Colorado has not abandoned AI accountability. It has changed the framework.
The original version of Colorado’s AI law, SB 24-205, was scheduled to impose broad duties relating to high-risk AI systems. Those provisions were first delayed and then replaced. On May 14, 2026, Governor Jared Polis signed SB 26-189, which repealed and reenacted the framework around a new concept: automated decision-making technology, or ADMT, used to materially influence consequential decisions.
Figure 1. Colorado has not abandoned AI accountability. It has changed the framework.
The revised law takes effect January 1, 2027 and applies to consequential decisions made on or after that date. That date replaces the June 30, 2026 deadline described in earlier commentary.
For healthcare executives, the change calls for a more precise response—not complacency.
What changed
SB 26-189 no longer uses the former law’s broad structure of annual impact assessments, formal risk-management programs and a general duty of reasonable care against algorithmic discrimination. Instead, it focuses on transparency, records and consumer process rights when covered ADMT materially influences consequential decisions.
The statute defines ADMT as technology that processes personal data and uses computation to produce predictions, recommendations, classifications, rankings, scores or other information used to make, guide or assist a decision about an individual. It becomes “covered ADMT” when it materially influences a consequential decision, including one involving access to healthcare services.
Routine and low-stakes uses are excluded. The statute identifies examples such as routine scheduling, administrative routing and workflow management. It also excludes tools used solely to summarize, organize, translate, draft, route or present information for human administrative review, as well as specified fraud-prevention technologies.
For organizations subject to the core requirements, the revised law creates a targeted set of duties:
- Developers must provide deployers with information about intended and known harmful uses, training-data categories, known limitations, appropriate use, monitoring and human review, and must communicate material changes.
- Deployers must provide clear notice before covered ADMT materially influences a consequential decision.
- Following an adverse outcome, deployers generally must provide a plain-language explanation within 30 days and explain how the consumer can obtain additional information and exercise applicable rights.
- Consumers may request correction of factually incorrect or materially inaccurate personal data and, where commercially reasonable, meaningful human review and reconsideration.
- Developers and deployers must retain records needed to demonstrate compliance for at least three years.
Figure 2. Core duties at a glance.
The healthcare distinction
The most important correction to the earlier article concerns healthcare scope. HIPAA-covered entities and their business associates are largely exempt from the statute’s core developer, deployer, disclosure and consumer-right provisions for services rendered to a covered entity. The exemption does not cover employment decisions, and for healthcare providers it applies only when the provider operates from a Colorado location.
The exemption is not a reason to ignore the statute. A covered entity must provide patients with a general notice of its use of advanced technologies, including covered ADMT. That notice may be incorporated into existing patient-rights or care notices.
Additional requirements apply when a covered entity uses covered ADMT to determine eligibility for financial assistance. In that situation, the patient must receive:
- A plain-language description of the decision and the technology’s role.
- The types of information relied upon, subject to legal protections.
- Instructions for correcting materially inaccurate personal data.
- Information about requesting meaningful human review or reconsideration, where applicable.
The disclosure may be provided in advance or within 30 calendar days after an adverse outcome.
FDA-regulated medical devices and certain pharmaceutical or medical-device research and development activities subject to FDA oversight are also excluded from the statute’s central provisions.
Figure 3. The healthcare distinction. The HIPAA exemption applies to providers only when they operate from a Colorado location.
These details matter. A hospital’s ambient documentation tool may fall outside the definition of a consequential decision if it merely drafts or summarizes information for human review. A system that helps determine financial assistance can trigger specific patient disclosures. Workforce AI may remain in scope even for a HIPAA-covered hospital.
The correct unit of analysis is therefore not, “Does the hospital use AI?” It is: “What does each system do, which legal entity is using it, whose decision is affected, and does a statutory exclusion or sector-specific rule apply?”
Figure 4. Analyze each system, not the organization as a whole.
What remains unsettled
Implementation is still developing. The Colorado Attorney General filed proposed ADMT rules on August 11, 2026 and opened a formal comment period through October 26, 2026. The office is required to adopt rules clarifying post-adverse-outcome disclosures and consumer rights by January 1, 2027.
Healthcare organizations should therefore avoid treating current draft rules as final. Policies, notices and workflows should be designed for adjustment once the Attorney General completes rulemaking.
Enforcement rests exclusively with the Colorado Attorney General under the Colorado Consumer Protection Act, as the statute creates no new private right of action. Before January 1, 2030, the Attorney General generally must offer a 60-day opportunity to remedy violations when a resolution is considered possible. However, no such grace period is required for knowing or repeated violations.
Figure 5. Key dates under SB 26-189.
What leaders should do now
Map AI by use case and entity.
Create an inventory that distinguishes clinical tools, documentation tools, patient-facing services, employment systems, insurance functions and financial-assistance decisions. Identify the legal entity acting as developer or deployer and whether it is a HIPAA-covered entity, business associate or another organization.
Classify decisions, not just technology.
Determine whether an output is more than incidental or clerical and whether it materially influences access, eligibility, pricing, treatment or another covered outcome. Record why each system is included or excluded.
Prepare patient notices.
Colorado healthcare providers should develop an accessible general notice about advanced technologies. Organizations using ADMT in financial-assistance determinations should build the required explanation, correction and review information into existing patient workflows.
Review employment AI separately.
The HIPAA-sector exemption does not remove employment-related consequential decisions. Recruiting, screening, promotion, compensation and termination tools require their own analysis.
Strengthen vendor contracts and evidence.
Require developers to provide intended-use documentation, known limitations, version information, update notices and information needed for human review. Preserve records showing which version was used, what controls applied and how the organization responded to material changes.
Monitor the rulemaking.
Assign responsibility for reviewing the Attorney General’s final rules and updating notices, escalation paths and recordkeeping before January 1, 2027.
Beyond minimum compliance
SB 26-189 is narrower than the law it replaced, especially for HIPAA-covered healthcare organizations. But the underlying governance problem has not disappeared. Federal health-IT rules already emphasize predictive-algorithm transparency and risk management, FDA oversight continues across AI-enabled medical devices, and HHS has made governance and public trust central to its AI strategy.
This creates an important distinction between legal minimums and operational trust. The law may require a general patient notice in one context; sound governance may also require validation, role-based access, human escalation, change control, performance monitoring and evidence that records have not been altered.
A practical four-layer approach remains valuable:
- Verifiable records of versions, uses, outputs, approvals and changes.
- Risk-based human oversight for decisions with clinical, financial or employment consequences.
- Granular access and data controls suited to healthcare privacy and security obligations.
- Continuous assurance for performance, drift, misuse and inequitable effects.
Of versions, uses, outputs, approvals and changes.
For decisions with clinical, financial or employment consequences.
Suited to healthcare privacy and security obligations.
For performance, drift, misuse and inequitable effects.
Figure 6. A practical four-layer approach.
Colorado’s rewrite offers a useful lesson. Regulations can change quickly; governance architecture must be durable enough to adapt. Healthcare leaders who build a clear inventory, reliable evidence and accountable human review will be better prepared not only for January 1, 2027, but for the broader evolution of AI oversight.
The objective is not compliance for its own sake. It is the responsible use of AI in a field where trust, safety and human judgment remain indispensable.
About the authors
Dr Ranse Howell is CEO of Regitech and founder of The Unified Sentient. His background spans law, alternative dispute resolution, social policy and the creative arts. He approaches AI governance with an emphasis on stakeholder alignment and on accountability systems that enable innovation rather than restrict it.
Laura Glennie is a healthcare services consultant. Laura has spent her clinical career focused on improving the quality of patient care and clinical excellence. Her knowledge of the Utilization Review process within large hospital systems, while maintaining a focus on the quality of patient-centered care, informs her thinking when anticipating the impact of AI and the future of healthcare.