Colorado's automated decision law and housing: what applies from 2027

In this article

Written by

Kooky

Builder of Shaka, the payment router that pays every agent their commission on closing date.

About Kooky and Shaka →

Colorado passed a law on artificial intelligence in consequential decisions in 2024. Anyone who learned that law then now has to learn it again. Senate Bill 24-205 was delayed in 2025, and in May 2026 the Colorado General Assembly repealed and reenacted the whole of it with a different design. The words "high-risk artificial intelligence system", the risk management programme and the impact assessment belong to the first version. The version on the statute book today speaks of automated decision-making technology, notices, explanations and human review.

This guide follows the law as the Colorado General Assembly's session laws and the Colorado Attorney General's rulemaking page present it on 10 October 2026. It covers what a consequential decision is and how housing is worded, which tools are in and out, who is a developer and who is a deployer, what each owes, what a person who is turned down for a lease or a purchase may ask for, which exemptions exist, how the Attorney General enforces the law, and the dates that matter. It describes Colorado law only. Federal fair housing and credit rules are separate subjects with their own texts.

Colorado General Assembly, session laws, Chapter 131 (Senate Bill 26-189), approved 14 May 2026.

Three bills, one law: how Colorado got here

The story runs through three bills, and each one changed the answer to "what applies, and when".

The first is Senate Bill 24-205, which the General Assembly's bill page files under the title "Consumer Protections for Artificial Intelligence". The Colorado Attorney General's page records that it was passed and signed by Governor Polis in 2024. According to the bill summary on the General Assembly's site, it asked developers of high-risk artificial intelligence systems to use reasonable care to avoid algorithmic discrimination, and asked deployers to implement a risk management policy and programme, complete an impact assessment, notify consumers when a system made a consequential decision about them, publish a statement about their systems, and tell the Attorney General within 90 days when they discovered algorithmic discrimination.

The second is Senate Bill 25B-004, "Increase Transparency for Algorithmic Systems", passed in the 2025 extraordinary session. The General Assembly's bill page shows it was introduced on 21 August 2025 and signed by the Governor on 28 August 2025. Its summary says the act extends the effective date of the requirements of Senate Bill 24-205 to 30 June 2026.

The third is Senate Bill 26-189, "Automated Decision-Making Technology". The bill page shows it was introduced in the Senate on 1 May 2026. The session laws list it as Chapter 131, approved on 14 May 2026. It repeals and reenacts Part 17 of Article 1 of Title 6 of the Colorado Revised Statutes, which is where the 2024 law sat. The Attorney General's page describes it in the same terms: a law that repeals and reenacts the provisions of Senate Bill 24-205 with new requirements, in effect from 1 January 2027.

A commentary published on 12 May 2026 by Consumer Finance Monitor, a law firm publication, lists what did not survive the rewrite: the broad duty of reasonable care, the risk management programme, impact assessments, annual reviews and public summaries. The same commentary notes that the three-year retention of records was kept.

The dates as they stand in October 2026

The session laws give one main date. Most of Senate Bill 26-189 takes effect on 1 January 2027, and it applies to consequential decisions made on or after that date. A decision on a rental application taken on 31 December 2026 is outside the new duties; the same decision taken a day later is inside them.

One point is not settled by the pages read for this guide: what the legal position was between 30 June 2026, the date the 2025 bill set for the 2024 requirements, and 1 January 2027. Neither the General Assembly's pages nor the Attorney General's page state it.

What counts as a consequential decision in housing

The law does not regulate technology in general. It regulates technology used in a "consequential decision", and the definition has two halves.

The first half is the kind of decision. Under section 6-1-1701(3)(a), as the session laws set it out, a consequential decision is a decision about a consumer that relates to access to, eligibility for, selection for or compensation for a covered domain. It also includes differentiated pricing or terms that are reasonably likely to materially limit or deny access. So the definition reaches both the yes-or-no answer and the price or conditions attached to a yes, when those conditions are harsh enough to work as a refusal.

The second half is the list of covered domains in section 6-1-1701(6). There are seven: education enrolment or opportunity; employment; housing; financial or lending services; insurance; health-care services; and essential government services and public benefits.

Housing is the third entry, and the act gives it in ten words: "the lease or purchase of residential real estate in Colorado". Three limits are built into that phrase. The transaction is a lease or a purchase. The property is residential. The real estate is in Colorado. A decision about leasing an office or buying a warehouse is not within the housing entry as worded, and a decision about a home in another state is not either. The act says no more about housing than those words, so questions at the edge, such as how far a step that comes before or after the lease or purchase itself is "related to" access, are left to the general definition and to the rules the Attorney General is writing.

The mortgage that pays for a purchase falls under a different entry, financial or lending services, which has a special rule described further on.

Section 6-1-1701(3)(b) then removes nine categories from the definition. As the act lists them, they include routine scheduling, advertising, marketing, search, content moderation, cybersecurity, fraud prevention, anti-money-laundering and sanctions compliance. As an illustration, a tool that decides which listing advertisement a person sees, or that checks a payment against a sanctions list, is on the excluded side of that line as the act draws it.

Which tools are covered, and which are not

The law's unit is "automated decision-making technology", shortened to ADMT. Section 6-1-1701(2) defines it as technology that processes personal data and uses computation to generate outputs, such as predictions, scores or rankings, that are used to make or assist a decision about an individual.

The same subsection lists what is not ADMT. According to the session laws, the list includes anti-virus software, firewalls, spam and robocall filtering, web hosting, databases, and spreadsheets that do not use machine learning, foundation models or large language models. It also leaves out tools used solely to summarise or organise information for human review. And it leaves out consumer-facing communication technology that is not intended for consequential decisions and is covered by an acceptable use policy that bars such use. A general-purpose chat assistant with that kind of policy is therefore not ADMT under the definition; the act does not say what follows if a user ignores the policy.

Being ADMT is not enough to trigger the duties. The technology must be a "covered ADMT", which section 6-1-1701(5) defines as ADMT used to materially influence a consequential decision. "Materially influence" has its own definition in subsection (13): the output is a factor in the decision that is not de minimis, and it affects the outcome, for instance by scoring, ranking or classifying. Incidental, trivial and clerical uses are excluded. The Attorney General may adopt rules to clarify the phrase, under section 6-1-1706(5).

A worked example, with invented facts, shows how the three tests stack. Assume a landlord with flats in Denver uses software that reads each applicant's file and returns a score from 1 to 100, and assume the landlord declines every applicant below 60. The software processes personal data and produces a score, so it is ADMT. The score settles who is declined, so it materially influences the decision. The decision concerns the lease of residential real estate in Colorado, so it is consequential. The software is a covered ADMT. Change one assumption: the software only sorts the documents in each file into folders for a person to read. It then organises information for human review and, as the act words the exclusion, is not ADMT at all.

Developer and deployer: who is who

Two roles carry the duties, and both are tied to doing business in Colorado.

A developer, under section 6-1-1701(8), is a person doing business in Colorado that makes a covered ADMT available. The definition also takes in a person that develops a component designed for use in a covered ADMT, and a person that intentionally and substantially modifies an ADMT so that it becomes a covered one. Paragraph (b) of the same subsection excludes certain research, internal-use and unaffiliated-modification situations.

A deployer, under section 6-1-1701(7), is a person doing business in Colorado that deploys a covered ADMT. The definition does not name trades. Whoever takes the decision with the tool is the deployer, whatever their business is called.

In the worked example above, the software company is the developer and the landlord is the deployer.

The person on the other side is the "consumer". The act borrows the meaning in section 6-1-1303(6)(a) of the Colorado Revised Statutes and adds that the term includes individuals whose access or opportunities in Colorado are evaluated in a consequential decision.

What a developer must hand over

The developer's duties are in section 6-1-1702 and start on 1 January 2027. They are duties owed to deployers, and they are about information.

According to the act, a developer must provide each deployer with documentation covering five subjects: the intended uses of the technology and its known harmful uses; the categories of data it was trained on, to the extent known; its known limitations and risks; instructions for appropriate use, monitoring and meaningful human review; and the information the deployer needs to meet its own disclosure duties under section 6-1-1704. If the developer holds something back, it must tell the deployer that it has done so.

The duty continues after delivery. The developer must give notice of material updates, of intentional and substantial modifications and of changes to the intended use, within a reasonable time. Publishing release notes is enough only if the deployer is also told directly that the release exists.

These duties are triggered, the act says, when the technology is marketed or configured for consequential decisions, or when the developer learns it is being used that way. The second trigger matters for general tools: a developer that never aimed its product at tenant or buyer decisions takes on the duties once it knows the product is used for them. The developer must keep records of its compliance for at least three years.

What a deployer must tell people before the decision

The deployer's first duty comes before the technology is used. Under section 6-1-1704(1) and (2), the deployer must give a clear and conspicuous notice that a covered ADMT is or will be used, together with instructions for obtaining more information.

The act offers a simple way to meet it. A prominent public notice at the points where consumers interact with the deployer, reasonably proximate to the transaction, satisfies the duty. The act does not prescribe a form or a text for the notice. What it prescribes is the timing (before use), the quality (clear and conspicuous) and the content (the fact of use, and where to learn more).

Section 6-1-1704(8) adds that notices must be accessible to people with disabilities and to people with limited English proficiency.

After a refusal: explanation, correction and human review

The heavier duties start only when the decision goes against the consumer. The act calls this an "adverse outcome" and defines it in section 6-1-1701(1) in two parts. The first is a decision that denies, terminates, revokes or materially reduces or restricts access to an opportunity or service. The second is a price or terms that are materially less favourable than those given to similarly situated consumers and that are reasonably likely to materially limit, delay or effectively deny access.

Within 30 days after such a decision, section 6-1-1704(3) requires the deployer to provide three things:

1. A plain-language description of the decision and of the role the technology played in it.
2. Instructions and a simple process for requesting more information, including the name of the ADMT, its version, its developer, and the types, categories and sources of data used. The session laws limit the technical items to what the deployer received from the developer, which is why the developer's documentation duty comes first.
3. An explanation of the consumer's rights under section 6-1-1705 and of how to use them.

Section 6-1-1704(5) protects trade secrets and other legally protected information: nothing in the section requires their disclosure. The protection has a condition attached. The deployer must tell the consumer when it withholds information on that ground.

The rights in section 6-1-1705 are two, and both are exercised on request after an adverse outcome. The consumer may ask for instructions on how to obtain the personal data used and how to correct data that is factually incorrect or materially inaccurate. And the consumer may ask for meaningful human review and reconsideration of the decision, which the deployer must provide to the extent commercially reasonable.

Each right has a limit written into it. Correction applies to facts. Opinions, predictions and scores are not subject to correction, so a consumer can have a wrong eviction record or a wrong income figure fixed, but cannot require the score itself to be rewritten. Human review is qualified by "commercially reasonable", a phrase the act does not define.

"Meaningful human review" does have a definition, in section 6-1-1701(15). The reviewer is a person designated by the deployer who has authority to approve, modify or override the decision, who is trained, who does not default to the technology's output, and who has sufficient information.

The act sets no number of days for answering a correction or review request. Section 6-1-1705 is one of the subjects on which the Attorney General must adopt rules.

Dates make the sequence concrete. In a worked example, assume the Denver landlord declines an application on 15 January 2027 because of the score. The 30 days for the explanation run to 14 February 2027. The landlord's compliance records for that decision are kept for at least three years after its date, so until at least 15 January 2030.

The 2024 text asked a business to assess its system. The 2026 text asks it to explain its decision to the person concerned.

Exemptions, and the one that is missing

Section 6-1-1708 holds the special rules for particular sectors. For readers in housing, what it leaves out matters as much as what it contains.

The sector rules the act does contain are these, as the session laws set them out. Insurers that are subject to section 10-3-1104.9 of the Colorado Revised Statutes are deemed compliant in the practice of insurance. Entities covered by the federal health privacy law known as HIPAA are exempt from sections 6-1-1701 to 6-1-1706, except for employment decisions. Medical devices regulated by the Food and Drug Administration are exempt from the same sections. And nonpublic personal information need not be disclosed where disclosure would violate the federal Gramm-Leach-Bliley Act.

Lenders have a rule of their own in section 6-1-1704(6). A creditor complies with the notice part of the law if the adverse action notice it already gives under the federal Equal Credit Opportunity Act and Regulation B, and under the Fair Credit Reporting Act where that applies, also meets the Colorado requirements. This is a route to compliance, not an exemption: the federal notice counts only if it carries what Colorado asks for.

The Consumer Finance Monitor commentary of 12 May 2026 reads the rewrite as removing the limited, conditional exemptions that the 2024 law gave some federally regulated entities.

Enforcement, the cure period and liability

Enforcement belongs to one office. Under section 6-1-1706, the duties in sections 6-1-1702 to 6-1-1705 are enforced exclusively by the Colorado Attorney General, under the Colorado Consumer Protection Act. The act adds a breach to that act's list of deceptive trade practices, at section 6-1-105(1)(uuuu). The automated decision law sets no penalty amounts of its own; it relies on the remedies of the Consumer Protection Act, which the pages read for this guide do not quantify.

Before going to court, the Attorney General must follow a cure procedure set out in section 6-1-1706(3). If a cure is possible, the office issues a notice of violation, and the recipient has 60 days after receiving it to cure. In a worked example, a notice received on 1 March 2027 gives until 30 April 2027. No cure period is required for knowing or repeated violations. A cure made within the 60 days may count as a mitigating factor if penalties are later considered.

The cure procedure is temporary. Subsection (3) carries its own repeal: its last paragraph says the subsection is repealed, effective 1 January 2030, and the Consumer Finance Monitor commentary describes the cure period as expiring on that date. The same subsection tells the Attorney General to report enforcement and cure figures to the General Assembly at its annual oversight hearing, beginning in January 2028.

A consumer cannot sue under this law. Sections 6-1-1706(4) and 6-1-1709 state that it creates no private right of action. They also state that existing rights and remedies are not limited, and the act names the Colorado Anti-Discrimination Act among them.

That is where section 6-1-1707 comes in. It deals with discrimination claims brought under existing state law that arise from a decision in which a covered ADMT was used. In such a claim, fault between developer and deployer is allocated by relative fault, and the act creates no joint and several liability beyond what existing law already provides. A developer is liable only if the technology was used in a manner it intended, documented, marketed or contracted for, and the technology materially influenced the decision. A contract clause that indemnifies a party for its own discrimination-related acts is void. And compliance with the notice and review duties is not a defence to other legal obligations.

What is still open before January 2027

The act tells the Attorney General to adopt rules on the adverse outcome disclosures and on the correction and review rights on or before 1 January 2027. To pay for the work, it appropriates US$46,190 from the general fund to the Department of Law for the 2026-27 fiscal year, on an assumption of 0.4 of a full-time position.

The Attorney General's page records the steps so far. Pre-rulemaking feedback closed on 13 July 2026. Proposed rules were filed on 11 August 2026. An interim draft was released on 6 October 2026. A public hearing is scheduled for 26 October 2026 at 10:00 in Denver, with a virtual option, and written comments are due by 11:59 pm the same day.

Four questions therefore have no final answer on 10 October 2026: how long a deployer has to answer a correction or review request; how detailed the 30-day explanation must be; whether "materially influence" will be clarified by rule; and what "commercially reasonable" human review looks like in practice. The first, second and fourth concern the adverse outcome disclosures and section 6-1-1705, on which rules are required by 1 January 2027. The third is optional for the Attorney General.

Kooky, from Shaka

Kooky edits Agents Estate and builds Shaka, the payment router he made for real estate professionals. One payment comes in, and every agent, agency and party in the deal receives their signed share on closing date.

About Kooky and Shaka →