Colorado SB 26-189: what to keep, and what a record shows.
For the compliance lead at a Colorado deployer, this page sets out what the Colorado AI Act, SB 26-189, asks you to keep and what a Verillian record of AI use on enrolled devices shows, clause by clause.
What the act asks, clause by clause
| The act asks | A Verillian record shows | It does not show |
|---|---|---|
| Covered domains include education, employment, lending, insurance, health care and essential government services. 6-1-1701(6) | Which governed AI services staff reached on enrolled devices. | Whether any is a covered tool. Ask your counsel. |
| A deployer gives a consumer clear and conspicuous notice, before use, that a covered tool is used in a decision. 6-1-1704(1) | Nothing. Verillian sends no consumer notices. | Where your notice appears. |
| Within thirty days of an adverse outcome, a deployer describes the decision and the tool's role. 6-1-1704(3)(a) | What an AI tool was given on an enrolled device, and when. | The decision or the disclosure. Those sit in your own systems. |
| On request, a deployer provides data correction instructions and meaningful human review, to the extent commercially reasonable. 6-1-1705(1)(a) | The signed exchange a reviewer can start from. | Whether a review was meaningful. 6-1-1701(15) defines it. |
| A deployer keeps records reasonably necessary to show compliance for at least three years after the decision. 6-1-1703 | A signed, hash-chained record of AI use on enrolled devices, kept on your own infrastructure. | Every record the act may need, or that nothing was omitted. |
| From January 1, 2027, a developer gives deployers documentation of intended uses and limits, and keeps records three years. 6-1-1702(1), (4) | Nothing. That comes from your AI developer. | The developer's models or training data. |
| The attorney general must adopt rules on disclosure and consumer rights by January 1, 2027. 6-1-1704(4)(b), 6-1-1705(3) | A dated record to read against the rules once adopted. | What the rules say. Check the attorney general's site. |
| The attorney general enforces the act, with notice and sixty days to cure where a cure is possible. 6-1-1706(1), (3) | A dated record to help you answer a notice. | Whether a violation occurred. Ask your counsel. |
| Limits | A record helps you show what AI tools were given and did on enrolled devices, kept on your own infrastructure. | Verillian is not a Colorado AI Act compliance product, does not decide whether you deploy a covered tool, and gives no legal advice. |
Aligned, not certified: Verillian holds no certification for the Colorado act, and the act does not name it. This is not legal advice. Ask your counsel what the act requires of you.
To see a record, book a demo. We read every request and reply.
Questions about the Colorado law
Which law is the Colorado AI Act today?
Senate Bill 26-189, signed May 14, 2026. It repeals and reenacts part 17 of article 1 of title 6 of the Colorado Revised Statutes. Most of it takes effect January 1, 2027, for consequential decisions made on or after that date. Guides written earlier may describe the version it replaced.
What does the act ask a deployer to keep?
Records reasonably necessary to show compliance, for at least three years after the date of a consequential decision, or longer if other law requires. Which records you need is a question for your counsel.
Does staff use of a chat assistant make us a deployer?
A deployer is a person doing business in Colorado that deploys a covered tool, one used to materially influence a consequential decision. Tools used solely to summarize, organize, translate, draft, route or present information for human review of administrative processing are excluded. Ask your counsel where yours fall.
Is Verillian a Colorado AI Act compliance product?
No. The act does not name Verillian, and a Verillian record does not decide whether anyone meets the act. It keeps a signed, hash-chained record of AI use on devices you enroll, on your own infrastructure. A change to its signed fields is detectable. It cannot show that nothing was omitted.