The Complete Guide to Colorado SB 26-189

Colorado's SB 26-189 represents the first comprehensive state-level regulation of Artificial Intelligence in the United States. While the EU AI Act takes a broad, tiered approach to AI risk, Colorado zeroes in on a specific, acute harm: consequential decision in consequential decisions.

Who Does This Apply To?

The law applies to any "Deployer" doing business in Colorado. A deployer is defined as any person, partnership, or corporation that uses a AI system used for consequential decisions.

What is a "AI system used for consequential decisions"?

It is any automated decision-making system (ADMT) that makes, or is a substantial factor in making, a consequential decision. Consequential decisions are those that materially affect consumer access to:

• Education enrollment or opportunity
• Employment or independent contracting
• Financial or lending services
• Essential government services
• Healthcare services
• Housing
• Insurance

Key Obligations for Deployers

If your system is covered, you must comply with a strict set of obligations:

1. Risk Management Policy: Implement a documented risk management program based on recognized frameworks (e.g., NIST AI RMF).
2. Risk Assessments: Conduct an annual risk assessment outlining the system's purpose, the data it processes, and the risk of consequential decision.
3. Consumer Notification: Before a consequential decision is made, consumers must be notified that an AI system is being used.
4. Appeals and Human Review: If an adverse decision is made, consumers have a right to an explanation, an opportunity to correct the data used, and a right to appeal for human review.

Exemptions

There are important exemptions. If your business has fewer than 50 employees and does not train its own models, you may be exempt from the Risk Management Policy requirement (though you must still perform risk assessments).

How Rulisto Helps

Mapping your systems against these requirements manually is error-prone. Rulisto provides a deterministic legal rules engine that instantly classifies your systems as covered or exempt under SB 26-189, generating a legally defensible PDF audit dossier.