Colorado AI Law: Complete Small Business Guide

What this law actually does

Colorado SB 26-189 is a notice law, not an auditing law. It applies when a business uses "covered automated decision-making technology" to materially influence a consequential decision about a Colorado consumer — decisions about things like employment, credit and lending, housing, insurance, education, health care, and essential government services. If AI is in that loop, the consumer has to be told.

Enforcement sits with the Colorado Attorney General under the Colorado Consumer Protection Act, which carries civil penalties of up to $20,000 per violation. There is no private right of action.

Does it apply to my business?

The trigger is narrower than under the old law. Ask two questions:

• Do you do business with consumers in Colorado?
• Does an automated system materially influence a consequential decision about them — screening job applicants, approving or pricing credit, accepting or rejecting a tenant, setting insurance terms, or gating access to health care or education?

If the answer to both is yes, SB 26-189's notice duties apply — and there is no small business exemption. If AI only powers marketing copy, product recommendations, or a support chat widget, SB 26-189 is likely not your main exposure. Colorado's separate Chatbot Safety Act (HB 26-1263) is — it takes effect the same day and requires telling users they're talking to AI. See the Colorado chatbot law guide.

What you need to do

SB 26-189 gives deployers three core duties:

• Pre-use notice. Give clear and conspicuous notice before the covered technology is used in a consequential decision, plus instructions for getting more information. A visible notice or link at the point of engagement — on the application form, in the intake flow — satisfies this.
• Post-decision notice. If the technology materially influenced an adverse outcome, notify the consumer within 30 days.
• Consumer rights. Let consumers access and correct the personal data used, and request meaningful human review of the decision.

Notably not required under SB 26-189: annual impact assessments, a formal risk-management program, or the NIST-aligned duty of care that the repealed SB 24-205 imposed. Those obligations went away with the 2024 law.

Draft rules are out — and they add a vendor question

On August 11, 2026, Colorado filed proposed rules implementing SB 26-189 alongside the chatbot law. They're drafts, not final, but they sharpen one thing that matters when choosing tools: developers would have to give deployers documentation covering intended use, known harmful uses and limitations, the categories of personal data used in training, instructions for meaningful human oversight, and notice of material updates — retained at least three years.

Flip that around and it's your procurement checklist. If a vendor can't produce those five items, meeting your own duties above gets much harder. Public comment runs through October 26, 2026. Full breakdown: Colorado's draft AI rules, explained.

The cheapest path to compliance

For most SMBs, compliance is mostly about notice language and a documented process — not ripping out AI tools. Inventory where automation touches a consequential decision. Add a plain-English notice at that point. Write down who a consumer asks for human review, and make sure someone actually answers within 30 days. Separately, if you run a chat widget, add an "You're chatting with an AI assistant" disclosure for the chatbot law.

How to find out where you stand

ComplianceBeacon scans your site and tells you which AI tools you're using and what disclosures Colorado law requires. Run a free scan.