AI governance frameworks: Compare
A learning aid, not legal advice.
| Dimension | Colorado SB 26-189, Automated Decision-Making Technology (repealed and replaced the Colorado AI Act, SB 24-205) binding law |
|---|---|
| Nature | Depth 3 of 3. State law; a violation is a deceptive trade practice under the Colorado Consumer Protection Act. SB 26-189; final fiscal note |
| Where and to whom it applies | Depth 1 of 3. Technology that materially influences a consequential decision about a Colorado consumer: education, employment, real estate, financial or lending services, insurance, health care, essential government services. SB 26-189 (definitions); final fiscal note |
| Roles addressed | Depth 3 of 3. Developers owe documentation to deployers; deployers owe notices, disclosures and review to consumers. SB 26-189; final fiscal note |
| Risk approach | Depth 1 of 3. No risk tiers: the trigger is use in a consequential decision. The 2024 act's risk management programme and impact assessments are gone. SB 26-189 (repeal and re-enactment) |
| Inventory and documentation | Depth 2 of 3. Developers give deployers documentation on intended and known harmful uses, training data categories, limitations and review instructions; both keep records for at least three years. SB 26-189; final fiscal note |
| Risk or impact assessment | Depth 0 of 3. No impact assessment duty; the 2024 act's assessments were removed. SB 26-189 (repeal and re-enactment) |
| Human oversight | Depth 2 of 3. After an adverse outcome, consumers can ask for correction of inaccurate data and for meaningful human review; developers give instructions for that review. SB 26-189; final fiscal note |
| Transparency and notices | Depth 3 of 3. Notice before the technology materially influences a consequential decision, and within 30 calendar days of an adverse outcome a description of the decision, the technology's role and the consumer's rights. SB 26-189; final fiscal note |
| Data governance | Depth 1 of 3. Consumers may request their personal data and correction of inaccurate data; developers disclose training data categories. SB 26-189; final fiscal note |
| Testing, robustness and security | Depth 0 of 3. No testing or robustness duty; developer documentation covers limitations and risks. SB 26-189; final fiscal note |
| Monitoring and incident reporting | Depth 1 of 3. Developers include monitoring instructions and notify deployers of changes; there is no incident reporting duty. SB 26-189; final fiscal note |
| Assurance and enforcement | Depth 2 of 3. Attorney General enforcement, with a 60-day cure period until 2030-01-01 (not for knowing or repeated violations); up to USD 20,000 per violation as a deceptive trade practice. No new private right of action. SB 26-189; final fiscal note |
| Effort to implement | Depth 2 of 3. Moderate: notices, adverse-decision letters, a correction and review route, vendor documentation and record keeping. SB 26-189; final fiscal note |
| Key dates | Depth 3 of 3. Signed 2026-05-14; duties apply from 2027-01-01. A federal court on 2026-04-27 barred enforcement of the 2024 act and any amending law until rulemaking ends and the court rules. SB 26-189 bill page; final fiscal note, page 5 |
A learning aid, not legal advice. Where AI SENTINEL is mentioned, it supports or maps to the dimension; it does not certify anything. Dates are those the official texts state on the date shown.