Framework · Colorado SB 26-189
Colorado SB 26-189 readiness for the AI in consequential decisions.
Signed in May 2026, SB 26-189 replaced Colorado's earlier AI Act and takes effect on 1 January 2027 as a transparency and disclosure regime for automated decision-making technology in consequential decisions, including employment. Meilynx covers it as readiness, with an inventory derived from live traffic and the procedures drafted ahead of the effective date, and no obligation is claimed as in force before 2027.
Inventory, disclose, correct, review, record.
From 1 January 2027, SB 26-189 asks a deployer of automated decision-making technology in a consequential decision for four things. Until then, the obligations are readiness only.
- An inventory of the automated decision-making technology in use.
- Disclosure to the individuals affected by a consequential decision.
- An opportunity to correct information and request human review of the decision.
- Record-keeping for the technology and the decisions it supports.
Readiness duties, to runtime evidence.
A specific Meilynx control for each obligation the proxy can substantiate ahead of the effective date, and the artifact it produces. The disclosure, the review procedure, and the scoping determination stay attested in your program.
Colorado SB 26-189 → Meilynx controls (AI-traffic slice, readiness)
| Requirement | How Meilynx maps | Examination artifact |
|---|---|---|
Inventory the automated decision-making technology used in consequential employment decisions CO SB 26-189 · readiness (effective 1 January 2027) | The inventory of AI models and providers behind employment decisions is derived from live traffic and enforced by runtime model allow-listing. Colorado's readiness obligations start here. | Automated decision-making technology inventory, generated from traffic |
Keep a record of when the technology ran, on what data, and what it produced CO SB 26-189 · readiness (effective 1 January 2027) | Each AI request, response, and governance decision is captured inline at the proxy and sealed into a tamper-evident, hash-chained record, so the record exists on the day the statute takes effect. | Hash-chained decision audit trail for the period |
Draft the disclosure to individuals affected by a consequential decision CO SB 26-189 · readiness (effective 1 January 2027) | The disclosure is an employer act. Personal-data detection over the traffic evidences which candidate and employee data actually reached each system, the fact base for drafting it, and the text itself is attested. | Personal-data findings by tool and vendor; disclosure procedure, attested |
Offer correction of information and human review of consequential decisions CO SB 26-189 · readiness (effective 1 January 2027) | The review is a human act, and Meilynx never performs it. The package carries the correction and human-review procedure and, once the statute is in force, its operating records as attested evidence. | Review procedure and its operating records, attested |
Detect unapproved changes to the technology as deployed CO SB 26-189 · readiness (effective 1 January 2027) | Prompt-drift and tool-grant-drift detection flag unapproved changes to configuration against approved baselines, so the inventory and the disclosure describe the technology as it actually runs. | Drift findings against approved baselines |
Inventory the automated decision-making technology used in consequential employment decisions
CO SB 26-189 · readiness (effective 1 January 2027)
Maps to · The inventory of AI models and providers behind employment decisions is derived from live traffic and enforced by runtime model allow-listing. Colorado's readiness obligations start here.
Examination artifact · Automated decision-making technology inventory, generated from traffic
Keep a record of when the technology ran, on what data, and what it produced
CO SB 26-189 · readiness (effective 1 January 2027)
Maps to · Each AI request, response, and governance decision is captured inline at the proxy and sealed into a tamper-evident, hash-chained record, so the record exists on the day the statute takes effect.
Examination artifact · Hash-chained decision audit trail for the period
Draft the disclosure to individuals affected by a consequential decision
CO SB 26-189 · readiness (effective 1 January 2027)
Maps to · The disclosure is an employer act. Personal-data detection over the traffic evidences which candidate and employee data actually reached each system, the fact base for drafting it, and the text itself is attested.
Examination artifact · Personal-data findings by tool and vendor; disclosure procedure, attested
Offer correction of information and human review of consequential decisions
CO SB 26-189 · readiness (effective 1 January 2027)
Maps to · The review is a human act, and Meilynx never performs it. The package carries the correction and human-review procedure and, once the statute is in force, its operating records as attested evidence.
Examination artifact · Review procedure and its operating records, attested
Detect unapproved changes to the technology as deployed
CO SB 26-189 · readiness (effective 1 January 2027)
Maps to · Prompt-drift and tool-grant-drift detection flag unapproved changes to configuration against approved baselines, so the inventory and the disclosure describe the technology as it actually runs.
Examination artifact · Drift findings against approved baselines
What you have ready on 1 January 2027.
The audit trail renders into an evidence package scoped to the AI-traffic slice. Each control is classified as proxy-verified runtime evidence or attested in your program, and the timeline marks Colorado as readiness until the effective date.
In the package
- Automated decision-making technology inventory, auto-populated from traffic.
- Notice, disclosure, correction, and human-review procedures (attested).
- Personal-data findings per tool and vendor.
- Tamper-evident decision audit trail across the reporting period.
- Obligation timeline: Colorado readiness until 1 January 2027, Illinois and NYC in force, EU AI Act pointer.
Colorado SB 26-189 and the proxy.
What changed with SB 26-189?
Signed on 14 May 2026 and effective 1 January 2027, SB 26-189 replaced Colorado's 2024 AI Act with a transparency and disclosure regime for automated decision-making technology used in consequential decisions, including employment. It requires an inventory of the technology in use, disclosure to affected individuals, an opportunity to correct information and request human review, and record-keeping.
Can we claim Colorado coverage today?
Nothing in SB 26-189 applies before 1 January 2027, and claiming to meet it today invites the question of what the claim rests on. The preset covers Colorado as readiness: an inventory of the technology in use and the notice, disclosure, correction, and human-review procedures drafted ahead of the effective date. No Colorado obligation is claimed as in force before 2027.
Does the preset satisfy SB 26-189 on its own?
No runtime product could, and before 2027 there is nothing yet to satisfy. The disclosure, the correction and human-review procedure, and the scoping call on which systems are automated decision-making technology all happen outside the proxy. What the proxy substantiates from live traffic carries proxy-verified evidence, and everything else is marked as attested. Illinois HB 3773 and NYC Local Law 144, both in force, sit under the same preset.
Build the evidence.
See exactly what an examiner receives
Download a sample examination package: model inventory, control coverage, a governance policy snapshot, and a SHA-256 integrity hash.