ADMT disclosure and transparency obligations mapped to SWT3 AI witness procedures. Effective January 1, 2027.
Who this is for: Compliance officers, AI deployers operating in Colorado, legal counsel, and engineering teams building automated decision systems for lending, insurance, employment, or housing.
Legislative update: Colorado SB 26-189 (signed May 14, 2026) repeals and replaces the original AI Act (SB 24-205) entirely. The new law eliminates the broad duty of care and algorithmic discrimination impact assessment requirements from the original. What remains is a narrower disclosure-and-transparency framework focused on Automated Decision-Making Tools (ADMT). This guide maps the replacement law's requirements, which take effect January 1, 2027.
September 2026 Update
Companion legislation and AG rulemaking: Colorado also enacted HB 26-1263 (Chatbot Safety Act, signed May 29, 2026, effective January 1, 2027), the first US state law regulating AI chatbots to protect minors. It requires age estimation, self-harm response protocols, annual AG reporting, and prohibits chatbot outputs from simulating licensed professional services. On August 11, 2026, the Attorney General filed formal proposed rules implementing both SB 26-189 (ADMT) and HB 26-1263 (chatbot safety), with the comment period open through October 26, 2026. See California Adam's Law (SB 1119) for a related chatbot safety crosswalk.
October 2026 Update -- Proposed Rules
On October 6, 2026, the Colorado Attorney General released revised proposed rules implementing the ADMT Act and Chatbot Safety Act. Key changes include a definition of "de minimis factor," a rebuttable presumption for material influence, and clarified obligations for multiparty ADMT arrangements. The formal rulemaking hearing is October 26, 2026 at 10:00 AM. Written comments accepted through October 26. Final rules are expected to take effect January 2027.
Caveat: The section below is based on the proposed rules (October 6 draft). Final rules may differ after the rulemaking hearing. This guide will be updated when final rules are published.
Colorado SB 26-189 replaces the broader SB 24-205 with a focused notice-and-transparency framework for Automated Decision-Making Tools (ADMT). It applies to any deployer that uses AI to make or substantially influence a consequential decision affecting a Colorado consumer in areas including:
The law imposes four core obligations:
| Obligation | Requirement | Timeline |
|---|---|---|
| Pre-use notice | Clear, conspicuous notice before consumer interacts with ADMT | Before interaction |
| Post-adverse disclosure | Plain-language explanation of decision, ADMT's role, and consumer rights | Within 30 days of adverse outcome |
| Human review | Meaningful human review and reconsideration on request | Upon consumer request |
| Recordkeeping | Records sufficient to demonstrate compliance | 3-year retention |
Each SB 26-189 obligation maps to one or more SWT3 procedures. The SWT3 SDK generates cryptographic evidence anchors for each procedure, creating an immutable compliance record.
| SB 26-189 Obligation | SWT3 Procedure | What It Witnesses | Evidence Produced |
|---|---|---|---|
| Pre-use notice | AI-TRANS.1 | Transparency disclosure delivered to consumer | Anchor with disclosure type, recipient type, timestamp |
| Post-adverse disclosure | AI-AUTO.1 | Automated decision notification with legal effects | Anchor with decision type, human review status |
| Explanation of decision | AI-EXPL.1 | Feature attribution / explanation generated | Anchor with feature count, method used |
| Confidence communication | AI-EXPL.2 | Model confidence score for the decision | Anchor with confidence value, calibration status |
| Human review | AI-HITL.1 | Human review completed on consumer request | Anchor with review outcome, reviewer identity |
| Override tracking | AI-HITL.2 | Human override of AI decision recorded | Anchor with override reason, original vs. final decision |
| Data correction | AI-DATA.4 | PII lifecycle event (correction, deletion) | Anchor with records affected, event type |
| Consent / legal basis | AI-CONSENT.1 | Consumer consent or legal basis verified | Anchor with consent type, withdrawal status |
| Recordkeeping (3 years) | AI-AUDIT.1 | Audit log integrity verified | Anchor with entry count, tamper detection result |
| Bias prevention | AI-FAIR.1 | Bias disparity ratio measured | Anchor with group count, max disparity |
| Bias audit | AI-FAIR.3 | Bias audit conducted across demographics | Anchor with groups tested, disparities found |
| Model documentation | AI-INF.1 | Inference provenance (model, prompt, response hashed) | Anchor with model hash, prompt hash, response hash |
| Model integrity | AI-MDL.1 | Deployed model hash matches approved registry | Anchor with weight hash, version identifier |
SB 26-189 requires: Clear and conspicuous notice to consumers before they use or interact with a covered ADMT.
How SWT3 addresses it: witnessTransparency() mints an anchor recording the disclosure type (AI usage notification), recipient type (end user / data subject), and timestamp. The anchor proves the notice was generated and delivered before the consequential decision.
Query the witness ledger for AI-TRANS.1 anchors filtered by consumer ID. Each anchor's timestamp proves pre-interaction notice. The clearing level ensures raw content is stripped while the compliance hash is retained.
SB 26-189 requires: Within 30 days of an adverse outcome, deployers must deliver a plain-language disclosure explaining the decision and the ADMT's role.
How SWT3 addresses it: witnessAutomatedDecision() mints an anchor with the decision type (credit, employment, insurance, housing), human review status, and notification timestamp. Combined with AI-EXPL.1, this creates a complete adverse action evidence chain.
Filter ledger for AI-AUTO.1 anchors where decision_type matches regulated categories. Cross-reference with AI-EXPL.1 anchors to verify explanation was generated. Timestamp delta proves 30-day disclosure window compliance.
SB 26-189 requires: Meaningful human review and reconsideration upon consumer request, to the extent commercially reasonable.
How SWT3 addresses it: witnessHumanReview() records the review completion with reviewer identity. If the human overrides the AI decision, witnessHumanOverride() captures the original decision, override reason, and final outcome. Together they prove the review was substantive, not rubber-stamped.
AI-HITL.1 anchors prove review occurred. AI-HITL.2 anchors (if present) prove override capability exists and is exercised. Absence of any AI-HITL.2 anchors across thousands of decisions may indicate inadequate human oversight.
SB 26-189 requires: Records sufficient to demonstrate compliance retained for at least three years from the date of the consequential decision.
How SWT3 addresses it: Every SWT3 Witness Anchor is written to the sovereign witness ledger with cryptographic fingerprints. witnessAuditIntegrity() periodically verifies the log has not been tampered with. The ledger itself serves as the 3-year compliance record, with each anchor independently verifiable.
Export the witness ledger for the relevant time period. Each anchor contains a SHA-256 fingerprint that can be independently recomputed. Daily Merkle rollups provide tamper-evident batch verification.
The revised proposed rules (October 6 draft) introduce three concepts that affect how deployers document ADMT use. Each maps to SWT3 procedures that produce the required evidence.
What the proposed rules say: The rules define when an ADMT output is a "de minimis factor" in a consequential decision -- meaning the output did not materially influence the outcome. If the deployer can demonstrate de minimis use, certain disclosure obligations are reduced.
Evidence needed: The deployer must document why the ADMT output was de minimis. AI-INF.1 anchors record the model's contribution to each decision, including the factors that influenced the output. Low contribution scores, or evidence that the human decision-maker did not rely on the ADMT output, support a de minimis claim.
The proposed rules require deployers to document why ADMT use was de minimis. AI-INF.1 anchors recording the model's contribution to the decision are the primary evidence. Cross-reference with AI-HITL.1 to verify the human made the decision independently. If the human decision consistently matches the ADMT recommendation, the de minimis claim is weak regardless of documentation.
What the proposed rules say: If an ADMT is used and an adverse outcome results, the rules create a rebuttable presumption that the ADMT output materially influenced the decision. The burden shifts to the deployer to prove otherwise.
Evidence needed: To rebut the presumption, the deployer needs evidence of genuine human decision-making that was independent of the ADMT output. AI-HITL.1 and AI-HITL.2 anchors showing substantive human review -- not rubber-stamp approval -- are the primary evidence. AI-EXPL.1 anchors showing the explanation provided to the human reviewer add supporting context.
To rebut the presumption of material influence, the deployer needs AI-HITL.1 + AI-HITL.2 anchors showing substantive human review. Look for review duration (not instant), decision rationale recorded, and cases where the human overrode the ADMT recommendation (AI-HITL.2). If the human never overrides, the presumption is very difficult to rebut -- the pattern suggests the ADMT was the decision-maker in practice.
What the proposed rules say: The rules clarify obligations when multiple parties are involved in an ADMT-assisted decision -- for example, a lender using a third-party credit scoring model, or an insurer using an external risk assessment vendor. Each party has disclosure and recordkeeping obligations.
Evidence needed: AI-CHAIN.1 anchors trace the handoff between parties in a shared decision pipeline. AI-DEL.1 delegation anchors record which party was responsible for which portion of the decision. When liability is disputed, the chain and delegation trail shows exactly who contributed what.
For shared decision pipelines, AI-CHAIN.1 anchors trace the handoff between parties. AI-DEL.1 delegation anchors record responsibility assignments. When a consumer disputes an adverse decision and multiple parties are involved, the examiner needs to determine which party's ADMT contributed to the outcome. Chain and delegation anchors are the primary evidence for liability allocation.
Three SWT3 industry profiles include all procedures needed for SB 26-189 compliance:
| Profile | Industry | SB 26-189 Coverage | Command |
|---|---|---|---|
fintech-model-risk | Lending, credit, AML | 16 procedures, full coverage | swt3 init --profile fintech-model-risk |
insurance-underwriting | Underwriting, claims, pricing | 14 procedures, full coverage | swt3 init --profile insurance-underwriting |
healthcare-clinical | Clinical decisions, diagnostics | 15 procedures, full coverage | swt3 init --profile healthcare-clinical |
| Examiner Question | Where to Look |
|---|---|
| How do you notify consumers before ADMT interaction? | AI-TRANS.1 anchors in the witness ledger, filtered by consumer session. Timestamp proves pre-interaction delivery. |
| How do you explain adverse decisions within 30 days? | AI-AUTO.1 + AI-EXPL.1 anchor pairs. Decision timestamp vs. disclosure timestamp proves 30-day window. |
| Can consumers request human review? | AI-HITL.1 anchors with reviewer identity. AI-HITL.2 anchors prove override capability exists. |
| How long do you retain compliance records? | Witness ledger retention policy (configurable). AI-AUDIT.1 anchors verify log integrity. SWT3 anchors are independently verifiable at any point. |
| How do you prevent algorithmic discrimination? | AI-FAIR.1 (disparity measurement) and AI-FAIR.3 (bias audit) anchors with group counts and disparity ratios. |
| Can consumers correct inaccurate data? | AI-DATA.4 anchors record PII lifecycle events including corrections. AI-CONSENT.1 tracks consent and withdrawal. |
Full SDK documentation: sovereign.tenova.io/docs
Create a free account: sovereign.tenova.io/signup