Employment
Hiring, employment opportunities, and employment-related decisions.
Colorado • AI Governance • ADMT • Compliance
Prepare for the Colorado AI Act.
Colorado's updated AI framework regulates automated decision-making technology used in consequential decisions involving areas such as employment, education, housing, financial services, insurance, healthcare, and government benefits.
BigID helps organizations discover AI systems, understand the personal and sensitive data behind them, map lineage and access, establish ownership, assess risk, apply governance controls, and maintain evidence that supports AI compliance.
AI Inventory
Personal Data
Decision Context
Compliance Evidence
Identify AI applications, models, agents, automated workflows, datasets, and connected systems.
Connect automated systems to the personal data, lineage, ownership, access, and business processes behind them.
Apply policies, maintain governance records, identify risk, and support defensible compliance evidence.
BigID
Colorado AI Compliance
Discover • Understand • Govern
Colorado AI Act at a Glance
What Is the Colorado AI Act?
Colorado's current artificial intelligence law regulates automated decision-making technology used to materially influence consequential decisions about individuals. The framework replaces the original 2024 Colorado AI Act requirements and establishes obligations for developers and deployers, including technical documentation, consumer notices, explanations following adverse outcomes, personal data rights, human review, and compliance recordkeeping.
Current Framework
Automated Decision-Making Technology Act
Effective
January 1, 2027
Regulated Use
Consequential Decisions
Enforcement
Colorado Attorney General
Consequential Decisions
When Automated Decisions Carry Real-World Consequences.
Colorado's framework focuses on automated technologies that materially influence decisions affecting access, eligibility, or compensation in important areas of a person's life.
⌂
Housing
Real estate transactions and decisions affecting access to housing.
◇
Education
Enrollment, admissions, and access to educational opportunities.
$
Financial Services
Financial, lending, credit, and other covered financial decisions.
+
Healthcare
Decisions involving access to covered healthcare services.
✓
Insurance
Insurance and decisions involving eligibility for covered benefits.
▦
Government Services & Benefits
Essential government services, public benefits, and other consequential government decisions.
Compliance Responsibilities
Developers and Deployers Have Different Responsibilities.
Colorado's law separates responsibilities based on whether an organization develops covered automated decision-making technology or deploys it to influence consequential decisions.
Developers
Document How the Technology Works
Intended Uses
Document intended applications and known harmful or inappropriate uses.
Training Data Categories
Provide required information about categories of data used to train the covered technology.
Limitations
Document known limitations and relevant information needed for appropriate deployment.
Human Review
Provide instructions and information supporting appropriate human oversight.
Material Changes
Notify deployers when relevant material updates or modifications occur.
Deployers
Make Automated Decisions Transparent
Consumer Notice
Provide clear notice when covered automated technology is being used.
Adverse Outcome Explanation
Provide required plain-language information after certain consequential decisions.
Data Access & Correction
Support rights to access and correct factually inaccurate personal data used by covered technology.
Human Review
Support meaningful human review and reconsideration where required.
Compliance Records
Maintain records needed to demonstrate compliance with applicable requirements.
AI compliance starts with knowing which systems influence decisions, what data they use, who owns them, and how their outputs affect people.
The Governance Challenge
You Cannot Govern a Decision Without Understanding the Data Behind It.
An AI inventory can tell you that a system exists. Compliance requires deeper context around the personal data, lineage, identities, ownership, access, policies, and business processes connected to automated decisions.
System
AI / ADMT
What technology is making or influencing the decision?
→
Data
Personal Data
What information feeds or influences the decision?
→
Context
Lineage & Access
Where did the data come from and who can reach it?
→
Outcome
Consequential Decision
How does the automated output affect the individual?
→
Governance
Evidence & Action
Can you explain, govern, document, and correct the process?
BigID Capabilities
Support Colorado AI Compliance With Data-Aware Governance.
BigID connects AI systems to data, ownership, identity, access, activity, lineage, policies, risk, and remediation so teams can turn AI governance requirements into operational controls.
Discover AI & ADMT
Identify models, applications, agents, automated systems, datasets, pipelines, and shadow AI across enterprise environments.
Explore AI Security & Governance →Identify Personal Data
Discover and classify personal, sensitive, regulated, and business-critical data used by or accessible to automated systems.
Explore Discovery & Classification →Map Data Lineage
Understand where decision-relevant data originates, how it moves, where it changes, and which AI or automated systems depend on it.
Explore Data Lineage →Govern Identity & Access
Connect human and non-human identities to the sensitive data and systems they can access and identify excessive permissions.
Explore Data Access Governance →Assess & Prioritize AI Risk
Combine data sensitivity, access, activity, ownership, lineage, policy, and business context to surface AI governance risk.
Explore AI Risk Management →Maintain Governance Evidence
Connect AI inventory, ownership, assessments, policies, lineage, access controls, monitoring, incidents, and remediation into defensible governance records.
Explore AI Governance →Compliance Readiness
Build the Context Before You Need to Explain the Decision.
Colorado's requirements make it increasingly important to connect automated decisions to the systems, data, documentation, ownership, and governance processes behind them.
◎
Discover
Inventory Covered Systems
Identify AI and automated technologies involved in consequential business processes.
→
◇
Understand
Map Data & Lineage
Connect systems to the personal data, datasets, sources, transformations, and downstream uses behind decisions.
→
⌘
Assign
Establish Ownership
Link automated systems to accountable owners, business purposes, policies, and responsible teams.
→
✓
Govern
Apply Controls
Operationalize policies around data, access, risk, retention, monitoring, and appropriate AI use.
→
▦
Prove
Maintain Evidence
Keep inventory, documentation, assessments, lineage, controls, incidents, and remediation records current.
Frequently Asked Questions
Colorado AI Act FAQs
Understand Colorado's updated automated decision-making law and how data-aware AI governance can help organizations prepare.
What is the Colorado AI Act? +
The term Colorado AI Act commonly refers to Colorado's regulation of artificial intelligence and automated decision-making. In 2026, Colorado enacted SB 26-189, which repealed and reenacted the original SB 24-205 framework and established updated requirements for automated decision-making technology used in consequential decisions.
When does Colorado's updated AI law take effect? +
The updated Automated Decision-Making Technology Act takes effect January 1, 2027.
What is automated decision-making technology under Colorado law? +
Colorado defines automated decision-making technology as technology that processes personal data and uses computation to generate predictions, recommendations, classifications, rankings, scores, or other information used to make, guide, or assist a decision about an individual, subject to the law's specific definitions and exclusions.
What is a consequential decision? +
A consequential decision involves an individual's access to, eligibility for, or compensation related to covered areas such as education, employment, housing, financial and lending services, insurance, healthcare services, or essential government services and public benefits.
What must developers of covered ADMT provide? +
Developers of covered automated decision-making technology must provide deployers with required technical documentation addressing areas such as intended uses, training-data categories, known limitations, appropriate use, and human review, and must communicate relevant material updates.
What rights do consumers receive? +
The law provides rights involving access to personal data used by covered automated decision-making technology, correction of factually inaccurate data, required information following certain adverse outcomes, and meaningful human review in specified circumstances.
How can BigID support Colorado AI Act compliance? +
BigID can help organizations discover AI and automated systems, identify personal and sensitive data, map data lineage, connect identities and access, establish ownership, assess AI risk, operationalize policies, monitor exposure, remediate governance gaps, and maintain supporting compliance evidence.
Does BigID determine whether an automated decision is legally compliant? +
No. BigID provides data security, AI governance, access intelligence, risk, policy, and compliance capabilities that can support an organization's compliance program. Organizations should evaluate specific legal obligations and decision-making practices with appropriate legal and compliance professionals.
Colorado AI Compliance
Understand the Data Behind Every Automated Decision.
BigID helps organizations discover AI systems, understand the personal and sensitive data behind them, map lineage and access, establish ownership, assess risk, apply governance policies, and maintain evidence to support evolving AI compliance requirements.
Industry Leadership
