Law / United States / 
Colorado
SB 26-189 (2026), Automated Decision-Making Technology Act, developer documentation and records
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://leg.colorado.gov/bill_files/116432/downloadAn AI transparency rule binding private bodies.
- Private right of action
- No
- Enforcement body
- Colorado Attorney General
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- none
As of .
What it requires
- This duty does not bind until .
- If you develop a covered automated decision-making technology that is marketed, configured or contracted to materially influence a consequential decision, make available to each deployer a general statement of its intended and known harmful or inappropriate uses, the categories of data used to train it, its known limitations, and instructions for appropriate use, monitoring and meaningful human review.
- Make available the information a deployer reasonably needs to give its own consumer disclosures, and notify the deployer if you withhold information.
- Notify each deployer, within a reasonable time, of material updates, intentional and substantial modifications, and changes to the intended use of, limitations for, or risk mitigation for the technology.
- Retain for at least three years after each record is created, or longer if state or federal law requires, records reasonably necessary to demonstrate compliance, including system version identifiers, changelogs, and documentation and notices of material updates given to deployers.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
What the log must hold
System identity
Log retention
The period runs from the creation of each record required or created under the section, and is longer where applicable state or federal law requires a longer one.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
Subsection (4) names the records directly: a developer must retain records reasonably necessary to demonstrate compliance with the section, and says those records include system version identifiers, changelogs, and documentation and notices of material updates provided to deployers. The deployer's parallel retention duty is stated in a separate section, 6-1-1703, and neither subsection says who may demand the records.
- Kind
- Explicit
- As of
- Provision
- C.R.S. 6-1-1702(4)
- Trigger
- automated_decisions
What this law does
On and after , a developer must make available to each deployer of a covered automated decision-making technology it developed a general statement of the technology's intended uses and known harmful or inappropriate uses, a description of the categories of data used to train it, its known limitations, and instructions for appropriate use, monitoring and meaningful human review.
The developer must also make available the information reasonably necessary for the deployer to comply with the deployer disclosure section, and must notify the deployer if information is withheld. A developer must give each deployer notice of material updates, intentional and substantial modifications, and changes to the intended use of, limitations for, or risk mitigation for the technology within a reasonable time.
These disclosure duties apply only to a deployer's use of a technology that was marketed, advertised, configured, contracted, sold or licensed to be used to materially influence a consequential decision.
A developer must retain, for not less than three years after the creation of a record required or created under the section, or for a longer period if state or federal law requires, records reasonably necessary to demonstrate compliance, including system version identifiers, changelogs, and documentation and notices of material updates provided to deployers. The Act takes effect on .
When LexLint raises it
When your app profile says your app makes credit decisions, makes education decisions, makes employment decisions, makes health care decisions, makes housing decisions, makes insurance decisions or makes public services decisions.