Colorado Just Defined What AI Governance Looks Like for Collections. The Rest of the Country Is Watching.

For two years, Colorado's 2024 AI Act sat on the horizon as the first comprehensive state AI consumer protection law in the country - broad, ambitious, and vague enough that most organizations simply waited to see if it would be amended before they had to comply with it.

On May 14, 2026, Governor Polis signed Senate Bill 26-189, repealing and replacing the 2024 Act entirely. The new law takes effect January 1, 2027.

The industry commentary called it a "lighter touch." For collections agencies and collections law firms, that reading misses the more important thing: the 2024 Act was too vague to operationalize. SB 26-189 is specific. It tells you exactly what you have to do.

The Konur Consulting take: Colorado's revised AI law is not a relaxation. It is a specification. The agencies that read it as a compliance reprieve are the ones that will face enforcement. The agencies that read it as an operationalization checklist will have compliant workflows before the Colorado AG's office has its first enforcement docket.

What SB 26-189 actually says

The new law centers on "automated decision-making technology" (ADMT) used in "consequential decisions." For financial services - including debt collection - a consequential decision is one that materially affects a consumer's financial position or legal rights.

An AI that determines which accounts to contact, sequences outreach based on scoring, generates settlement offers, or influences any adverse financial outcome for a Colorado consumer is operating in the consequential decision space under SB 26-189.

The obligations that attach to deployers - the agencies and firms using these tools:

Consumer notice. Before or at the time a covered ADMT is used in a consequential decision, the consumer must receive clear and conspicuous notice. The law allows this to be satisfied by a "prominent public notice reasonably accessible at points of consumer interaction." That is not a disclaimer buried in a terms-of-service page. It means the consumer can realistically find it when the AI is interacting with them.

Post-adverse-outcome rights. If a consumer experiences an adverse outcome from a consequential decision in which a covered ADMT was a material factor, they have the right to: access the personal data used in the decision, request correction of factually incorrect data, and request meaningful human review and reconsideration of the decision, to the extent commercially reasonable.

Meaningful human review. This is the most operationally significant requirement. A "trained individual with authority to approve, modify, or override the decision" must be available to review and reconsider adverse AI-influenced decisions. That individual must not simply default to the system output - they must consider relevant evidence and understand the system's intended use and limitations.

AG enforcement, with a cure window. Violations are deceptive trade practices under Colorado law. The Colorado AG enforces - no private right of action. Before bringing an enforcement action, the AG must generally provide a 60-day notice of violation and an opportunity to cure, except where violations are knowing or repeated. That cure window is only valuable to agencies that can discover and diagnose a violation within 60 days.

Why "lighter touch" misreads what happened

The 2024 Act required risk assessments, impact assessments, and a duty to use "reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination." That language was simultaneously sweeping and undefined. Most organizations' response was to wait.

SB 26-189 removed the duty-of-care framework, the risk management programs, and the impact assessment requirements. That is what "lighter touch" refers to.

What it added is disclosure obligations, post-adverse-outcome consumer rights, and a meaningful human review requirement. Those are specific, operational, and enforceable. An agency that cannot demonstrate it provided the required notice, that it has a process for handling adverse-outcome requests, and that it has a trained human with override authority in the loop is not compliant - and the 60-day cure window does not help if the agency does not know what went wrong or how to fix it.

What this means for collections operations

Three categories of AI use in collections fall squarely within SB 26-189's coverage:

AI-driven account scoring and prioritization. If your AI determines which accounts are contacted, in what order, and with what intensity - and a consumer in Colorado receives no contact on a recoverable account, or receives aggressive contact on a marginal one, because of that scoring - the AI has participated in a consequential financial services decision.

AI-generated settlement offers and payment plans. If your AI generates or recommends settlement terms for a Colorado consumer, and those terms are adverse to the consumer (below-market terms, high-pressure framing, terms that do not account for ability to pay), the AI has influenced a consequential decision with potential adverse outcomes.

AI-managed outreach sequencing and channel selection. An AI that determines whether to contact a consumer by voice, text, or email; how frequently; and at what time of day is making decisions that affect a consumer's financial situation. The data used in those decisions - credit scoring inputs, payment history, behavioral signals - is personal data that the consumer has a right to access if the outcome is adverse.

What to do before January 1, 2027

• Inventory your AI tools by consequential-decision exposure. Which of your AI platforms make, guide, or assist decisions that affect Colorado consumers' financial positions? Every covered tool needs a documented intended use, a notice process, and a human-review pathway.
• Build the consumer notice workflow. SB 26-189 requires notice at or before the point of AI interaction in a consequential decision. This is not a website footnote - it needs to be accessible at the moment of contact.
• Designate and document your meaningful human review function. Who in your organization has authority to override an AI-influenced decision about a Colorado consumer's account? That person needs to know the system's intended use, its limitations, and what "relevant evidence" looks like. This is a role definition and a training requirement, not just an org chart entry.
• Build the adverse-outcome intake process. When a Colorado consumer requests access to data used in an adverse decision, or requests human review, you need a process that can respond. Document it. Test it. Know your response timeline.
• Update vendor contracts. SB 26-189 requires developers to give deployers the information they need to comply - material updates, version identifiers, documentation of intended uses and known limitations. If your AI vendor contracts do not include these obligations, they need to be updated before January 1.

FAQ

Does SB 26-189 apply to agencies operating outside Colorado?

If the consumer is a Colorado resident, the law applies regardless of where the agency is located. Any agency with Colorado consumers in its portfolio should treat SB 26-189 as applicable.

What if our AI only assists human decision-makers - doesn't the human override the AI anyway?

SB 26-189's ADMT definition covers AI that "makes, guides, or assists" consequential decisions. Assistance is sufficient to trigger coverage. An AI that presents a scored recommendation to a human collector who almost always follows it is participating in the decision.

How is Colorado's law likely to influence other states?

Colorado was first. Its framework - disclosure obligations, consumer rights on adverse outcomes, meaningful human review - is already being cited as a template by other states developing AI legislation. The agencies building compliance architecture for Colorado will have the transferable framework when the next state follows.

Is there a small-business exemption?

SB 26-189 does not include an explicit small-business exemption for deployers. The original 2024 Act had a limited exemption for organizations with fewer than 50 employees that did not use their own data to train or fine-tune the AI. The revised law's exemption structure should be verified against the enrolled bill text for your specific circumstances.

Colorado backed down from the law that was too broad to enforce. What it replaced it with is a law that is specific enough to enforce. Those are different problems - and the second one has a January 1, 2027 deadline attached.

Konur Consulting helps collections agencies and law firms map their AI tools against SB 26-189's ADMT definition, design the notice and human-review workflows, and build the documentation infrastructure that makes a 60-day cure window usable rather than theoretical. Reach out at info@konurconsulting.com to start the compliance architecture work before the deadline arrives.

---

Source - Colorado SB 26-189: Norton Rose Fulbright, "Colorado Enacts Revised AI Law," May 2026. nortonrosefulbright.com

Source - Colorado AI law analysis: Morrison Foerster, "Colorado Hits Reset on AI Regulation with a New AI Act," May 15, 2026. mofo.com

Source - Consumer Financial Services Law Monitor: Kim Phan, Chris Willis and Taylor Gess, "Colorado Rewrites Its AI Law," May 13, 2026. consumerfinancialserviceslawmonitor.com