Colorado rewrote its AI law: four duties every AI product will meet anyway

On 14 May 2026, Colorado repealed the AI law it had passed two years earlier and replaced it with a narrower one. From 1 January 2027², any company that uses automated decision-making technology to materially influence a decision about someone's education, job, loan, insurance, health care or government services in Colorado must meet four duties. Tell people first. Explain a bad outcome. Let them fix their data. Give them a real human review. Most product teams will read that as a compliance task. I read it as a product spec, and a cheap one.

What does Colorado's new AI law require?

The new law, SB 26-189, puts the duties on the company that deploys the system:

• Notice before use. A clear notice that automated technology will shape the decision. A prominent public notice can count.
• An explanation after a bad outcome. Within 30 days³ of an adverse outcome, such as a denial or worse terms, a plain-language account of the decision, the technology's role and the person's rights.
• A right to correct. People can ask to fix personal data that is wrong or materially inaccurate.
• Meaningful human review. Where commercially reasonable, a trained reviewer with the authority to override, who must not simply defer to the machine.

Developers must give deployers documentation on intended uses, limits and how to review outputs. Both keep records for at least 3 years². Only the attorney general enforces it, and companies get a 60-day³ window to fix a violation unless it was knowing or repeated.

What Colorado dropped tells you where the US is going

The old law asked for risk management programs, annual impact assessments and a duty of reasonable care against algorithmic discrimination. All of that is gone. What survived is the part a customer can see.

That is not an accident. Washington has tried to stop states from regulating AI and has not managed it. In July 2025 the Senate voted 99 to 1⁴ to strip a 10-year moratorium on state AI laws from the budget bill. A December 2025 executive order set up a Justice Department task force to challenge state AI laws, and in April 2026 the Justice Department joined a lawsuit against Colorado's original law⁵. Still, no federal statute overrides state rules yet¹.

So the floor that survives the politics is the consumer-facing floor: notice, explanation, correction, review. If you are betting on which duties will outlast the next fight in Congress, bet on those four.

The four duties are just good product

Strip away the legal language and each duty is something a well-run business already wants.

Notice is trust. Explanation is customer support done before the complaint. Correction is free data cleaning. Human review is an escalation path, which every service business needs anyway.

I have seen transparency pay for itself. At Praava Health we replaced referral kickbacks with transparent pricing, and lab margins rose from about 30% to 50%. At Ekhanei, building the motorbike category from zero in about two and a half months depended on trust by design, because buyers would not hand over money to a stranger otherwise. Telling people how a decision was made is not a tax on growth. In low-trust markets it is the growth strategy.

Bangladesh is already stricter on one point

Here is the flip. Bangladesh's Personal Data Protection Ordinance, gazetted in November 2025, gave citizens the right to access and correct their data, and the right to restrict automated decisions made with it⁶. It treated health, financial, genetic and biometric data as sensitive, with enhanced protection. Parliament has since enacted a Personal Data Protection Act 2026⁷.

Compare that with Colorado. Its human review applies only to the extent it is commercially reasonable. HIPAA-covered health entities are largely exempt for most uses, and FDA-regulated medical devices are excluded. A health AI product could be lightly touched in Denver and fully covered in Dhaka.

The lesson for anyone building across both markets is simple. Do not build a Colorado version and a Bangladesh version. Build once, to the strictest rule you will face, and switch features off where the law is looser. It is far cheaper than retrofitting an explanation screen into a live product.

Build once, for the strictest market

Here is the spec I would hand a product team this quarter. My free AI use-case risk triage shows which of your use cases make consequential decisions and need it first.

• Log every decision. Inputs, model version, output and any human action, kept at least three years. Every other duty depends on this.
• Write the adverse-outcome letter now. One page, plain language, what was decided, what the AI did, and how to ask for review. Test it on real users.
• Give correction a front door. A form or a phone line that actually changes the data and re-runs the decision.
• Staff the human review. Name reviewers, train them, give them power to override, and track how often they do.
• Ship one design. Same notices and controls in every market, tuned only where a law is stricter.

I made a related case when the EU paused its rules: use the extra time to build, not wait. Colorado is the US version of the same lesson.

The short version

• From 1 January 2027, Colorado's SB 26-189 sets four duties for AI that shapes decisions on jobs, loans, insurance, education, health care and public services.
• The duties are notice, an explanation within 30 days of a bad outcome, data correction and meaningful human review.
• Colorado dropped impact assessments and risk programs, and no federal law overrides state AI rules yet.
• Bangladesh's 2025 data ordinance gave a right to restrict automated decisions, stricter than Colorado on that point.
• Build once, to the strictest market, with decision logs, plain-language notices and staffed human review.

If a customer asked tomorrow why your AI turned them down, could you answer in one plain page?

Md Shafaat Ali Choyon (MPH, CHES®, MBA, MCIM) is a growth, marketing and public-health strategist who builds and runs AI in production, with 17 years across telecom, fintech, e-commerce, consumer tech and healthcare in the US and Bangladesh. See the essays or the portfolio.