Colorado SB 26-189 (effective 2027) requires that any business using automated decision-making technology (ADMT) in a "consequential decision" — which includes decisions about which consumers to contact, at what frequency, or with what intensity — must provide consumers with notice that AI is being used, an explanation of any adverse outcome, access to the data used, and the ability to request meaningful human review. For collections agencies using AI for outreach prioritization, scoring, or hiring, this creates disclosure and workflow obligations that cannot be satisfied by a policy document alone.
For collections teams, the practical challenge is not understanding that disclosure exists in principle. It is operationalizing who gets notice, what the notice says, when it appears, how adverse treatment is explained, where the supporting data is pulled from, and who handles the review request when a consumer asks for a person to take another look. None of that is handled by a static compliance PDF.
That is why ADMT compliance work should start from workflow mapping rather than legal summary alone. The business has to identify the covered decisions, decide where disclosure is attached, define the content of explanations, build the process for data access requests, and create a real human review path. If any one of those pieces is left abstract, the law may be understood but not implemented.
On this page
- What SB 26-189 covers
- What consequential decision means for collections AI
- The 4 consumer rights created by the law
- Notice: what the disclosure must say
- Adverse action explanation and data access
- Meaningful human review
- How to operationalize compliance
- What happens if you don't comply
- SB 26-189 vs. existing collections obligations
- FAQ
What SB 26-189 covers
SB 26-189 addresses the use of automated decision-making technology in decisions that have meaningful effects on people. Collections agencies should care because the law is not limited to flashy generative AI products. It is about systems that make or materially influence decisions. A ranking model, prioritization engine, treatment recommender, suppression model, or score that drives who gets contacted and how can all matter if the effect on the consumer is meaningful.
That means agencies should inventory more than just the voice bot. The outreach prioritizer, the confidence score that decides whether a human will review the account, the treatment tree that changes pressure or cadence, and even hiring systems for collection roles may all sit inside the same compliance conversation. The law cares about function, not whether the system is marketed as AI in big letters.
What “consequential decision” means for collections AI
The hardest part for operations teams is usually the phrase “consequential decision.” In plain language, it refers to decisions that can materially affect a person's treatment or opportunities. In collections, the exact boundaries should be reviewed with counsel, but the operational takeaway is clear: if AI influences which consumers are contacted, in what order, how often, through what path, or whether a human gets involved, the team should assume the decision could be relevant under the law until proven otherwise.
That does not mean every tiny automation step is equally exposed. It means you need a decision map. Separate pure administrative automation from choices that affect a consumer's experience or options. A model that sorts accounts into higher- or lower-intensity treatment is more likely to matter than a system that merely summarizes a prior call note for an internal reviewer. The map does not need to be philosophical. It needs to be usable by operations and compliance.
The 4 consumer rights created by the law
For collections teams, SB 26-189 can be translated into four practical consumer-facing rights. Consumers must receive notice that AI is being used in a covered decision. They must be able to receive an explanation of an adverse outcome. They must be able to access relevant data used in the decision. And they must be able to request meaningful human review. Each right has a workflow implication.
| Right | Operational requirement | Team owner |
|---|---|---|
| Notice | Place disclosure at the right stage and channel | Compliance + product |
| Explanation | Summarize why the adverse outcome occurred in understandable terms | Compliance + operations |
| Data access | Retrieve and deliver the relevant data used in the decision | Data + legal operations |
| Human review | Route the case to a person who can reassess and change the outcome | Operations + compliance |
These rights are linked. A weak notice makes later requests more confusing. A weak explanation makes human review harder because the reviewer has to reconstruct the decision from scratch. Weak data access turns an explanation into a generic narrative instead of a defensible response. That is why the implementation effort should be treated as one operating program rather than four unrelated tasks.
Get the ADMT compliance checklist for collections AI.
Notice: what the disclosure must say
Notice should be plain, timely, and tied to the covered decision context. In collections AI, that often means the consumer should understand that automated technology is being used to influence outreach, treatment, or another meaningful action. Teams should avoid dense legal drafting that technically contains the right words but leaves the consumer unsure what actually happened. If a notice cannot be explained by a frontline manager in one sentence, it is probably too abstract.
The notice workflow also needs placement rules. Is it delivered at first contact? On a portal? In follow-up communication? In a privacy notice? The answer may vary by use case, but the business should decide deliberately instead of assuming a general privacy policy will cover specific AI-driven treatment decisions.
Adverse action explanation: what data must be provided
An explanation is not the same as a disclosure. Disclosure tells the consumer AI was used. Explanation tells the consumer what role it played in the outcome and, where relevant, what factors or data drove that result. For collections agencies, this could mean explaining that outreach priority, treatment path, or review routing was influenced by certain account data or model-driven scoring. The explanation should be specific enough to be meaningful but disciplined enough to avoid overclaiming how the model “thought.”
Data access is the harder companion task. To explain a decision well, you need to know which fields, events, or scores were materially involved and be able to retrieve them. That requires audit-ready logging. Without it, agencies end up offering vague descriptions that satisfy no one because they cannot point to the actual inputs used at the time of decision.
Meaningful human review: what the law actually requires
Meaningful human review is not a help-desk form that disappears into a generic queue. The reviewer needs enough information to understand the AI-influenced decision, authority to change the outcome, and a process that occurs within a reasonable time. In collections, that means the reviewer can see the relevant account state, the AI-influenced recommendation or prioritization, the reasons behind it, and the available alternatives.
It also means the review should be more than a rubber stamp. If the reviewer is expected to click approve on every case because the system is presumed correct, the review is thin. Good design gives the reviewer a decision frame and room to override, suppress, or reroute when appropriate.
How to operationalize: notice, audit logs, review routing
Start with a decision inventory. List every AI-influenced collections workflow that could affect consumer treatment. For each one, identify the decision point, the consumer touchpoint, the underlying data, the audit fields, the notice mechanism, and the review owner. Then build the logs and queues before writing polished consumer copy. Without the system plumbing, legal language will float unsupported above the actual process.
Next, establish a standard explanation packet. This can include the decision date, system name, material input categories, resulting treatment path, and how to request review. The exact packet can vary by use case, but consistency makes staff training and audit much easier. Finally, run tabletop exercises: can the team actually retrieve the data, explain the result, and route the review within a sensible window? If not, the policy is ahead of the operation.
What happens if you don't comply
Noncompliance risk is not only about formal penalties. It also creates complaint handling burden, weakens client confidence, and exposes gaps in your broader AI governance program. The 60-day cure window for some first-time violations is helpful, but it should not be treated as a product plan. A cure window is not a substitute for implementation. It is a limited chance to fix a problem after it is already visible.
Collections agencies should also expect questions from clients and procurement teams well before the law's effective date. Buyers do not want to discover in diligence that the agency has not mapped notice, data access, and review rights for its AI workflows. Getting ahead of the process can therefore help on both compliance and commercial grounds.
Comparison: SB 26-189 vs. existing collections compliance obligations
| Topic | Traditional collections rules | SB 26-189 focus |
|---|---|---|
| Communication content | What can and cannot be said | Whether AI use is disclosed in covered decisions |
| Consumer treatment | Frequency, channel, and conduct rules | How AI influences prioritization and outcomes |
| Audit trail | Call notes, account logs, complaint records | Decision logging, explanation support, data retrieval |
| Human involvement | Supervisor oversight as needed | Consumer right to meaningful human review |
The laws do not replace each other. They stack. A collections AI workflow can satisfy traditional communication rules and still fail ADMT disclosure or review duties if it cannot explain or revisit AI-influenced treatment. That is why agencies should treat SB 26-189 as an additional operating layer, not as a new label for the controls they already have.
FAQ
What is Colorado SB 26-189?
It is a Colorado law that sets obligations for organizations using automated decision-making technology in consequential decisions, including notice, explanation, access to relevant data, and meaningful human review.
Does Colorado's AI law apply to collections agencies?
It can when the agency uses AI to make or materially influence consequential consumer treatment decisions, such as outreach prioritization, contact intensity, or review routing.
What is a “consequential decision” under SB 26-189?
In plain terms, it is a decision with meaningful effects on a person. For collections teams, decisions about who is contacted, how often, how urgently, or under what treatment path can fall into that discussion.
What is the deadline to comply with Colorado's ADMT law?
The law takes effect in 2027. Teams should use the time before then to identify covered decisions and build the workflows needed for notice, explanation, data access, and human review.
What does “meaningful human review” require under SB 26-189?
It requires a real reviewer with context, authority, and time to reassess the AI-influenced outcome and change it if needed. Passive oversight or after-the-fact auditing is not the same thing.
Map your ADMT obligations before 2027 forces the issue
We can help translate notice, explanation, data access, and human review into actual collections workflow and audit design.