one the developer knows or should know is likely to materially affect the ADMT's outputs or performance for its intended use, including changes to model parameters, default settings or documentation.
• Neither section lists a fixed set of fields. 'Reasonably necessary to demonstrate compliance' means the records have to show that each decision-level duty was met for that decision: the notice was up, the explanation went out within 30 days with the right content, and any correction or review request was handled.

What must a Colorado deployer tell a consumer after an AI-influenced adverse decision?

Before using a covered ADMT to materially influence a consequential decision, the deployer must give clear and conspicuous notice; a prominent public notice reachable at or near the point of interaction satisfies this. After an adverse outcome, the deployer has 30 days to provide a plain-language description of the decision and the ADMT's role, a simple process to request more information including the ADMT's name, version number if applicable, developer, and the types, categories and sources of personal data used, and an explanation of the consumer's rights.

• On request after an adverse outcome, the consumer gets instructions for getting and correcting factually incorrect or materially inaccurate personal data, and an opportunity for meaningful human review and reconsideration to the extent commercially reasonable. Opinions, predictions and scores aren't subject to correction. Meaningful human review means a designated, trained person with authority to approve, modify or override, who considers the relevant primary evidence, doesn't default to the system output, and has enough information to understand the output's intended use, limitations, input categories and principal factors.
• A creditor that sends a compliant ECOA or FCRA adverse action notice satisfies the Colorado disclosure only if that notice also covers the Colorado content, so lenders still need the ADMT name, version and data sources on file per decision.

What would Colorado's draft ADMT and chatbot rules add to the law?

The Attorney General filed proposed rules (4 CCR 904-6) on August 11, 2026, released an interim redline on October 6, held the hearing on October 26, and had not adopted final rules as of November 11, 2026. The draft is set to take effect January 1, 2027, so its details may still change.

• Draft Rule 8.7 would require a deployer that conducts a meaningful human review to keep a record, including contemporaneous documentation, of the reviewer's identity, authority and relevant training, the review timestamps, the primary evidence available to the reviewer including information from the consumer, the reviewer's access to the ADMT's intended use, limitations, inputs and principal factors, whether the reviewer approved, modified or overrode the decision, and a written justification. Reasons must be specific to the evidence, not a recitation of the ADMT's general logic.
• Draft Rule 6.1 would presume an output materially influences a decision when it constrains options, sets a threshold or produces a score, rank, classification, recommendation or prediction about the person that the decision-maker saw and that matches the outcome. A deployer can rebut that with evidence, including contemporaneous evidence, that the output was a de minimis factor, for example an independent review of substantial other information by someone with authority and subject knowledge. Draft Rule 4.2 would require a company that builds on an upstream developer's covered ADMT to retain the upstream documentation and pass it downstream.

When can the Colorado Attorney General start enforcing the new ADMT law?

Only the Attorney General enforces the law, a violation is a deceptive trade practice, and the law creates no new private right of action. Before acting, the Attorney General must issue a notice of violation and allow 60 days to cure where a cure is possible, but not for knowing or repeated violations. Law-firm analyses note that the cure provisions are repealed January 1, 2030, and that anti-discrimination claims under other law don't depend on this statute.

• In a federal lawsuit an AI company filed in April 2026 against the original law, the parties agreed to an April 27, 2026 order under which the Attorney General won't start enforcement, including investigations, for violations of the original law or its replacement that occur up to 14 days after the court rules on a preliminary injunction motion, which is due 28 days after the rules are finally adopted. January 1, 2027 remains the date the law applies to decisions, so the three-year record clock for a decision made that day starts then, whenever enforcement begins.