# My business uses an AI model or vendor tool that scores, ranks or screens people for jobs, loans, housing, insurance, school, healthcare or government benefits in Colorado. Colorado replaced its AI Act with SB 26-189. What records does the new law make me keep for each AI-influenced decision from January 1, 2027, and for how long?

**Short answer:** Colorado's SB 26-189, signed May 14, 2026, repealed the original Colorado AI Act before its June 30, 2026 start and replaced it with a narrower automated decision-making technology (ADMT) law that applies to consequential decisions made on or after January 1, 2027. The impact assessments and risk-management program are gone; what's left sits at the level of each decision. A deployer (the business using a covered ADMT) must keep, for at least three years after the date of each consequential decision, records reasonably necessary to demonstrate compliance, which may include ADMT version identifiers, changelogs and documentation of material mitigation changes. A developer must keep its own compliance records for three years from when each record is created, including system version identifiers, changelogs and the material-update notices it sent to deployers. Those records have to back up the decision-level duties: a pre-use notice, a plain-language explanation within 30 days of an adverse outcome naming the tool, its version number and developer and the types and sources of personal data used, and, on request, correction of inaccurate data and meaningful human review. The Attorney General's October 6, 2026 interim draft rules (not yet adopted as of November 11, 2026) would also require a contemporaneous record of every human review: who reviewed, their authority and training, timestamps, the evidence they saw and a written justification.

## Checklist
1. List each decision in a covered domain (education, employment, Colorado residential real estate, financial or lending services, insurance, health-care services, essential government services and public benefits) where an ADMT output is a non-de minimis factor that affects the outcome. Include vendor tools built into HR, lending or claims platforms.
2. Check the exclusions honestly: tools used solely to summarize, organize, translate, draft, route or present information for human review are not ADMT, and customer service triage, routine scheduling, advertising, product recommendations, search and content moderation are not consequential decisions. A summary that also produces a score or ranking that influences the outcome doesn't fit those carve-outs.
3. For every consequential decision, save at the time it's made: a decision reference, the ADMT name and version, the developer, the pre-use notice version in force, the output, and whether it was the only factor or one of several. The 30-day adverse-outcome explanation and any later dispute both depend on these.
4. Keep each record for at least three years after the decision date, or longer where another law requires it (for example employment or lending record rules).
5. Ask each vendor (developer) for its documentation: intended and known harmful uses, categories of training data, known limitations, instructions for monitoring and human review, and direct notice of material updates. File the version you received with a date, because the law ties what you must tell consumers to what the developer gave you.
6. Keep a changelog of your own: when you switched model versions, thresholds, prompts or vendors, and any mitigation changes made after a problem was found.
7. Build the human-review record now. For each review, log the reviewer (by staff reference), their authority to approve, modify or override, their training, start and end timestamps, the evidence they had, including anything the consumer sent, and a written reason that is specific to the case rather than a description of how the model works.
8. Under the interim draft rules, acknowledge a review request within 10 days and complete the review within 45 days. Track both dates per request.
9. Keep the evidence that would rebut a presumption of material influence where it applies, such as a decision-maker's independent analysis or a decision that went against the model's output. The interim draft rules make that evidence matter.

## What records does Colorado's SB 26-189 require AI developers and deployers to keep, and for how long?
- Section 6-1-1703, added by SB 26-189, is short: a deployer shall retain, for not less than three years after the date of a consequential decision (or longer if another state or federal law requires), records reasonably necessary to demonstrate compliance with part 17, and those records may include covered ADMT version identifiers, changelogs and documentation of material mitigation changes.
- Section 6-1-1702(4) sets the developer's duty: keep records reasonably necessary to demonstrate compliance with the developer section for at least three years after each record is created, including system version identifiers, changelogs and the documentation and notices of material updates provided to deployers. A material update is one the developer knows or should know is likely to materially affect the ADMT's outputs or performance for its intended use, including changes to model parameters, default settings or documentation.
- Neither section lists a fixed set of fields. 'Reasonably necessary to demonstrate compliance' means the records have to show that each decision-level duty was met for that decision: the notice was up, the explanation went out within 30 days with the right content, and any correction or review request was handled.

## What must a Colorado deployer tell a consumer after an AI-influenced adverse decision?
- Before using a covered ADMT to materially influence a consequential decision, the deployer must give clear and conspicuous notice; a prominent public notice reachable at or near the point of interaction satisfies this. After an adverse outcome, the deployer has 30 days to provide a plain-language description of the decision and the ADMT's role, a simple process to request more information including the ADMT's name, version number if applicable, developer, and the types, categories and sources of personal data used, and an explanation of the consumer's rights.
- On request after an adverse outcome, the consumer gets instructions for getting and correcting factually incorrect or materially inaccurate personal data, and an opportunity for meaningful human review and reconsideration to the extent commercially reasonable. Opinions, predictions and scores aren't subject to correction. Meaningful human review means a designated, trained person with authority to approve, modify or override, who considers the relevant primary evidence, doesn't default to the system output, and has enough information to understand the output's intended use, limitations, input categories and principal factors.
- A creditor that sends a compliant ECOA or FCRA adverse action notice satisfies the Colorado disclosure only if that notice also covers the Colorado content, so lenders still need the ADMT name, version and data sources on file per decision.

## What would Colorado's draft ADMT and chatbot rules add to the law?
- The Attorney General filed proposed rules (4 CCR 904-6) on August 11, 2026, released an interim redline on October 6, held the hearing on October 26, and had not adopted final rules as of November 11, 2026. The draft is set to take effect January 1, 2027, so its details may still change.
- Draft Rule 8.7 would require a deployer that conducts a meaningful human review to keep a record, including contemporaneous documentation, of the reviewer's identity, authority and relevant training, the review timestamps, the primary evidence available to the reviewer including information from the consumer, the reviewer's access to the ADMT's intended use, limitations, inputs and principal factors, whether the reviewer approved, modified or overrode the decision, and a written justification. Reasons must be specific to the evidence, not a recitation of the ADMT's general logic.
- Draft Rule 6.1 would presume an output materially influences a decision when it constrains options, sets a threshold or produces a score, rank, classification, recommendation or prediction about the person that the decision-maker saw and that matches the outcome. A deployer can rebut that with evidence, including contemporaneous evidence, that the output was a de minimis factor, for example an independent review of substantial other information by someone with authority and subject knowledge. Draft Rule 4.2 would require a company that builds on an upstream developer's covered ADMT to retain the upstream documentation and pass it downstream.

## When can the Colorado Attorney General start enforcing the new ADMT law?
- Only the Attorney General enforces the law, a violation is a deceptive trade practice, and the law creates no new private right of action. Before acting, the Attorney General must issue a notice of violation and allow 60 days to cure where a cure is possible, but not for knowing or repeated violations. Law-firm analyses note that the cure provisions are repealed January 1, 2030, and that anti-discrimination claims under other law don't depend on this statute.
- In a federal lawsuit an AI company filed in April 2026 against the original law, the parties agreed to an April 27, 2026 order under which the Attorney General won't start enforcement, including investigations, for violations of the original law or its replacement that occur up to 14 days after the court rules on a preliminary injunction motion, which is due 28 days after the rules are finally adopted. January 1, 2027 remains the date the law applies to decisions, so the three-year record clock for a decision made that day starts then, whenever enforcement begins.

## Ask Rightshold (free, no key)
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code (one-click setup: https://www.rightshold.com/start?ref=seo), then ask: "Record a signed receipt when our screening tool scores an applicant: the ADMT name and dated version, a hash of the inputs and of the output, our decision reference and the notice version in force, so we can show what the tool produced for this decision if we have to explain an adverse outcome or prove compliance within the next three years."

```json
{
  "tool": "record_ai_run",
  "arguments": {
    "model": "<ADMT name and dated version>",
    "provider": "<developer or in-house>",
    "prompt_sha256": "<sha256 of the exact input features or prompt>",
    "output_sha256": "<sha256 of the exact output, e.g. score and reason codes>",
    "params": {
      "decision_ref": "<your decision id, no names>",
      "decision_type": "employment_screen",
      "covered_domain": "employment",
      "notice_version": "<pre-use notice version posted>",
      "developer_doc_version": "<vendor documentation version on file>",
      "used_as": "one_factor_of_several"
    },
    "ran_at": "2027-01-04T15:00:00Z"
  }
}
```
- Needs an API key. Send hashes and your own references only, never names, emails or applicant data. Params are stored as a hash, so keep the exact params object with your decision file.
- For a human review after an adverse outcome, request_human_approval can bind the reviewer's decision (approve, modify or override) to a hash of the final outcome and the run receipt, as a signed, timestamped record that the review happened and when. Use a staff reference, not the reviewer's name; keep the name, authority and training record in your own HR system. verify_human_approval checks it for free.
- verify_ai_run is free and needs no key, so the Attorney General's office, an auditor or your lawyer can check that the output you produce later matches the hash recorded on the decision date. The receipt shows what you recorded and when, not that the tool is accurate, fair or compliant.

_Rightshold doesn't decide whether Colorado's law applies to you, write notices or explanations, or handle consumer requests, and it doesn't keep your decision files for you. It records the hashes and references you send and lets anyone check them later. Requirements are summarized from SB 26-189 as published in the Colorado session laws (chapter 131, approved May 14, 2026) and from the Attorney General's October 6, 2026 interim draft of 4 CCR 904-6, which was not final as of November 11, 2026. Not legal advice; talk to a lawyer about your use._

## Sources
- [Colorado General Assembly: SB 26-189 session law (Automated Decision-Making Technology), chapter 131](https://leg.colorado.gov/laws/session-laws/SB26-189/131/download)
- [Colorado Attorney General: ADMT and Chatbot Safety rulemaking page](https://coag.gov/ai/)
- [Colorado Department of Law: 4 CCR 904-6 interim draft rules, redline (October 6, 2026)](https://coag.gov/app/uploads/2026/10/2026.10.06-ADMT-Chatbot-Act-Rulemaking-Interim-Draft-Redline.pdf)
- [Jones Walker: The Colorado AI Law You Prepared For Is Gone (October 23, 2026)](https://www.joneswalker.com/en/insights/blogs/ai-law-blog/the-colorado-ai-law-you-prepared-for-is-gone-and-the-rulemaking-comment-window-c.html)
- [Hunton: Colorado AI Act Amended and Effective Date Delayed](https://www.hunton.com/privacy-and-cybersecurity-law-blog/colorado-ai-act-amended-and-effective-date-delayed)

## Related
- [Do California's CCPA automated decisionmaking rules apply to your AI app by January 1, 2027?](https://www.rightshold.com/answers/do-californias-ccpa-automated-decisionmaking-rules-apply-to-your-ai-app-by-january-1-2027)
- [How to show a customer or regulator that a human reviewed an AI decision before it went out](https://www.rightshold.com/answers/how-to-show-a-customer-or-regulator-that-a-human-reviewed-an-ai-decision-before-it-went-out)
- [How to prove which model version, prompt and settings produced an AI output](https://www.rightshold.com/answers/how-to-prove-which-model-version-prompt-and-settings-produced-an-ai-output)
- [Verified AI Runs](https://www.rightshold.com/verified-ai-runs)

_Not legal advice. Updated 2026-11-11. JSON: https://www.rightshold.com/answers/what-records-does-colorados-new-ai-law-sb-26-189-make-you-keep-for-each-ai-decision-from-2027.json_