# SB 26-189: Automated Decision-Making Technology Act (repeal and reenactment of the Colorado AI Act)

Source: https://www.bankingnewsai.com/ai-regulation/documents/co-sb26-189
Last updated: Aug 26, 2026

SB 26-189, signed May 14, 2026 and effective January 1, 2027, repeals the Colorado AI Act and reenacts it as the Automated Decision-Making Technology Act. It replaces the duty of care, impact assessments, and risk-management programs with a transparency regime: developer documentation to deployers, clear consumer notice, a plain-language explanation within 30 days of any adverse outcome, rights to access and correct personal data, and commercially reasonable human review. It removes the prior safe harbor for banks and credit unions under equivalent federal supervision, but a lender's ECOA/Reg B (and where applicable FCRA) adverse action notice satisfies the Act's notice and disclosure duties for the same decision. The Attorney General enforces exclusively, with penalties of up to $20,000 per violation and a 60-day cure period through January 1, 2030.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [Colorado AI Act](https://www.bankingnewsai.com/ai-regulation/colorado-ai-act) |
| Type | Statute |
| Status | Final · applies from Jan 1, 2027 |
| Published | May 14, 2026 |
| Effective | Jan 1, 2027 |
| Applies to | Developers and deployers of covered ADMT that materially influences consequential decisions about Colorado consumers in financial services, insurance, employment, housing, education, health care, and government services — banks and credit unions included |
| Official text | https://leg.colorado.gov/bills/sb26-189 |

## Key points

- Introduced May 1, 2026, passed both chambers by May 9, signed May 14, 2026 — two weeks start to finish, ahead of the June 30, 2026 date on which SB 24-205 would have taken effect
- 'ADMT' = technology that processes personal data to generate recommendations, rankings, or scores used to make decisions about an individual; 'covered ADMT' is ADMT used to materially influence a consequential decision, including decisions affecting access to financial services
- Developers must provide deployers documentation of intended and known harmful uses, categories of training data, limitations and known risks, instructions for meaningful human review, and notice of material updates (from January 1, 2027)
- Deployers must give clear and conspicuous notice at points of consumer interaction and, within 30 days of an adverse outcome (denial, termination, material reduction, or materially worse pricing), explain the decision, the ADMT's role, the data used, and the consumer's rights
- Consumers may access and correct personal data used and request meaningful human review by trained staff with authority to override the outcome, to the extent commercially reasonable
- Strikes the SB 24-205 safe harbor for banks, credit unions, and entities complying with federal agency standards; no GLBA entity-level exemption
- A financial institution that provides a required ECOA/Regulation B and, where applicable, FCRA notice complies with the Act's notice and disclosure requirements for that decision or adverse outcome
- Violations are deceptive trade practices under the Colorado Consumer Protection Act (up to $20,000 per violation); AG exclusive enforcement; no private right of action; 60-day notice and cure before January 1, 2030; three-year record retention; AG must adopt implementing rules by January 1, 2027

## What changed for banks

Colorado moved from an EU-style governance statute to an FCRA-style disclosure statute. For banks the trade is unfavourable on scope but favourable on burden: the prudential-regulator exemption is gone, so AI-influenced credit, deposit, and pricing decisions for Colorado consumers are squarely covered, but the obligations largely map onto existing adverse action notice processes. The genuinely new work is documenting what vendors' models do, standing up a human-review channel that meets the AG's standards, and handling data-correction requests within the Act's timelines.

## Use cases it governs

- [Credit scoring & underwriting](https://www.bankingnewsai.com/ai-regulation/by-use-case#credit-underwriting)
- [Fair lending & discrimination](https://www.bankingnewsai.com/ai-regulation/by-use-case#fair-lending)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Customer-facing chatbots](https://www.bankingnewsai.com/ai-regulation/by-use-case#customer-chatbots)

Supersedes: [SB 24-205](https://www.bankingnewsai.com/ai-regulation/documents/co-sb24-205), [SB 25B-004](https://www.bankingnewsai.com/ai-regulation/documents/co-sb25b-004).

## FAQ

### Does SB 26-189 apply to banks?

Yes. It removed the SB 24-205 exemption for banks and credit unions supervised under equivalent federal guidance. The only financial-sector relief is that an ECOA/Reg B (and FCRA, where applicable) adverse action notice satisfies the Act's notice and disclosure duties for the same decision.

### When does the Colorado ADMT Act take effect?

January 1, 2027. The Attorney General must adopt implementing rules by the same date and has said it will not enforce until rulemaking is complete.

### What counts as an adverse outcome under SB 26-189?

A denial, termination, material reduction in benefits or services, or materially worse pricing or terms resulting from a consequential decision that covered ADMT materially influenced. The deployer must explain it in plain language within 30 days.

## Compare

- [EU AI Act vs Colorado AI Act](https://www.bankingnewsai.com/ai-regulation/compare/eu-ai-act-vs-colorado-ai-act): EU AI Act vs Colorado AI Act: AI in Credit Decisions

## Which AI tools for banks does SB 26-189 apply to?

- [Credit decisioning](https://www.bankingnewsai.com/ai-tools/credit-decisioning) — Colorado ADMT Act: [Zest AI](https://www.bankingnewsai.com/vendors/zest-ai) · [Provenir](https://www.bankingnewsai.com/vendors/provenir) · [FICO](https://www.bankingnewsai.com/vendors/fico) · [Scienaptic](https://www.bankingnewsai.com/vendors/scienaptic) · [Taktile](https://www.bankingnewsai.com/vendors/taktile) · [Covecta](https://www.bankingnewsai.com/vendors/covecta)

## Related documents

- [SB 24-205](https://www.bankingnewsai.com/ai-regulation/documents/co-sb24-205) — Consumer Protections for Artificial Intelligence (Colorado Artificial Intelligence Act) (May 17, 2024)
- [SB 25B-004](https://www.bankingnewsai.com/ai-regulation/documents/co-sb25b-004) — Artificial Intelligence Consumer Protections — delay of effective date to June 30, 2026 (Aug 28, 2025)
- [Colorado AG proposed ADMT rules](https://www.bankingnewsai.com/ai-regulation/documents/co-ag-admt-proposed-rules-2026) — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) (Aug 11, 2026)
- [HB 26-1263](https://www.bankingnewsai.com/ai-regulation/documents/co-hb26-1263) — Conversational Artificial Intelligence Service Operator Requirements (Chatbot Safety Act) (May 29, 2026)
- [Colorado SB 21-169 and Regulation 10-1-1](https://www.bankingnewsai.com/ai-regulation/documents/co-sb21-169) — Protecting Consumers from Unfair Discrimination in Insurance Practices (SB21-169, C.R.S. § 10-3-1104.9) and Colorado Insurance Regulation 10-1-1 (3 CCR 702-10) (Jul 6, 2021)
- [Regulation (EU) 2026/1744 (Digital Omnibus on AI)](https://www.bankingnewsai.com/ai-regulation/documents/eu-digital-omnibus-ai-regulation-2026-1744) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Jul 24, 2026)
- [RBI draft Guidance on Regulatory Principles for Model Risk Management](https://www.bankingnewsai.com/ai-regulation/documents/rbi-model-risk-management-guidance-2026) — Guidance on Regulatory Principles for Model Risk Management, 2026 (draft released for public comments) (Jun 24, 2026)
- [Draft Commission guidelines on high-risk classification](https://www.bankingnewsai.com/ai-regulation/documents/eu-commission-draft-guidelines-high-risk-classification-2026) — Draft Commission Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act (May 19, 2026)

Last reviewed Aug 26, 2026. Cite the official text (https://leg.colorado.gov/bills/sb26-189) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/co-sb26-189
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.