Detailed overview
Colorado regulates AI through its law on automated decision-making technology, or ADMT. In 2026, Colorado repealed and reenacted its earlier AI consumer-protection framework. The revised law focuses on ADMT used to materially influence consequential decisions and became law in May 2026.
An automated decision-making technology is technology that processes personal data and uses computation to generate outputs such as predictions, recommendations, classifications, rankings, scores or other information used to make, guide or assist a decision about an individual. A consequential decision is a decision relating to access to, eligibility for or compensation related to education, employment, housing, financial or lending services, insurance, healthcare services or essential government services.
The Colorado framework applies to covered ADMT, meaning ADMT used to materially influence a consequential decision. Starting 1 January 2027, developers of covered ADMT must provide deployers with technical documentation describing intended uses, categories of training data, known limitations, instructions for appropriate use and human review. Developers must also notify deployers of material updates or modifications.
Developers and deployers must keep records necessary to demonstrate compliance for at least three years. Deployers must provide clear and conspicuous consumer notice at the point of interaction with covered ADMT. If the ADMT produces a consequential decision that results in an adverse outcome, the deployer must provide a plain-language description of the ADMT's role within 30 days.
Consumers have rights to request personal data used by covered ADMT, to correct factually incorrect personal data and to request meaningful human review and reconsideration after an adverse consequential decision. These rights are especially relevant for AI used in employment screening, credit scoring, insurance assessment, education access, healthcare eligibility and essential government services.
The Colorado Attorney General enforces the law through the Colorado Consumer Protection Act. A violation is treated as a deceptive trade practice. Before initiating an action, the Attorney General must generally give a 60-day notice and opportunity to cure if a cure is possible. The law does not create a new private right of action.
Practical requirements & details
Sourced from Colorado's revised automated decision-making technology (ADMT) framework — repealed and reenacted in 2026 — and enforced under the Colorado Consumer Protection Act.
Defined terms
- ADMT — technology that processes personal data and uses computation to generate predictions, recommendations, classifications, rankings, scores or other outputs used to make, guide or assist a decision about an individual.
- Consequential decision — decision relating to access, eligibility or compensation for education, employment, housing, financial or lending services, insurance, healthcare or essential government services.
- Covered ADMT — ADMT used to materially influence a consequential decision.
Developer duties (from 1 Jan 2027)
- Provide deployers with technical documentation on intended uses, training-data categories, known limitations, instructions for appropriate use and human review.
- Notify deployers of material updates or modifications.
Deployer duties
- Clear and conspicuous consumer notice at the point of interaction with covered ADMT.
- After adverse consequential decision — provide plain-language description of the ADMT's role within 30 days.
Consumer rights
- Access — request the personal data used by covered ADMT.
- Correction of factually incorrect personal data.
- Right to meaningful human review and reconsideration after an adverse consequential decision.
Record-keeping
- Developers and deployers must keep compliance records for at least three years.
Penalties
- Enforced by the Colorado Attorney General through the Colorado Consumer Protection Act.
- Violation treated as a deceptive trade practice.
- 60-day notice and opportunity to cure generally required before action where cure is possible.
- No new private right of action.
Related entries
See also the federal-level entry for the United States, which covers the broader US AI regulatory framework (executive orders, NIST AI Risk Management Framework, sectoral regulators, and US-wide federal initiatives).