Does the NIST AI RMF still protect a Colorado AI program after SB26-189?
No, not by name. The signed text of Colorado SB26-189 does not mention NIST, ISO/IEC 42001 or any AI risk management framework, so the framework-based deployer program duty and the affirmative defense from SB24-205 are not carried into the replacement law. An organization can still use the NIST AI RMF voluntarily, and the framework remains a sound way to organize governance, testing and documentation. What changed is that the statute no longer names it as the benchmark a court or the attorney general will weigh when a violation is alleged. The governor signed SB26-189 on May 14, 2026 (Chapter 131), and several of its requirements start January 1, 2027, so the period between now and that date is the window to decide what the program is for.
The answer depends on which role the organization plays. A developer of automated decision-making technology used in consequential decisions must provide technical documentation to deployers from January 1, 2027. A deployer must give consumers notice, a plain-language explanation within 30 days after an adverse outcome, and a way to request data correction and human review. Consequential decisions cover access to or compensation for education, employment, housing, lending, insurance, health care and essential government services. Organizations that built a Colorado program around the old safe harbor should first inventory which systems touch those decisions, then confirm with counsel which role applies to each one. Ask counsel whether any remaining protection exists under the enforcement terms, which include the attorney general's authority under the Colorado Consumer Protection Act and a 60-day cure period for actions before January 1, 2030. The Colorado General Assembly bill page for SB26-189 is the starting point for that review.
What SB26-189 requires instead for automated decision-making technology
Under SB26-189, the central duty on the developer side is documentation. A developer of automated decision-making technology used in consequential decisions must give deployers technical documentation starting January 1, 2027. The law does not ask developers to adopt a particular framework, and the signed text does not name the NIST AI RMF or ISO/IEC 42001. Developers should expect deployers to request this documentation during procurement, so the content needs to be ready before contracts are negotiated.
- Timing: The documentation obligation begins January 1, 2027, so developers should confirm which of their current systems will be in use in Colorado after that date.
- Recipient: Documentation goes to deployers, who need enough detail to meet their own notice, explanation and review duties.
- Scope of the system: Developers should identify whether each product is used for a consequential decision as the law defines it.
- Contract terms: Ask counsel how documentation delivery, updates and confidentiality will appear in customer agreements.
- Ownership: A developer's documentation package is the input deployers rely on, so errors there pass downstream.
Before relying on any documentation template, confirm the exact content requirements with Colorado counsel, because the bill summary describes the duty at a high level and the signed act controls.
Deployers are the organizations that use automated decision-making technology to make or support consequential decisions about Colorado consumers. Their duties are consumer-facing. They must give notice that the technology is in use, provide a plain-language explanation within 30 days after an adverse outcome, and offer a way for consumers to request correction of their data and human review of the decision. These steps need operational owners, not just a policy document.
- Notice: Consumers must be told that automated decision-making technology is involved in the decision.
- Adverse outcome explanation: A plain-language explanation is due within 30 days after an adverse outcome, so the process needs a clock and an owner.
- Data correction: Consumers may request correction of their personal data, so deployers need a path to verify and act on requests.
- Human review: Consumers may request human review, so reviewers must have authority and access to the relevant information.
- Illustrative case: A lender that denies a loan through an automated model would need to send notice, explain the denial within the window and route a review request to a trained reviewer.
Deployers should confirm with counsel which of these steps apply to each consequential decision category and how the 30-day window is counted.
The law applies to automated decision-making technology used in consequential decisions, which SB26-189 defines as decisions about access to or compensation for education, employment, housing, lending, insurance, health care and essential government services. This list determines whether a system is in scope, so organizations should map each AI-supported workflow against it before assuming the law does not apply. Systems that only assist internal analytics may fall outside the definition, but that judgment depends on how the output is used.
- Education: Decisions about admission, access or compensation tied to schooling.
- Employment: Decisions about hiring, pay, promotion or access to work.
- Housing: Decisions about access to rental or purchased housing.
- Lending and insurance: Decisions about credit, loans, coverage or premiums.
- Health care and essential government services: Decisions about access to care, benefits or other essential public services.
Confirm the scope with the exact statutory definitions in the signed act, since operational teams often describe these decisions more broadly than the law does.
The Colorado attorney general enforces SB26-189 under the Colorado Consumer Protection Act. The law includes a 60-day cure period for actions brought before January 1, 2030, which gives organizations a window to correct a violation after notice. It also creates no new private right of action, so consumers cannot sue directly under this law. Enforcement therefore runs through the state, and the attorney general's view of a deployer's response will matter.
- Enforcing authority: The attorney general acts under the Colorado Consumer Protection Act.
- Cure period: A 60-day cure period applies to actions brought before January 1, 2030.
- No private right of action: The act creates no new right for individuals to sue under it.
- Documentation of cure: Keep dated records of what was corrected and when, since the cure window depends on showing the fix.
- Interaction with other law: Consumer protection claims and other statutes may still apply, so review them separately.
Ask counsel how the cure period applies to each duty and what records the attorney general would expect to see.
SB24-205 tied a deployer's risk management policy and program to the guidance in the NIST AI RMF, ISO/IEC 42001 or a substantially equivalent framework, and it offered an affirmative defense to organizations that followed those frameworks. SB26-189 repeals and reenacts those provisions as rules for automated decision-making technology, and its signed text does not mention NIST, ISO/IEC 42001 or any AI risk management framework. The framework-based program and the affirmative defense are not carried into the replacement law.
- Framework reference removed: The replacement law does not direct organizations to a named framework.
- Defense removed: The affirmative defense tied to NIST and ISO/IEC 42001 compliance is not part of SB26-189.
- Duties replaced: Notice, explanation, correction and review duties now form the core of the law.
- Effective dates: Several requirements start January 1, 2027, so timing differs from the original act.
- Programs built on the old safe harbor: Organizations should review whether their NIST-based documentation still answers the new duties.
Review any program written to the old law with counsel before treating it as current compliance evidence.
What changes the work for your organization
Whether a Colorado program needs rework depends less on the AI RMF itself than on a handful of facts about your organization. The cards below cover who builds the system, which decisions it touches, how many people it reaches, what existing documents can be reused and what vendors can supply. Each factor is something you can check and control before committing budget.
Build or buy the technology
Organizations that build automated decision-making technology hold the design, testing and documentation duties directly. Organizations that buy it depend on the developer for technical documentation, which SB26-189 requires developers to provide to deployers from January 1, 2027. Check whether your role is developer, deployer or both, because a company that customizes a vendor tool can take on developer-side obligations. Confirm this classification with counsel for each system in your inventory.
Consequential decision categories touched
SB26-189 applies to decisions about access to or compensation for education, employment, housing, lending, insurance, health care and essential government services. A system that scores job applicants and one that prioritizes support tickets may carry very different duties. List each system against these categories, including tools used only to inform a human decision. Systems that touch none of these categories may fall outside the new notice and correction duties.
Consumer and decision volume
The number of consumers affected and the number of individual decisions a system makes drive the operational load of notices, plain-language explanations and correction or human review requests. A tool that makes a few hundred lending decisions a month needs a different intake process than one that screens an entire applicant pool. Ask each business owner for decision volumes and request channels, then size staffing and ticketing to those figures rather than to a generic estimate.
Reuse of SB24-205 documents
Many organizations built risk policies, impact assessments and testing records against the original SB24-205 duties, which pointed to the NIST AI RMF and ISO/IEC 42001. SB26-189 does not mention either framework, so those documents remain useful evidence of practice but do not automatically satisfy the new duties. Map each existing document to a specific notice, explanation, correction or human review obligation. Gaps found in this mapping define the real rework.
Vendor documentation readiness
Deployers depend on developers for technical documentation that must be in hand from January 1, 2027. Before that date, ask each vendor in writing what documentation it will provide, in what format, how often it is updated and who answers questions about model changes. Include contract terms for documentation delivery and change notices. A vendor that cannot commit to these terms shifts risk to your program, so treat the answer as a procurement decision.
Enforcement exposure and cure
The Colorado attorney general enforces SB26-189 under the Colorado Consumer Protection Act and offers a 60-day cure period for actions before January 1, 2030. The law creates no new private right of action. Your exposure depends on how quickly you can detect a failed notice or unanswered correction request and fix it. Confirm with counsel which records you must retain to show a timely cure, and test your ability to produce them before enforcement questions arrive.
What to do with programs built around the old safe harbor
Treat a NIST AI RMF or ISO/IEC 42001 program built for Colorado as useful evidence of governance, but not as a statutory defense under SB26-189. The original SB24-205 tied a deployer's risk management program and an affirmative defense to the latest NIST AI RMF or ISO/IEC 42001. The signed text of SB26-189 does not mention either framework, so the work does not carry over automatically. Before relying on it, ask counsel to confirm in writing how the signed act treats existing framework documentation, and do not describe the program to customers or regulators as a safe harbor until that reading is in hand.
Re-scope the program around the duties SB26-189 actually sets for automated decision-making technology used in consequential decisions. Map each system that touches lending, employment, housing, insurance, health care, education or essential government services to the requirements that start January 1, 2027: consumer notice, a plain-language explanation within 30 days after an adverse outcome, and a way for consumers to request data correction and human review. Check whether the existing AI inventory, impact assessments and MEASURE evidence can produce those outputs, and where they cannot, plan the process, owners and records that will. Confirm the exact scope and dates with counsel rather than working from this summary.
Ask your developers and vendors now what technical documentation they will provide to you from January 1, 2027, and write those obligations into contracts and intake reviews. Also confirm how the attorney general's 60-day cure period for actions before January 1, 2030 would work in practice, and make sure incident and complaint records can show when a problem was found and fixed. A NIST-aligned program still helps answer the question of whether governance was reasonable, so keep it, but the decisions about notice, explanation and correction should now be traceable to the statute itself.
How to re-scope a Colorado program before January 1, 2027
The sequence below moves an organization from an inventory of AI systems to a documented set of consumer notice, explanation, correction and human review workflows that match what SB26-189 requires, with the evidence to show each one works. It replaces the framework-based program that SB24-205 once invited.
Inventory systems that touch consequential decisions
Start with the AI and automated tools already in use, then sort them by whether they make or substantially support decisions about education, employment, housing, lending, insurance, health care or essential government services. Legal or compliance staff should own the sort, with system owners confirming how each tool actually affects outcomes. The output is a list that marks each system as automated decision-making technology in a consequential decision or as out of scope, with the reason recorded. Confirm the final scope against the signed text of SB26-189 and any rules the attorney general issues.
Collect developer technical documentation
For each in-scope system bought from a vendor, request the technical documentation the developer must provide to the deployer from January 1, 2027. Contract terms should name what documentation is delivered, how often it is updated and who answers questions about it. For systems built in-house, the deployer and developer roles may both sit with one team, so the same documentation must be produced internally. The output is a documentation file per system, with a gap list for anything a vendor refuses or cannot yet provide.
Design consumer notice and adverse outcome workflows
Define the points where a consumer receives notice that automated decision-making technology is used, and the trigger that starts an adverse outcome workflow. The workflow must produce a plain-language explanation within 30 days after the adverse outcome, so the team needs a named owner, a template and a record of the date the outcome was issued. Test the workflow with sample cases, labeled as illustrative, to confirm the explanation is understandable without technical training. The output is an approved notice text, an explanation template and a tracked clock for each case.
Build correction and human review intake
Set up a channel where consumers can request correction of their data and a human review of the decision. Define who receives requests, how identity is confirmed, how the reviewer is independent of the original automated output and how the outcome is communicated back. Route intake through the same case system used for adverse outcome explanations so both obligations share one record. The output is a documented intake procedure, a reviewer assignment rule and test cases showing a request moves from receipt to decision.
Retire the framework-based safe harbor assumptions
Review the program documents built under SB24-205 and remove any statement that treats NIST AI RMF or ISO/IEC 42001 alignment as the basis for a legal defense under the replacement law. Keep those frameworks where they still serve the organization's own governance, but describe them as internal practice, not as a statutory defense. The output is a revised policy set and a memo for the legal team recording which obligations now rest on SB26-189 directly.
Document the evidence for each obligation
For every requirement, record the evidence that shows it operates: the inventory, vendor documentation, notice versions, explanation samples, correction and review logs, and the attorney general cure correspondence if one arises. Store the evidence with dates and owners so an assessor or the attorney general can trace each obligation to a working control. Ask an independent reviewer to test the file before January 1, 2027. The output is an evidence index mapped to each SB26-189 obligation, reviewed and signed by the accountable executive.
What must be in place before a Colorado review
SB26-189 replaces the framework-based program of SB24-205 with specific duties for automated decision-making technology in consequential decisions. The cards below list the records an attorney general review would likely ask for, and each one should be checked against the signed act (Chapter 131) rather than against the NIST AI RMF, which the replacement law does not name.
Inventory of covered systems
Start with a list of every automated decision-making system that influences access to or compensation for education, employment, housing, lending, insurance, health care or essential government services. Record the system owner, the decision it supports, the consumers affected and whether a human reviews the output. Check the inventory against the consequential decision categories in the signed act, since a system that touches none of them may fall outside the duties entirely. Ask counsel to confirm the boundary cases.
Documented decision categories
For each covered system, write down the consequential decision it makes and the category it falls under. Keep the definitions in one place so that a later reviewer can trace why a system was or was not treated as covered. Revisit the categories when a vendor adds a new use case, because a feature added for one purpose can move a system into a covered category.
Consumer notice and delivery records
Keep the notice text used for consumers, the version history of that text and proof of when and how each notice was delivered. Notice is a deployer duty, so the records should show that it reached the consumer before or at the time the system was used. Compare the wording with the notice requirements in the signed act and have counsel approve any change.
Adverse outcome explanation templates
Prepare plain-language templates that explain an adverse outcome and can be sent within 30 days after the decision. Each template should name the decision, the main factors that drove it and the steps the consumer can take next. Log every explanation with the date it was sent, the consumer reference and the person who approved the wording, so the 30-day timing can be shown for any sampled case.
Correction and human review logs
Document the procedure a consumer follows to request data correction and human review, and keep a log of each request, the outcome and the reviewer. The log should show when a request was received, when the data was corrected or the decision reviewed, and who made the call. Test the procedure with a sample request before a review, since an untested route is hard to defend.
Developer technical documentation on file
Deployers need technical documentation from the developers of the systems they use, and that documentation must be on file from January 1, 2027. Collect it under contract, record the version it describes and check that it covers the system as configured in your environment. Where a vendor cannot provide it, record the gap and the steps taken to obtain it.
Enforcement-ready records for the attorney general
The attorney general enforces SB26-189 under the Colorado Consumer Protection Act, and a 60-day cure period applies to actions before January 1, 2030. Keep records in a single, indexed repository so that the notices, logs, documentation and inventory can be produced quickly. Record when a problem was found and fixed, since that timeline is what supports a cure.
Who owns the legal duties and who prepares the evidence
The organization that develops or deploys an automated decision-making technology used in a consequential decision remains the party that owns the legal duties under Colorado SB26-189. Those duties include deciding whether and how the technology is used, giving consumers notice, providing a plain-language explanation within 30 days after an adverse outcome, and handling requests to correct data or to have a human review a decision. Outside help cannot take these over, because the law places them on the organization's own conduct.
- Use decisions: Leadership decides which consequential decisions the system supports, who approves changes, and when a system is paused or withdrawn.
- Consumer notices: The organization writes, approves and delivers notices and adverse-outcome explanations, and owns the accuracy of what they say.
- Consumer requests: Staff receive and answer correction and human review requests, and record the outcome.
- Developer documentation: Deployers must rely on technical documentation from developers from January 1, 2027, so procurement and contract teams must request it and check that it arrives.
- Records of decisions: The organization keeps the approvals, exceptions and incident decisions that show who acted and when.
Before engaging any partner, confirm internally which of these duties sit with you as developer, deployer or both, and which sit with a vendor under contract.
An implementation partner such as DeployOpen prepares the systems, workflows, documentation and evidence that the organization needs to show its own compliance. Work is typically fixed-scope and defined in writing before it starts. The partner does not decide the legal position, does not sign notices on the organization's behalf, and does not issue audit reports, attestations or certifications. No partner can guarantee compliance with a specific statute.
- Records and logging: Configuring self-hosted platforms so decisions, inputs, versions and reviewer actions are captured in systems the organization controls.
- Request workflows: Building the intake, tracking and response steps for correction and human review requests, with clear owners and deadlines set by the organization.
- Documentation packs: Drafting technical and process documentation for the organization to review, approve and maintain.
- Testing support: Running agreed tests, such as adversarial testing or red teaming within a defined scope, and delivering the results and remediation records.
- Handover: Delivering runbooks and configuration records so the organization can operate the program without the partner.
Ask any partner to state in the scope which artifacts it produces, which the organization must approve, and which it will not produce.
Counsel gives legal advice on how SB26-189 applies to a specific system, sector and contract, including whether a use is a consequential decision and how the attorney general's cure and enforcement framework affects the organization's exposure. An independent assessor or certification body gives a review or opinion on controls. Only the assessor issues a report or certificate, and only within its own engagement terms. Both roles should be engaged directly by the organization, not through the implementation partner, so their independence is preserved.
- Legal reading: Counsel confirms whether a deployment falls under the act and whether the organization's notices and records meet the statute as written.
- Enforcement posture: Counsel advises on the 60-day cure period for actions before January 1, 2030, and on what the attorney general may request.
- Independent review: Where an opinion on controls is needed for a contract or internal committee, an assessor reviews the evidence and reports its own findings.
- Scope letters: Counsel and assessors define the questions and the evidence they need before they review, which the partner can then prepare.
- Contract terms: Counsel reviews how developer and deployer obligations, documentation delivery and indemnities are allocated.
Confirm with counsel which duties under the act apply to your organization before commissioning any technical work.
How to choose a partner for Colorado ADMT work
Colorado's replacement law moved automated decision-making technology into its own rules, and the NIST AI RMF no longer appears in the signed text. A partner you choose should be able to show how it reads that text, what it will deliver in writing, and where its responsibility stops. The cards below set out the checks to run before you sign.
Counsel that reads the signed text
Ask whether the partner or your counsel has read the signed SB26-189 text, not summaries of the original SB24-205. The signed text does not mention NIST, ISO/IEC 42001 or any AI risk management framework, so a program built only around the old framework-based risk program and affirmative defense may not map to current duties. Ask who interprets the law for your organization and who signs off on that reading. The partner prepares systems and evidence; it does not give legal advice unless it is licensed to do so.
Written scope before work starts
Require a written scope that lists which systems count as automated decision-making technology used in consequential decisions, which duties are in scope, what deliverables you will receive and the dates each one is due. Consequential decisions cover education, employment, housing, lending, insurance, health care and essential government services. A scope that does not name the systems or the decisions will leave gaps in notice, explanation and correction handling. Ask for the change process if scope moves during the work.
Prior notice and logging work
Ask for examples of consumer notice text, adverse outcome explanation templates and request handling workflows the partner has built for other systems. Your program needs a way to deliver a plain-language explanation within 30 days after an adverse outcome, and a way for consumers to request data correction and human review. Ask how those requests are logged, how long records are kept and who can see them. If the partner cannot describe its logging design in concrete terms, treat that as a readiness gap.
Clear limits on certification
No AI RMF certification exists, and no partner can issue an attestation that your systems meet SB26-189. Ask the partner to state in writing what it will not certify, including legal compliance conclusions, enforcement outcomes and the attorney general's view of your program. Only an independent auditor or assessor issues reports, and the Colorado attorney general enforces the act. Confirm that any readiness review is labeled as preparation, not as a finding of compliance.
Decision rights over covered systems
Ask who in your organization holds the authority to approve, restrict or switch off a system used for consequential decisions, and whether the partner has any role in that decision. Clarify who receives developer technical documentation, who answers consumer requests for human review and who has final say when a review reverses an outcome. Document these roles before implementation begins. A partner can configure the workflow, but the organization owns the decision.
Technical documentation handoff
If you deploy a system built by a vendor, confirm that the developer's technical documentation will reach you before the January 1, 2027 start of that duty. Ask the partner whether it can check that documentation for gaps and map it to your notice and explanation workflows. Check who pays for and maintains that documentation after go-live, and what happens if the developer changes the system. This check is most useful when the partner also builds the monitoring that will show those changes.
Questions buyers ask about the Colorado AI Act and the NIST AI RMF
Does Colorado SB26-189 mention the NIST AI RMF?
No. The signed text of SB26-189 does not mention NIST, ISO/IEC 42001 or any AI risk management framework. The original SB24-205 tied a deployer's risk management policy and program to the latest NIST AI RMF, ISO/IEC 42001 or a substantially equivalent framework, and gave an affirmative defense for organizations that followed those frameworks. The replacement law, signed May 14, 2026 as Chapter 131, does not carry that language forward. Read the signed SB26-189 text yourself before you assume any framework-based protection still applies.
Does the NIST AI RMF still help if the law no longer names it?
Yes, but its role changes. The NIST AI RMF is voluntary and was never a legal requirement under Colorado law, so it remains a practical way to structure governance, mapping, measurement and management of AI risk. It can help you document how you identify consequential-decision systems, test them and respond to problems, which the replacement rules still expect in some form. What it no longer does is serve as a statutory safe harbor under Colorado law. Treat it as a method for building evidence, not as a legal shield, and confirm the current obligations with counsel.
What changes in Colorado on January 1, 2027?
Several SB26-189 requirements start on January 1, 2027. The law regulates automated decision-making technology used in consequential decisions, defined as decisions about access to or compensation for education, employment, housing, lending, insurance, health care and essential government services. From that date, developers must give deployers technical documentation. Deployers must give consumers notice, provide a plain-language explanation within 30 days after an adverse outcome, and offer a way to request data correction and human review. Confirm which obligations apply to your role as developer or deployer before you plan the work.
Who enforces the Colorado AI law, and what is the cure period?
The Colorado attorney general enforces SB26-189 under the Colorado Consumer Protection Act. For actions taken before January 1, 2030, the law provides a 60-day cure period, so an organization that receives notice of a violation has a window to correct it. The act creates no new private right of action, which means consumers cannot sue directly under this statute. Enforcement still falls under existing consumer protection law, so an uncured violation can carry the penalties that law allows. Ask counsel to confirm how the cure period applies to your facts.
Can we meet the Colorado requirements in-house?
Often yes, if you have staff who understand the consequential decisions your systems affect, can read vendor technical documentation, and can run a consumer notice and correction process. The work splits into legal interpretation, which counsel owns, and system work, which your engineering, data and operations teams own. Outside help is most useful when you lack an inventory of automated decision systems, need to test models for the decisions covered by the law, or must build evidence before the January 1, 2027 dates. An implementation partner can prepare systems, logs and documentation. Only you decide compliance, and only an independent party issues any formal assessment.
What should we ask a partner for in a quote?
Ask for a written scope that names the systems, decision types and jurisdictions covered, and whether Colorado is the only law in view. Request the deliverables in plain terms, such as an inventory, documented data flows, notice templates, a correction and human review workflow, logging design and test records. Ask which parts are one-time work and which recur, such as monitoring, updates after rule changes and retained evidence. Confirm who your counsel is, what the partner will not do, and how changes to the law after the quote are handled. DeployOpen does not publish a price list, and a quote follows from the written scope.
Does the planned NIST revision affect Colorado organizations?
Indirectly, and mainly through the framework you cite. NIST says AI RMF 1.0 is being revised under the White House AI Action Plan and has not yet published a revised version as of October 17, 2026. Because SB26-189 no longer cites the NIST AI RMF, the revision does not change Colorado's current statutory text. It does matter if your internal program, customer contracts or other laws reference the framework by version, since a revised document could change what you are measured against. Track the revision and record which version your program uses.
How DeployOpen scopes Colorado readiness work
DeployOpen agrees the scope of any Colorado readiness work in writing before it starts. For an organization preparing for SB26-189, that scope names the automated decision-making systems in question, the consequential decisions they support (such as lending, employment, housing or insurance), and the deployer workflows to be built. Those workflows typically cover consumer notice, the plain-language explanation due within 30 days after an adverse outcome, the route for requesting data correction, and the path to human review. The scope also states which technical documentation the organization expects to receive from its developers from January 1, 2027, and how that documentation will be stored and checked. Your legal, compliance and product teams should confirm the scope against the signed text of the act before any engineering begins, because the definitions decide which systems are in scope.
DeployOpen then implements and documents the technical controls, notice and logging workflows that the organization has chosen, running inside the organization's own infrastructure. The handover is an evidence package: configuration records, workflow logs, test results and the documentation that shows how each step operates, arranged so that counsel, internal audit or an assessor can review it. DeployOpen prepares systems and evidence for review. It does not give legal advice, issue audit reports, attestations or certifications, or guarantee any outcome with the Colorado attorney general. Decisions about whether a system is covered, how notices read and how the organization responds to an enforcement inquiry stay with the organization and its counsel.
