Colorado’s Rewritten AI Act Reaches Tenant Screening on January 1, 2027. The Attorney General’s Draft Rules Are Out and Comments Close October 26.

1. What Colorado’s ADMT Act means for a landlord who screens with software

Beginning January 1, 2027, Colorado’s Automated Decision Making Technology Act makes a landlord or property manager doing business in Colorado a regulated deployer when it uses covered automated decision making technology that materially influences a consequential decision about leasing residential real estate in Colorado. If your screening platform produces an accept, decline, or conditional recommendation and you follow it more often than not, the law is written for you.

Colorado SB 26-189 is a state law, effective January 1, 2027, that requires any business using automated decision making technology to materially influence a decision about housing, employment, credit, insurance, education, or health care to give consumers advance notice, explain adverse outcomes within 30 days, honor data correction and human review requests, and keep records for three years. It replaced Colorado’s 2024 AI Act, which never took effect, and is enforced exclusively by the Colorado Attorney General.

The statute is short by AI law standards, 24 pages in the signed act, and it is written in the language of notices, explanations, and appeals rather than bias audits and impact assessments. That makes it easier to comply with than the repealed law and harder to ignore, because the duties are concrete and dated.

We covered the employment side of this statute in Colorado’s AI Law Never Took Effect: What Applies to Employers on January 1, 2027. This article is the housing application. The two share definitions and enforcement, but the Attorney General’s proposed rules treat rental housing as its own case, with its own examples and, in one respect, its own presumption.

The audience here is the owner or manager of 5 to 500 units who screens through a vendor product and follows the recommendation because that is what the product is for. Under the old law that person would have been exempt from most of the work. Under this one there is no headcount threshold and no small landlord carve out.

2. Which screening tools are covered and which are not

A screening tool is covered ADMT under C.R.S. 6-1-1701(5) when it processes personal data, uses computation to generate a score, ranking, recommendation, classification, or prediction about an applicant, and that output is used to materially influence the application decision. The test has nothing to do with whether the vendor calls the product artificial intelligence or uses a large language model. On the statutory definition, a rules based risk score built in 2009 can qualify just as well as a machine learning model built last year, if it processes personal data, generates a decision relevant output, and materially influences the decision.

The definition of ADMT at 6-1-1701(2) is broad by design: any technology that processes personal data and uses computation to generate output “used to make, guide, or assist a decision, judgment, or determination concerning an individual.” The carve outs at 6-1-1701(2)(b) are for infrastructure, not decision tools: anti malware, databases, firewalls, spell checkers, web hosting, spreadsheets that require human analysis without machine learning, and tools used solely to summarize, organize, translate, draft, route, or present information for human review.

The second filter is “materially influence,” defined at 6-1-1701(13) as an output that is more than a de minimis factor and that affects the outcome “by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how a consequential decision is made.” Incidental, trivial, or clerical uses do not count. A screening report that only presents raw records for a leasing manager to read is on the safer side of that line. A screening report that attaches a green, yellow, or red recommendation is not.

There is a third filter that matters for small operators: consequential decision at 6-1-1701(3)(b) expressly excludes advertising, marketing, search, routine scheduling, customer service triage, and communication of decisions. It also excludes, at 6-1-1701(3)(b)(VIII), activities relating to fraud prevention “including identity verification, consumer identification, monitoring, and reporting controls required under state or federal law.” How far that exclusion reaches for a voluntary identity or fraud check that no law requires is not settled by the text, so do not assume every fraud tool is categorically outside the act. An identity check is in any event not the decision to deny the applicant, which is.

The “records only” row is a risk assessment, not a safe harbor, and it depends on the human actually deciding. The Attorney General’s notice of hearing proposes a presumption that an output materially influenced a decision whenever it “constrains an option set, sets a threshold, or produces a rank, score, classification, recommendation, prediction, or other inference” that the decision maker reviewed and that matches the outcome. The presumption can be rebutted with evidence that the decision maker recorded an independent judgment before seeing the output, did not view it, or decided inconsistently with it. If your leasing file cannot show any of those things, assume the tool is covered.

3. Does this reach an owner outside Colorado?

Yes, if you are doing business in Colorado and the applicant is being evaluated for Colorado housing. A deployer under 6-1-1701(7) is “a person doing business in Colorado that deploys a covered ADMT.” Owning and leasing residential units in the state is doing business in the state, whether the owner is an LLC in Denver or an individual in Phoenix managing a Fort Collins fourplex through a national platform.

The consumer definition closes the other side of the loop. Section 6-1-1701(4) borrows the Colorado Privacy Act definition of consumer, which normally means a Colorado resident, and then expands it at (4)(b) to include “any individual whose access to, eligibility for, or opportunity in Colorado is evaluated in a consequential decision by a person doing business in Colorado.” On the face of that text, an applicant relocating from Texas who applies for a Boulder apartment is a consumer for this purpose even though she is not yet a Colorado resident. No rule or enforcement action has yet applied the expanded definition, so treat that reading as the text’s plain meaning rather than settled interpretation.

The covered domain itself is territorial: 6-1-1701(6)(c) reaches “the lease or purchase of residential real estate in Colorado.” A Colorado based company screening applicants for units it manages in Nebraska is not making a Colorado housing decision. What matters is where the unit is, not where the software runs or where the company is headquartered.

The practical consequence is that a portfolio with even a handful of Colorado units needs a Colorado specific workflow. Most multistate operators already carry a Colorado addendum for the Rental Application Fairness Act. SB 26-189 adds a second layer to the same addendum rather than a new category of work.

4. The four duties that attach on January 1, 2027

A landlord deploying a covered screening tool owes four things under SB 26-189: notice before the tool is used, a written explanation within 30 days of any adverse outcome, a functioning process for correction and human review on request, and three years of compliance records. Each duty applies to consequential decisions made on or after January 1, 2027, per Section 5(3) of the act, so an application decided on December 30, 2026 is outside the law and one decided on January 2, 2027 is inside it.

Duty one: pre use notice, 6-1-1704(1) and (2)

Before using a covered tool to materially influence a decision, the deployer must give the consumer “clear and conspicuous notice” that it used or will use the tool, plus instructions for obtaining the additional information the statute provides for. Subsection (2) says a deployer complies by “maintaining a prominent public notice that is reasonably accessible at points of consumer interaction,” including a link or posting reasonably close to the application. For rental screening, the most defensible implementation is a clear notice at or before the application interaction, with a public policy or linked notice readily accessible to applicants, rather than a line buried in the lease.

Duty two: post adverse outcome disclosure, 6-1-1704(3)

Within 30 days after a decision that results in an adverse outcome, the deployer must provide three things: a plain language description of the decision and the role the tool played in it, instructions and a “simple to follow process” for requesting the tool’s name, version number, developer, and the types, categories, and sources of personal data used, and an explanation of the consumer’s correction and human review rights and how to exercise them. Subsection (5) preserves trade secrets, but a deployer that withholds information on that basis must tell the consumer it is doing so.

Duty three: correction and meaningful human review, 6-1-1705

A consumer who experiences an adverse outcome may request instructions for obtaining and correcting “factually incorrect or materially inaccurate personal data” used in the decision, and “an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable.” The statute does not require correction of “opinions, predictions, scores, or protected evaluations,” so a consumer can dispute a wrong eviction record but cannot demand that the score itself be rewritten.

Meaningful human review is a defined term in the statute itself at 6-1-1701(15), not only in the proposed rules, and the definition is where the work lives. The reviewer must be designated by the deployer, must have authority to approve, modify, or override the decision, must consider relevant available primary evidence, must be trained to conduct the review, must not default to the system output, and must understand the tool’s intended use, material limitations, categories of inputs, and principal factors. A leasing agent clicking “confirm” on the same screen that produced the score does not satisfy any of that. The proposed rules discussed in section 6 would add reviewer independence, timelines, and documentation on top of these statutory elements.

Duty four: three years of records, 6-1-1703

The deployer must retain, for not less than three years after the date of the decision, “records reasonably necessary to demonstrate compliance,” which may include tool version identifiers, changelogs, and documentation of material mitigation changes. The same section requires a longer period if other law requires one. The retention clock runs from each consequential decision, so in practice a landlord should keep decision level records sufficient to show compliance, including the notice, the tool information, the output, any correction request, and any review, and a 200 unit portfolio with normal turnover will accumulate several hundred dated records a year.

There is also a duty the landlord does not owe but benefits from. Under 6-1-1702, on and after January 1, 2027 the developer of a covered tool must give each deployer a statement of intended and inappropriate uses, training data categories to the extent known, known limitations and risks, instructions for use and human review, and the information the deployer needs to comply with 6-1-1704. The statute anticipates vendor silence by requiring the deployer to disclose data sources only “to the extent the deployer receives the necessary information from the developer.” That limits the disclosure duty; it does not shift the rest of the deployer’s obligations to the vendor, so document the request, the response, and any refusal.

5. Adverse outcome is broader than denial

An adverse outcome under 6-1-1701(1) includes any decision that “denies, terminates, revokes, or materially reduces or restricts” access to housing and, separately, any decision that imposes “materially less favorable differentiated price, cost, compensation, or other material terms” compared to similarly situated consumers. A landlord who never denies anyone but routinely uses a score to require a double deposit, a cosigner, or a shorter lease term is producing adverse outcomes every week, provided the terms are materially less favorable than those offered to similarly situated applicants, which is a fact question the statute does not answer in advance.

The Attorney General’s proposed rules make this concrete with rental examples. One describes a housing provider that uses a covered tool “as the sole basis” for setting a $2,500 security deposit on a three bedroom unit where other applicants for the same size unit paid between $1,500 and $2,500, because the applicant lacked recent rental history. That provider must send an adverse outcome disclosure that names the decision, the role of the tool, and the principal reason. Another example describes a consumer “charged two months’ rent instead of one month’s rent” as a deposit because the tool profiled a high likelihood of property damage from prior rental history and credit score.

Nonrenewal is in scope too. The proposed human review rule uses the example of a property management company that relies on a covered tool to decide not to renew leases for a group of residents based on rental agreement violations and two years of payment history. Because the harm is denial of housing, the rules treat that as “a denial of a basic human need” and presume human review is commercially reasonable, a point we return to in section 6.

The definition at 6-1-1701(1)(b) closes with a sentence that removes any ambiguity: “If a decision outcome imposes materially less favorable differentiated pricing or terms, the decision outcome materially influences price, cost sharing, compensation, or material terms.” If the tool set the deposit, the disclosure duty follows.

6. What the Attorney General’s proposed rules would add

The Colorado Department of Law filed proposed rules implementing SB 26-189 with the Secretary of State on August 11, 2026, and they would turn the statute’s general duties into specific formats, deadlines, and standards effective January 1, 2027. Everything in this section is proposed, not final, and may change before adoption. According to the Attorney General’s rulemaking page, comments submitted by September 4, 2026 will be considered in a revised draft to be circulated no later than September 23, 2026, the written comment period runs through October 26, 2026, and the public hearing under the notice of hearing begins October 26, 2026 at 10:00 AM at 1300 Broadway in Denver, in person and by video.

The statute itself commands this rulemaking. Sections 6-1-1704(4)(b) and 6-1-1705(3) require the Attorney General to adopt rules clarifying the adverse outcome disclosure and consumer rights provisions on or before January 1, 2027, and 6-1-1706(5)(b) authorizes rules on “materially influence” including “presumptions, illustrative examples, and objective indicators.” The proposed rules, designated 4 CCR 904-6, do all three. The provisions below are the ones a housing provider should read first, and every one of them may change before adoption.

Form and delivery of the adverse outcome disclosure

As drafted, proposed Rule 6.2 would require the disclosure in writing “via at least two methods” when the deployer has two ways of reaching the consumer, for example email plus regular mail, and through any channel the deployer typically uses with that consumer. Printed disclosures could not be smaller than 12 point font. Proposed Rule 3.2 would layer on plain language, accessibility consistent with WCAG 2.2 for online content, delivery in the language in which the deployer ordinarily interacts with the consumer, and readability on mobile screens.

Content: principal reasons with specificity

Proposed Rule 6.4 would require the disclosure to state what decision was made, using the example “Leasing Company ABC was unable to approve your application to rent 123 Main Street,” to describe the role of the tool and of any human reviewer, and to give “the principal reason(s) for the adverse outcome with specificity.” A statement that the outcome was based on “internal standards or policies” would be expressly insufficient. If the outcome rested on a risk score, the disclosure would have to say so and disclose the consumer’s score. If any data point produced an automatic denial, such as a credit score of 580 or a felony conviction three years earlier, the automatic denial factor would have to be disclosed. If incomplete information caused the outcome, the disclosure would have to say what additional information would be needed.

Then comes the sentence that should get every operator’s attention: “A Deployer does not comply with section 6-1-1704(3)(a), C.R.S. when it is not able to explain how a Covered ADMT Materially Influenced a Consequential Decision, or how the Covered ADMT used a Consumer’s Personal Data in connection with that decision.” If that language survives to adoption, “the vendor will not tell us” is not a defense. It is the violation.

Follow up information within ten business days

Proposed Rule 6.6 would require that a consumer who follows the disclosure’s link or calls a toll free number receive the tool’s name, version, developer, and data types and sources immediately, and that a consumer who writes in receive the same within ten business days. Data sources would have to be identified by name, including “specific data brokers, databases, courts, social media companies, schools, and employers,” and where a data broker aggregated from other sources, the original source too.

Human review: the housing presumption

Proposed Rule 7.7 would list seven factors for whether human review is commercially reasonable, including the deployer’s size and capacity and the marginal cost of review, then adds a presumption: “When the harm to a Consumer resulting from an Adverse Outcome is a severe and irreversible denial of a basic human need, Meaningful Human Review is presumed to be Commercially Reasonable.” The rule’s own worked example applies that presumption to a lease nonrenewal and states that a management company can rebut it only by proving the review is “technically or financially impossible, or that the review could not change the adverse outcome.” The deployer bears the burden with specific evidence.

The proposed reviewer standard is demanding for a small operation. The draft would require “an independent reviewer who did not make the original decision” and, whenever feasible, one who does not report to the person who did, would state that ADMT “may not assist in the Meaningful Human Review,” would require acknowledgment of the request within 10 days and a decision within 45 days, and would say an adverse outcome “must be stayed pending Meaningful Human Review” where possible. For a two person operation the “whenever feasible” qualifier is doing real work, and a comment explaining why is exactly what the October 26 deadline is for.

Two proposed tests for “materially influence”

The notice of hearing puts two alternative definitions of “de minimis factor” out for comment. Standard 1 treats a factor as de minimis only if it had “a trifling, trivial, or incidental impact,” even where other factors mattered more. Standard 2 treats it as de minimis if it “is not a substantial factor” and independent factors “played a significantly larger role.” Both carry the same presumption of material influence for any score the decision maker saw that matches the outcome; Standard 2 is materially friendlier to a landlord who documents a real review.

Vendors and the open question

The notice concedes that the statute “does not explicitly contemplate scenarios in which Deployers do not directly operate the ADMT” and asks whether the rules should define an “ADMT vendor,” whether deployers should be “responsible for fulfilling all Deployer obligations” when they use one, and whether vendors must help answer consumer data requests. Almost every small landlord screens through a vendor, so this is the most important open question in the docket for this audience.

7. How this stacks on FCRA and Colorado’s Rental Application Fairness Act

SB 26-189 does not replace the two notices a Colorado landlord already sends; it adds content requirements that neither existing notice was built to carry. Understanding the gap between the three is the difference between one compliant letter and three inconsistent ones.

The federal layer is the Fair Credit Reporting Act. As the FTC explains in its guidance for landlords, if you reject an applicant, raise the rent or deposit, require a cosigner, or take “any other adverse action based partly or completely on information in a consumer report,” you must give an adverse action notice. That notice must identify the consumer reporting agency, state that the agency “did not make the decision to take the unfavorable action and can’t give specific reasons for it,” and explain the right to dispute and to a free report within 60 days. FCRA does not require the landlord’s own reasons in that notice, and the notice does not substitute for any separate state law duty to explain the decision. That is the first gap.

The state layer is the Rental Application Fairness Act at C.R.S. 38-12-904. If a landlord denies an application, it must provide “a written notice of the denial that states the reasons for the denial,” with a good faith effort to do so within 20 calendar days, plus a copy of any consumer report obtained. The same section caps rental and credit history lookback at seven years and most criminal history at five. That sounds like it covers the new law, until subsection (2)(a)(II): if “the specific screening criteria cannot be directly cited because of the use of a proprietary screening system,” the landlord may instead hand over the vendor’s report “with only the proprietary information redacted.” SB 26-189 has no such escape. That is the second gap.

The proposed rules do try to reconcile the layers. Proposed Rule 6.7 would treat a deployer that must send an FCRA or ECOA adverse action notice as complying with 6-1-1704(3) “as long as” the notice also contains the ADMT information and rights explanation required by 6-1-1704(3)(b) and (c) and goes out within 30 days. A second paragraph would extend the same treatment to notices required by “any other federal, state, or local law,” which would include the 38-12-904 denial notice. If that rule is adopted substantially as drafted, the workable design is one Colorado letter that satisfies all three, sent within 20 days to meet the shortest clock, containing reasons, the tool identification block, and the rights paragraph. Until then, plan for the combined letter but be ready to split it.

One caution. The statute’s own harmonization clause at 6-1-1704(6) is written for “a creditor” giving notice under ECOA and Regulation B. A landlord screening an applicant is generally not a creditor, so the statutory safe harbor does not obviously reach the leasing office, and the broader reconciliation lives only in the proposed rule. If Rule 6.7 changes in the September 23 draft, the answer changes with it.

8. Enforcement, penalties, and the 60 day cure window

The Colorado Attorney General enforces SB 26-189 exclusively, a violation is a deceptive trade practice under the Colorado Consumer Protection Act, and the civil penalty is up to $20,000 per violation, with the statute’s separate violation language capable of multiplying exposure across consumers or transactions. No new private right of action exists, but the act expressly preserves discrimination claims under the Colorado Anti Discrimination Act, and it voids vendor contract terms that would shift that discrimination liability onto the landlord.

The architecture is at 6-1-1706. Subsection (1)(b) makes violations of the developer, recordkeeping, disclosure, and consumer rights sections “enforceable exclusively by the attorney general,” and subsection (2)(a) declares a violation “a deceptive trade practice,” which Section 2 of the act writes into C.R.S. 6-1-105 as new paragraph (uuuu). That routes penalties through C.R.S. 6-1-112, which sets a civil penalty of “not more than twenty thousand dollars for each violation” and provides that “a violation of any provision constitutes a separate violation with respect to each consumer or transaction involved.” Where the violation was committed against an elderly person the ceiling rises to $50,000. How a screening program’s violations would be counted, per applicant, per notice, or per practice, is a question the Attorney General’s charging theory and a court will answer, not the statute, so treat the per consumer language as potential cumulative exposure rather than a formula.

The cure period is the feature most likely to matter in the first two years. Under 6-1-1706(3), before any enforcement action the Attorney General must issue a notice of violation “if a cure is deemed possible,” and may sue only if the deployer fails to cure within 60 days. The cure right does not apply to knowing or repeated violations, and it is a procedural opportunity to fix a problem before suit, not immunity. It is repealed effective January 1, 2030, so an operator has three years of that opportunity and then none. Starting in January 2028 the Attorney General must report annually on actions filed and cure periods offered and missed, so the first public enforcement statistics land about 13 months after the law takes effect.

Two provisions of 6-1-1707 change the risk calculus around vendors. Subsection (1) confirms that a deployer or developer “may be held liable in an action alleging unlawful discrimination” under the Colorado Anti Discrimination Act “arising from a consequential decision materially influenced by a covered ADMT,” with fault allocated between them under subsection (2). Subsection (7)(a) then declares “contrary to public policy and void” any contract provision that would indemnify a developer or deployer against liability for its own acts or omissions in violation of Colorado anti discrimination law. Subsection (7)(c) confirms the clause “does not otherwise limit the enforceability of contract terms between parties acting in a commercial or business capacity,” so vendors and landlords can still allocate service failures, defense costs, and other commercial risk. What neither can do is contract away statutory liability for its own discrimination.

The budget signals how enforcement will start. Section 4 appropriates $46,190 to the Department of Law for the 2026 to 2027 fiscal year on an assumption of 0.4 additional FTE. That is an office that will rely on consumer complaints and the cure notice process to prioritize, which means the operators who receive the first notices will be the ones whose applicants complained.

9. Why the federal retreat makes state law the operative rulebook

The federal government has withdrawn its written guidance on algorithmic housing decisions while leaving the Fair Housing Act itself untouched, which means the concrete, dated obligations a small landlord can actually be cited for now come from states like Colorado. HUD’s Office of Fair Housing and Equal Opportunity published a Federal Register notice on April 6, 2026 withdrawing eight guidance documents effective September 17, 2025, including the April 29, 2024 guidance on advertising housing “through Digital Platforms.” The notice explains that FHEO withdrew every guidance document that was not statutorily prescribed, consistent with the statute, or burden reducing, and states that the withdrawn documents “should not be relied upon as authoritative.”

The companion tenant screening guidance, announced by HUD on May 2, 2024 alongside the advertising document, is not named in the withdrawal notice, but as of this writing its PDF is gone from its original hud.gov address and the press release survives only on HUD’s archive site. Whatever its formal status, no small landlord should build a compliance program on it. The National Apartment Association, in its note on the withdrawals, made the point that matters: “state obligations may still apply.”

The statute did not move. The Fair Housing Act still prohibits discrimination in the rental of housing on the basis of race, color, national origin, religion, sex, disability, and familial status, and private plaintiffs still sue under it. The clearest recent example involved a screening algorithm rather than a landlord’s intent. In Louis v. SafeRent Solutions, No. 1:22-cv-10800 in the District of Massachusetts, two Black applicants holding housing vouchers alleged that SafeRent’s screening score disproportionately penalized Black and Hispanic renters. The court granted final approval of a $2.275 million settlement on November 20, 2024. According to the Civil Rights Litigation Clearinghouse’s summary of the court file, SafeRent agreed for at least five years to stop issuing accept or decline recommendations for voucher holders based on its scoring model unless civil rights experts have validated the model for fairness, and the property manager that used the score, Metropolitan Management Group, was a named defendant and party to the settlement. A discriminatory effect alone does not decide such a case; the analysis turns on causation, the provider’s business justification, and available less discriminatory alternatives. It does mean the landlord is in the caption alongside the vendor.

The prevalence numbers show how common the covered practice already is. TechEquity Collaborative’s April 2025 survey research, which expanded an earlier California study to Georgia and North Carolina, reports that 60 percent of surveyed landlords received AI enabled tenant screening reports, that only 3 percent of roughly 2,200 surveyed tenants across the three states could name the screening company that assessed them, and that landlords with one to four unit portfolios were, in the study’s phrasing, 5.5 percent more likely than larger landlords to accept a screening recommendation without additional review. Those are the study’s own figures and framing, not Colorado’s; the Attorney General’s notice does not cite them. They do describe exactly the behavior the proposed presumption of material influence would capture.

Colorado is not alone. Illinois has moved opposite to the federal government on disparate impact in lending, as we analyzed in our Illinois Civil Rights Safeguard Act article, and four states have restricted algorithmic rent pricing, covered in Four States Now Ban Algorithmic Rent Pricing. As federal guidance retreats, state statutes with specific dates and duties are filling the space.

10. A 100 day plan before January 1, 2027

A landlord with Colorado units can build a credible initial compliance baseline for January 1, 2027 in roughly 100 days by inventorying every automated step in the application workflow, extracting the developer documentation the statute now entitles you to, rewriting one notice and one disclosure, designating a reviewer, and starting a records file. It requires one person who owns the workflow and a calendar, not a compliance department. Vendor dependence, the final rules, and complex portfolios may add time, and the proposed rule details below should be treated as targets until the rules are adopted.

Days 1 to 20: inventory and classify

List every tool that touches an application, renewal, or deposit decision. For each, answer three questions: does it produce a score, rank, recommendation, or prediction about an individual; is that output seen by the person deciding; and does the decision usually match it. If all three answers are yes, it is presumptively covered under the proposed rules. Document the answers. That document is the beginning of your 6-1-1703 record.

Days 20 to 45: pull the developer package

Write to each covered vendor and request the 6-1-1702 documentation: intended and inappropriate uses, training data categories, known limitations and risks, human review instructions, and the tool name, version, developer identity, and named data sources you need for 6-1-1704. Ask how material update notices under 6-1-1702(2) will arrive. Document the request, the response, and any refusal or limitation; a vendor’s silence narrows what you must disclose but does not remove your other duties. A vendor that cannot answer by November is telling you something about January.

Days 45 to 70: rewrite two documents

First, the pre use notice: a short, clear paragraph at or before the application stating that an automated screening tool will be used and where to get more information. Second, the adverse outcome letter. Build one Colorado template that satisfies FCRA, 38-12-904, and 6-1-1704(3): the decision, the role the tool played, the principal reasons with specificity including any score and any automatic denial factor, the tool identification block or a link to it, and a paragraph explaining correction and human review rights with a link, a mailing address, and a phone number. Send it within 20 days to satisfy the shortest deadline. Use 12 point type on paper and two delivery channels where you have them, which are proposed rule standards worth adopting now.

Days 70 to 90: designate the reviewer and the intake

Name the person who will conduct meaningful human review. Under the proposed rules that person should not be the one who made the original decision, should not report to them where feasible, must be trained on the tool’s inputs and limits, and must have authority to override. For a small operation that may be the owner rather than the leasing agent. Set up one intake method, a web form is enough, for data, correction, and review requests, and put someone on a schedule to check it. Plan for acknowledgment within 10 days and a decision within 45, the proposed rule timelines, and adjust if the final rules differ.

Days 90 to 100: file a comment and open the records file

The comment period closes October 26, 2026, and the Attorney General’s questions about vendor responsibility and the independent reviewer are ones small operators are best placed to answer with specifics. Then open the records file: for every consequential decision on or after January 1, 2027, keep the tool version, the output, the notice, the disclosure, and any review, for three years. The NIST AI Risk Management Framework’s Govern and Manage functions and the ISO/IEC 42001 clauses on documented information map directly onto what the statute asks for, so an operator who builds this once will not rebuild it when the next state acts.

This article is provided for general informational purposes and reflects the state of the law as of September 2026. It is not legal advice. Regulations in this area are changing quickly, and the Colorado Attorney General’s rules described here are proposed and may change before adoption. Confirm current requirements and consult qualified counsel before making decisions for your organization.