Law / United States / 
Colorado
SB 26-189 (2026), Automated Decision-Making Technology Act, deployer record keeping
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://leg.colorado.gov/bill_files/116432/downloadAn AI governance rule binding private bodies.
- Private right of action
- No
- Enforcement body
- Colorado Attorney General
- How the hook was established
- express
- What makes it apply
- Operator establishment, Place of effect, Data subject residence
- Audit expectation
- none
As of .
What it requires
- This duty does not bind until .
- Retain for at least three years after the date of each consequential decision, or longer if state or federal law requires, records reasonably necessary to demonstrate compliance with Part 17, such as the technology's version identifiers, changelogs, and documentation of material mitigation changes.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
What the log must hold
System identity
Log retention
The period runs from the date of the consequential decision, and is longer where applicable state or federal law requires a longer one.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
The section names the records directly: a deployer must retain records reasonably necessary to demonstrate compliance with Part 17, and the records may include the technology's version identifiers, changelogs, and documentation of material mitigation changes. The section states no one who may demand the records.
- Kind
- Explicit
- As of
- Provision
- C.R.S. 6-1-1703
- Trigger
- automated_decisions
What this law does
A deployer of a covered automated decision-making technology must retain, for not less than three years after the date of a consequential decision or for a longer period if state or federal law requires, records reasonably necessary to demonstrate compliance with Part 17 of Title 6 of the Colorado Revised Statutes. The records may include the technology's version identifiers, changelogs, and documentation of material mitigation changes. The Act takes effect on .
When LexLint raises it
When your app profile says your app makes credit decisions, makes education decisions, makes employment decisions, makes health care decisions, makes housing decisions, makes insurance decisions or makes public services decisions.