Colorado and California · January 1, 2027 · 63 days to go
Colorado and California rules on automated decisions
From January 1, 2027, businesses that use AI or other automated tools in significant decisions about people, such as hiring, lending or housing, must give notice and offer ways to question those decisions, under Colorado's new law and California's CCPA regulations.
The checker is free and takes about two minutes.
Colorado: SB 26-189
Passed in May 2026, SB 26-189 replaced the Colorado AI Act before it took effect. It applies to businesses that do business in Colorado and use “covered” automated decision-making technology: technology that processes personal data and produces outputs such as scores, rankings, recommendations or classifications that materially influence a consequential decision about a person.
Consequential decisions are about employment, education, housing, financial or lending services, insurance, healthcare, and essential government services. Colorado job applicants are included.
A business using such a tool must:
- give people clear notice before the tool is used in a consequential decision, with a way to get more information;
- within 30 days of an adverse outcome, explain the decision and the tool's role in plain language, and how to exercise their rights;
- correct inaccurate personal data on request;
- offer meaningful human review and reconsideration, to the extent commercially reasonable;
- keep records for at least three years, and make notices accessible to people with disabilities and limited English.
Developers must give the businesses that use their tools documentation on intended uses, known risks and limitations, and appropriate human oversight. The Attorney General is due to adopt rules by January 1, 2027, including on what “materially influence” means.
California: CCPA rules on automated decisionmaking technology
The California Privacy Protection Agency's regulations took effect on January 1, 2026. From January 1, 2027, businesses covered by the CCPA that use automated decisionmaking technology to make significant decisions about consumers must meet the ADMT requirements. ADMT here means technology that processes personal information and replaces or substantially replaces human decision-making.
Significant decisions are those that result in providing or denying financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services.
A business using ADMT this way must:
- give a plain-language pre-use notice explaining the specific purpose of the ADMT and people's rights;
- let people opt out, with limited exceptions, such as offering an appeal to a qualified human reviewer who can overturn the decision;
- on request, explain the purpose, the logic involved, and how the output was used in the decision about them.
Risk assessment requirements under the same regulations began on January 1, 2026.
How to prepare
Most of the work is knowing which tools you use and which decisions they shape.
1. List your tools
Every AI and automated tool your organization uses, and the decisions about people each one plays a part in.
2. Ask your vendors
How each tool works, what data it uses, its known limitations, and what documentation they provide.
3. Notices and review
Prepare the notices each law requires, and a process for explanations, corrections and human review or appeals.
How BuildAIPolicy can help
The AI Policy & Risk Pack is written from your answers about how your organization uses AI, in American spelling. It gives you the groundwork: an AI tool inventory, a risk register, an AI acceptable use policy and sample notice wording. It doesn't write the notices these laws require for you, and it isn't legal advice. Preview every section free before you pay.
Questions
When do the rules start?
Both on January 1, 2027. California's broader CCPA regulations took effect on January 1, 2026, and businesses using automated decisionmaking technology for significant decisions must meet the ADMT requirements from January 1, 2027.
Does a person reviewing the result take a tool outside the rules?
Not necessarily. Colorado's law covers tools whose output is a substantial factor in the decision, even when a person makes the final call. California's rules cover technology that replaces or substantially replaces human decision-making, so meaningful human involvement matters more there.
Do the rules cover chatbots and everyday software?
Colorado's law excludes tools such as spam filters, firewalls, calculators, databases and spreadsheets, scheduling and routing tools, fraud prevention, and tools that only organize information for a person to review. What matters is whether a tool's output substantially affects a significant decision about someone.
Who enforces them?
In Colorado, the Attorney General has exclusive enforcement authority, generally with 60 days' notice and a chance to fix a problem first (until January 1, 2030), and the law doesn't create a new private right of action. In California, the rules are part of the CCPA's regulations.
Does the pack write the notices these laws require?
No. The AI Policy & Risk Pack gives you the groundwork: an AI tool inventory, a risk register, an acceptable use policy and sample notice wording, written from how your organization uses AI. It isn't legal advice, and it doesn't replace the specific notices and processes each law requires.
Sources
- Seyfarth: Colorado enacts artificial intelligence replacement law
- Crowell: Colorado hits reset on AI regulation: SB 26-189 repeals and reenacts the Colorado AI Act
- Lathrop GPM: Colorado enacts new law regulating automated decision-making technology
- CPPA: California finalizes regulations to strengthen consumers' privacy (September 2025)
- Thompson Coburn: California's ADMT rules under the CCPA (March 2026)
- Brownstein: Preparing for California's automated decision-making regulations under the CCPA (September 2026)
- Ogletree (National Law Review): California finalizes regulations on AI, risk assessments and ADMT
This page is a general summary, last checked against these sources on October 30, 2026. It isn't legal advice. For advice on your situation, speak to a qualified adviser.