Colorado rewrote its AI law. Automated decisions are the new frame.

For two years, US AI regulation was framed around “high-risk AI”. That framing is fading. In 2026 Colorado threw out its first AI law and replaced it with one about automated decisions. California’s new privacy regulations take the same approach. The question regulators now ask is simple: when software makes a significant decision about a person, what do you tell them, and can a human step in?

This is good news for builders, because it is a question you can design for. It is also a trap, because many products make significant decisions without anyone calling them that. A fraud model that freezes an account or a scoring tool that filters job applicants can both be in scope.

This article explains the Colorado and California rules, shows how they line up with the EU, the UK and others, and sets out a single design that works across them.

Colorado, take two

Colorado passed the first broad US state AI law in 2024. It was widely criticised as hard to apply, and its start date was pushed back. In May 2026 the state repealed it and replaced it with SB 26-189, signed on 14 May 2026. The new law takes effect on 1 January 2027, subject to the Attorney General completing rulemaking.

The new law drops the old general duty of reasonable care and the impact-assessment model. Instead it regulates “automated decision-making technology”, or ADMT. Broadly, that means technology that processes personal data and produces predictions, scores, rankings, recommendations or classifications used to make or assist decisions about people.

It only bites when ADMT materially influences a “consequential decision”. That means a decision about access to, eligibility for or the terms of education, employment, housing, lending and financial services, insurance, health care or government services.

What Colorado now requires

The duties are split between developers, who build or offer the technology, and deployers, who use it to make decisions. A hiring platform is usually a developer. The employer using it is a deployer.

Deployers must tell people before ADMT is used in a consequential decision. If the outcome is adverse, meaning it materially reduces access or worsens the price or terms, the deployer must explain the decision and the technology’s role in plain language within 30 days, according to published briefings. The person can then ask to see and correct the personal data used, and ask for meaningful human review where commercially reasonable.

Developers must give deployers documentation on intended uses, known risks and limitations, the categories of training data and how to set up human oversight. Both sides keep records for at least three years.

Enforcement sits with the Colorado Attorney General; there is no private right of action
Violations are treated as deceptive trade practices, reportedly with penalties of up to $20,000 per violation
A 60-day cure period applies before enforcement, except for knowing or repeated violations, and is due to end in 2030

A law under a legal cloud

Colorado’s AI regime is also in litigation. In April 2026 a challenge was filed against the earlier law, and the Attorney General agreed to pause enforcement while it was resolved. Enforcement has been reported as stayed pending litigation, and it is not yet clear how the new law will be affected.

My advice is to prepare anyway. The notices, explanations and review routes Colorado asks for are the same ones California, the EU and the UK expect. Work done for Colorado is rarely wasted.

California’s ADMT rules

California regulates automated decisions through its privacy law, the CCPA. Updated regulations took effect on 1 January 2026. Businesses that use ADMT to make “significant decisions” about consumers must comply with the ADMT rules from 1 January 2027.

A significant decision is one that results in the provision or denial of financial or lending services, housing, education, employment or independent contracting, or health care services. Targeted advertising alone does not count.

Three rights sit at the core. Consumers must get a pre-use notice explaining the purpose of the ADMT and their rights. They can opt out, subject to exceptions. One exception allows a business to offer an appeal to a human reviewer with authority to change the decision instead of an opt-out. Consumers can also ask for information about how the ADMT was used in their case.

The rules sit alongside new risk assessment duties. Assessments apply to in-scope processing starting from 2026, legacy processing must be assessed by 31 December 2027, and attestations and summaries are due to the regulator from April 2028.

The same question, asked elsewhere

Other US rules point the same way. New York City’s Local Law 144 has required bias audits and candidate notices for automated hiring tools since July 2023. Texas’s TRAIGA, in force since January 2026, prohibits certain harmful uses of AI and offers safe harbours tied to recognised frameworks.

In Europe, Article 22 of the GDPR gives people the right not to be subject to decisions based solely on automated processing that have legal or similarly significant effects, unless an exception applies. Where it does, people must be able to get human intervention, give their view and contest the decision. The EU AI Act adds its own duties for high-risk uses such as hiring and credit, from December 2027.

The UK has gone a different way. Since February 2026, under the Data (Use and Access) Act 2025, significant automated decisions are permitted more widely, with tighter limits where sensitive data is involved. Safeguards remain, including information, the right to make representations, human intervention and the right to contest. In Asia-Pacific, Australia’s privacy reforms add transparency duties for automated decisions from December 2026.

Design once, comply in many places

Across these regimes, the same five building blocks keep appearing. If you build them into the product once, most of the remaining work is adjusting notices and timelines per market.

Think of it as plumbing. Each decision should leave a trail that shows what data went in, what the system produced, who reviewed it and what the person was told. That trail is your evidence when a regulator, a customer or a court asks.

An inventory of every automated decision, its inputs and the markets it affects
Clear notices before the decision is made
Explanations a non-expert can understand when the outcome is negative
A route to human review by someone with authority to change the result
Records that prove each of these steps happened

Where startups get caught

Exposure often sits in features nobody calls a decision. Lead scoring that decides who gets a sales call may be harmless. Lead scoring that decides who gets access to a credit product is not. The difference is the outcome for the person.

Common examples include fraud models that freeze accounts, résumé ranking inside an applicant tracking system, tenant screening scores and dynamic pricing for insurance. Take a lending app serving customers in Denver and Los Angeles. Its credit model likely triggers both the Colorado and California rules.

Vendors are not off the hook either. If you sell a scoring tool to employers or lenders, your customers will need your documentation to meet their own duties. Enterprise buyers increasingly ask for it in procurement.

What human review really means

A human who clicks “approve” on every automated result is not meaningful review. Regulators in the EU and UK have said so for years, and the Colorado law speaks of review by a trained person with authority to override.

Meaningful review needs three things. The reviewer must understand what the system does and its limits. They must have the information and time to reach a different view. They must actually have the power to change the outcome. Design the workflow, staffing and metrics so all three are true.

Checklist

List every point where your product approves, denies, ranks or prices something for a person.
Tag each decision by sector, such as employment, credit, housing, insurance, education or health.
Map which US states and other countries each decision affects.
Draft a pre-use notice that explains, in plain language, that automated tools are used and why.
Build an adverse-outcome explanation template that names the main factors in the decision.
Set up a human review route with trained reviewers who can override the result.
Log inputs, outputs, model version and reviewer actions for at least three years.
Prepare developer documentation for customers if you sell decision tools to others.
Track Colorado rulemaking and litigation before relying on its 1 January 2027 start date.

FAQs

Does Colorado’s law apply if we are not based in Colorado?

It applies to developers and deployers doing business in Colorado, and it protects Colorado consumers. A company based elsewhere that makes consequential decisions about Colorado residents should assume it may be in scope.

Is a human in the loop enough to stay outside these rules?

Not always. Colorado and California focus on whether the technology materially influences or substantially replaces human decision-making. A reviewer who simply accepts the system’s output will not take you outside the rules.

We only provide the software. Who has to send the notices?

Usually the business making the decision, the deployer, sends notices and handles reviews. As the developer, you must give that business the documentation it needs. In practice, customers will expect your product to make notices, explanations and review easy.

Will a federal US law replace these state rules?

There is no comprehensive federal law on automated decisions today. Federal preemption of state AI laws has been debated, but until something passes, plan for the state rules as written.

How does this relate to the EU AI Act?

They overlap but are not identical. The EU AI Act regulates high-risk AI systems themselves, while Colorado and California regulate decisions about people. A hiring or credit tool sold in both markets will usually need to meet both.

Primary sources

Briefing · Skadden on Colorado’s replacement AI Act Briefing · Thompson Coburn on the 2026 CCPA regulations

General information, not legal advice.