Summary#

Colorado’s Automated Decision-Making Technology Act amends existing state law and adds rules for certain automated decisions. It also amends the Colorado Consumer Protection Act and an insurance law. The bill’s stated purpose is to address the use of automated decision-making technology in consequential decisions.

• From January 1, 2027, covered businesses and other deployers must tell consumers when covered technology is used in consequential decisions, keep compliance records, and provide added information after an adverse outcome.
• After an adverse outcome, a consumer may request correction of inaccurate personal data and an opportunity for meaningful human review and reconsideration, to the extent commercially reasonable.
• Developers must give deployers information about covered technology, including its intended uses, known limits and risks, and appropriate use and review instructions. They must also give notice of certain material updates and keep records.
• The rules cover decisions in education, employment, housing, financial services, insurance, health care, and essential government services and public benefits. The bill has exceptions, including for some health-care entities and insurance practices.
• The Attorney General enforces the new requirements. The bill does not create a new private right of action, but it does not remove rights under other laws. It also addresses how fault may be allocated in discrimination cases involving covered technology.

What it means for you#

• Consumers, workers and job applicants: If a covered system materially influences a consequential decision about you and the result is adverse, the deployer must give you specified information within 30 days. You may request correction of factually incorrect or materially inaccurate personal data and meaningful human review and reconsideration, to the extent commercially reasonable. The correction right does not cover opinions, predictions, scores or protected evaluations.
• Businesses and public bodies that use covered systems: Before using a covered system in a consequential decision, you must give notice; a prominent public notice accessible near relevant interactions can satisfy this duty. You must keep records for at least three years. Required notices must be reasonably accessible to people with disabilities and limited English proficiency.
• Technology developers: You must provide specified information to deployers and notify them of material updates and certain changes. These duties apply to covered uses that fit the bill’s conditions, including uses intended or agreed to for consequential decisions.
• Health-care and insurance organizations: Some insurers are treated as complying with the bill’s requirements for insurance practices if they are subject to specified insurance rules. Certain HIPAA-covered entities are exempt from most of the new duties, but must provide a general notice about advanced technology; extra disclosures apply when covered technology determines eligibility for financial assistance. The health-care exemption does not cover employment decisions.
• Everyone: The bill does not ban automated decision-making or require a person to review every automated decision. It does not create a new private lawsuit under this part of state law.

Money#

The bill appropriates $46,190 from the General Fund for 2026–27 to the Department of Law, based on an assumption that the department will need an additional 0.4 full-time-equivalent position.

• The department may use the appropriation for consumer protection, antitrust and civil rights work.
• The bill requires businesses and other deployers to provide notices and keep records, but the materials give no estimate of their costs.
• No estimate of future enforcement costs or penalties collected is provided.

What is unclear#

• The Attorney General must adopt rules by January 1, 2027, to clarify disclosures and consumer rights. Those rules may affect what businesses must disclose and how they must handle requests.
• The bill allows further rules about when a system “materially influences” a decision. That boundary will affect which systems and decisions are covered.
• The bill does not set a general deadline for responding to requests for correction or human review, or specify a detailed review process. Human review is required only to the extent commercially reasonable.
• The bill exempts or adjusts requirements for several areas, including insurance, health care, education and credit notices. How these provisions interact with all existing state and federal requirements may depend on the circumstances and later rules.

Case for#

• A possible argument for the bill is that people should know when automated technology materially affects important decisions about work, education, housing, health care, insurance, credit or public benefits.
• Requiring developers to share information with deployers could help deployers understand a system’s limits and use it more carefully.
• The bill gives people a way to seek correction of inaccurate personal data and request human review after an adverse outcome, without requiring review of every decision.
• Attorney General enforcement and annual reporting requirements could support oversight while leaving existing legal remedies in place.

Case against#

• One concern is that key boundaries, including what counts as material influence, depend partly on later rules. Businesses may not know clearly which systems trigger the requirements until those rules are settled.
• The duties may require new notices, records and staff time, but the materials do not estimate those costs.
• Human review is limited by what is commercially reasonable, and the bill does not set a general response deadline for review or correction requests.
• Enforcement under this part is reserved to the Attorney General, not individuals. That may limit direct enforcement of these specific duties, although other legal rights and remedies remain available.