Colorado AI Law and California ADMT Rules: What Changes on 1 January 2027

Firms that use automated tools in hiring, lending, or insurance now face state laws that define those tools in different ways. The Colorado AI law and California’s rules on automated decisions show how far apart those definitions can be.

Two sets of AI rules start on 1 January 2027. They refer to Colorado’s revised AI law and California’s rules for automated decision-making technology (ADMT). Colorado’s SB 26-189 applies to decisions made on or after it takes effect. The California rules set the same date for firms that already use ADMT for significant decisions. Those rules sit under the California Consumer Privacy Act.

Both laws favour set duties over broad AI risk programmes. These duties cover notice, reasons, and human review. Colorado cut the risk programmes and yearly impact checks that its 2024 AI Act had. 

California added ADMT duties to its privacy rules. A firm that uses automated tools in hiring, lending, housing, insurance, education or health care now needs proof. That proof shows what notices went out and what reasons the firm gave. It also shows that one person could change the outcome. AI governance has to produce it.

This article covers what each law needs. It compares the two and lists the records a company should keep before the start date.

What Colorado AI Law Requires?

Governor Jared Polis signed SB 26-189 into law on May 14, 2026. It repeals and reenacts Part 17 of the state's consumer protection law. The new text replaces the 2024 Colorado AI Act, which was scheduled to take effect on 30 June 2026. The new effective date is 1 January 2027. The full text sits on the state bill page.

Colorado AI law applies to developers and deployers doing business in the state. It covers tools that use personal data to make consequential decisions. The law names seven areas. These include education, jobs, housing, financial services or loans, insurance, health care, and essential government services.

Some uses fall outside the law, such as routine scheduling, advertising, and search. Tools that only sum up data for a human also fall outside it. The exception is a tool that gives a score, ranking, or prediction that shapes the result.

Deployers have five main duties:

• Give clear notice before using covered ADMT.
• Explain the tool’s role in plain language within 30 days of an adverse outcome.
• Let consumers correct factually incorrect personal data.
• Offer meaningful human review and reconsideration where commercially reasonable.
• Retain compliance records for a minimum of three years.

Developers must give deployers documents explaining intended uses, known harmful uses, training data types, limitations, and how to conduct human review. They must notify deployers of significant updates and keep records for three years.

Only the Attorney General (AG) may enforce Colorado AI law. The law does not allow individuals to file a lawsuit. A breach counts as a deceptive trade practice under the Colorado Consumer Protection Act. That Act allows civil penalties of up to $20,000 per violation, a cap that HB19-1289 set. Until 1 January 2030, the AG must give 60 days' notice and a chance to cure, if a cure is possible.

The AG submitted draft rules on 11 August 2026 and held a hearing on 26 October. The office must approve the final rules before they take effect. The AG's rulemaking page tracks the process.

A court order adds a caveat. A May 2026 fiscal note records an order of 27 April 2026 in X.AI LLC v. Weiser. The order prevents the AG from enforcing SB 24-205 or any law that changes it. It lasts until the AG finishes rulemaking and the court rules. The note lists the order among the legal cases that touch SB 26-189. Firms should check the order's current status before they rely on the start date.

What California’s ADMT Regulations Require?

The California Privacy Protection Agency (the Agency) wrote these rules under that Act. They apply to companies subject to the Act. The Agency adopted them on 24 July 2025, and the state approved them on 22 September 2025. They took effect on 1 January 2026, but the ADMT duties start later. The Agency's rulemaking page lists the final package.

A firm that used ADMT to make a significant decision before the start date must meet the requirements by that date. A firm that starts to use ADMT on or after that date must comply before first use.

The rules define ADMT as technology that uses personal data to replace or largely take over human decision-making. Significant decisions cover finance or lending, housing, education, health care, and jobs or pay.

A tool does not substantially replace a person when a reviewer meets three tests. The reviewer needs to know how to interpret the output. The reviewer must weigh it with other data. The reviewer must also be able to change their decision.

A business that uses ADMT for significant decisions must:

• Give a pre-use notice at or before collection of the personal information.
• Offer an opt-out, unless it instead provides an appeal to a human reviewer who understands the output and can overturn the decision.
• Provide information about how the ADMT is used.
• Complete a risk assessment.

Risk assessment duties for new processing took effect on 1 January 2026. Assessments of older processing that continues are due by 31 December 2027. Firms must send an attestation and a summary to the Agency by 1 April 2028. The Agency's announcement sets out the 2026 and 2028 dates. The Agency enforces the rules. Cyber audit dates run on a separate track from 1 April 2028 and fall outside this article.

Take one candidate-scoring tool. If a recruiter reads every score, knows how the tool made it and can overrule it, the tool may fall outside the California test. If the score ranks candidates and shapes who gets an interview, the tool can still fall inside the Colorado AI law. One tool can therefore need California opt-out or appeal handling, Colorado AI law notice and review, both, or neither. The answer depends on how the firm uses the score.

Where the Two Laws Differ?

The laws look alike but trigger on different tests. California applies when technology replaces or substantially replaces human decision-making, so a tool whose output a qualified human always reviews and can overrule may fall outside the definition. Colorado AI law applies when technology materially influences a consequential decision, so the same tool can fall inside the law when it produces a score, ranking, or prediction that shapes the outcome.

A firm in both states can use the wider Colorado AI law test to pick which tools to list. It can use the California opt-out or appeal route to design the consumer process.

Key Dates at a Glance

These dates set the pace for both laws:

Records a Business Needs to Hold

Neither law asks for a general AI policy. Both ask a firm to show what happened in specific decisions. Six sets of records follow from the duties above:

1. Tool Inventory: Each automated tool, the decision it influences, and the people affected. Law firm guidance recommends starting with tools used in hiring, lending, housing and workplace monitoring.
2. Data Inventory: The personal data each tool uses, where that data sits, and which of it is sensitive. IAPP notes that the California risk assessment depends on this knowledge and that many organisations hold outdated inventories.
3. Notice Records: When each consumer received a pre-use notice.
4. Explanation and Correction Records: The 30-day explanation after an adverse outcome in Colorado AI law and any request to correct personal data.
5. Human Review Records: Who reviewed a decision, what the reviewer saw, and whether the reviewer could change the result. California’s test for human involvement turns on these points.
6. Vendor Documentation: The developer documentation that Colorado AI law requires developers to give deployers.

Retention periods differ. Colorado AI law sets a floor of three years for compliance records. California says to keep risk assessments for as long as the processing runs or five years after completion. Colorado AI law also dropped its 2024 presumption of compliance for following NIST AI RMF or ISO/IEC 42001. A known framework still helps shape the programme. It gives no legal cover under the Colorado AI law.

The duty to explain raises a tech question. Explainable AI tools such as SHAP show which inputs drove a prediction. That can help a team write the 30-day explanation.

Federal Preemption and the EU AI Act

A federal push to pre-empt state AI laws is under way. IAPP says state laws stay in force for now. A firm that waits for federal action still faces the start date.

European firms can fall within scope. Colorado's test for a deployer is that it does business in the state. California's test is whether a firm meets the Act's definition of a business. Financial institutions can read about EU and UK rules in OpenSense Labs' article on AI governance in financial services.

How to Prepare Before 1 January 2027

The steps below follow the order in which the dependencies arise:

1. Build the Tool Inventory: Include tools bought from vendors and record which decision each tool influences.
2. Test Each Tool Against Both Triggers: Apply Colorado’s “materially influences” test and California’s “substantially replaces” test, and note where a tool meets one but not the other.
3. Assign Owners for Notices and Explanations: California’s pre-use notice and Colorado’s 30-day explanation each need a named owner and a template.
4. Design the Human Review Route: Reviewers need to understand the output, see other relevant information and hold authority to change the decision.
5. Decide Where Records Live: Notices, explanations, reviews, and vendor documents need a location and a retention period.
6. Track the Colorado AI Law Rules: The AG's draft rules asked whether deployers should stay liable when a vendor runs the tool. Vendor contracts need a review once the final text appears.

California's date for older processing is later, at 31 December 2027. Each assessment still needs the data list. That list belongs early in the plan.

Where AI Output Governance Fits

OpenSense Labs' AI Governance solution applies a Responsible AI (RAI) framework to AI output. It scores, filters, and corrects each output in real time. It rates output on eight dimensions that include fairness, transparency, privacy, and security. It works across models such as OpenAI, Claude and Gemini through an API and SDKs. This covers the output side of the evidence above.

Notices, explanations of bad outcomes, and human review remain process duties of the firm that deploys the tool. An output governance layer supports the programme but does not replace it. Firms that first need to map their data, infrastructure and governance can use an AI readiness assessment to set a base.

Colorado AI law and California both ask businesses to show how automated tools shape decisions about people, and both start on the same date. The practical work is an accurate tool inventory, tested against two different triggers, and records that show notices, explanations, and human review in each decision. Businesses that complete the inventory first can then apply the rest of the sequence to every covered tool.

Explore OpenSense Labs’ AI Governance solution