Compliance

What Colorado's SB 26-189 Means for Residential Property Managers

Colorado repealed its original AI Act and replaced it with SB 26-189, effective January 1, 2027. Here's what the new disclosure and human-review rules mean for tenant screening and leasing decisions.

Published by InsidePartners · July 7, 2026

Colorado spent two years with the most aggressive AI law in the country on the books. In May 2026 it repealed that law and replaced it with something structurally different — and for residential property managers, the change is easy to misread. The instinct is to treat a shorter law as a lighter obligation. For tenant screening, that instinct is wrong.

1. What Changed

The original Colorado AI Act (SB24-205) was built around preventing algorithmic discrimination — impact assessments, a risk-management program, and a duty of reasonable care with an affirmative defense. Enforcement was stayed in federal court in April 2026, and the framework never took effect.

SB 26-189 repealed and replaced it. The new law (effective January 1, 2027) drops the discrimination-prevention machinery and installs a transparency regime built on disclosure and consumer rights. The attorney general is the sole enforcer; there is no private right of action. The practical shift: the question is no longer "can you prove your system doesn't produce a discriminatory result?" It's "did you tell the person, and can they get a human to review it?"

Key Facts

Signed: May 14, 2026
Effective: January 1, 2027
Replaces: SB24-205 (CAIA), which never took effect
Formal name: Automated Decision-Making Technology (ADMT) Act
Enforcer: Colorado AG only — no private right of action
Cure period: 60 days (before January 1, 2030)

2. Why Property Management Is in Scope

Two definitions do the work. Tenant-screening and application-scoring software is "automated decision-making technology" (ADMT) — any system that processes personal data using computation to make or substantially assist in a consequential decision. A decision to approve or deny a rental application is a "consequential decision" — housing is explicitly covered in the law's list.

A mid-size portfolio running automated screening is a deployer of covered ADMT in consequential decisions. This applies to scoring tools property managers have run for years — the same tools that felt routine before the law changed.

Covered ADMT Examples

Tenant screening and scoring platforms
Application-ranking or auto-filter tools
Background check software with automated recommendations
Credit-scoring integrations that influence decisions

Covered Decisions

Rental application approval or denial
Lease term or deposit decisions influenced by screening
Waitlist placement driven by automated scoring
Lease renewal decisions using automated risk assessment

3. The Three Duties That Matter

SB 26-189 creates three primary obligations for deployers of ADMT in consequential decisions. For property managers, these map directly onto the leasing workflow.

1. Pre-Use Notice

Disclose, before the fact, that an automated tool will factor into the leasing decision. This notice must cover the purpose of the ADMT, the nature of the consequential decision, and how the applicant can access and correct the personal data being used. It must be provided before screening runs, not buried in fine print after the decision is made.

2. Adverse-Decision Notice

Within 30 days of a denial or other adverse outcome where ADMT materially contributed, you must notify the applicant. The notice must state that an automated tool was used, that it materially influenced the decision, and how they can request human review. This is a hard deadline — not a best-effort target.

3. Meaningful Human Review

On request, provide a meaningful opportunity for human review of the consequential decision — to the extent commercially reasonable. The reviewer must have the authority to overturn the automated outcome. A leasing manager glancing at the same score the system already produced is not meaningful review. A person who can read the file, assess context, and change the outcome is.

Consumer Data Rights

Applicants have the right to access and correct the personal data used as input to the screening system. You must have an operable process for receiving and responding to these requests — not just a policy that says you will.

4. What This Actually Requires Operationally

None of these duties are satisfied by a policy document — they are satisfied by workflow. When an applicant asks why they were denied, you need to be able to say who (or what) scored them, on what data, and what notice they received. If that lives in a black-box vendor tool nobody has mapped, the exposure isn't primarily legal — it's operational.

The managers who handle this well will have three things wired into their leasing flow:

An inventory of every automated tool touching an approval or denial

Not a list of software subscriptions — a map of which tools produce outputs that factor into the leasing decision, with documentation of what data they process and what they recommend.

Notice language triggered at the right moments

Pre-use notice delivered at application submission. Adverse-decision notice triggered automatically — within 30 days — when a denial is recorded in which the screening tool materially contributed. Both need to be in your leasing management system, not in a separate policy binder.

A defined human-review path that a real person owns

A named role — leasing manager, regional supervisor, whoever — with documented authority to overturn a screening-based denial, and a process for logging the request, the review, and the outcome.

The 30-Day Clock Is the Hardest Part

The adverse-decision notice requirement has a hard 30-day deadline. That means the clock starts running the moment you record a denial — not when someone complains, not when the AG calls. For portfolios processing hundreds of applications per month, that deadline needs to be enforced by your systems, not by someone remembering to send an email.

5. The InsidePartners View

Deregulation isn't a green light — it's a liability shift. The paperwork got lighter; the accountability got heavier and more specific. SB24-205 asked you to build a risk-management program. SB 26-189 asks you to deliver a notice to a specific person within 30 days of a specific decision. The first obligation could be satisfied at the policy level. The second cannot.

That's a governance problem, and governance is workflow, not a binder. Mapping which automated tools touch consequential decisions, wiring in the notice and human-review steps, and assigning an owner is exactly the kind of operational work that decides whether a portfolio is calm or scrambling on January 1, 2027.

This is also not a one-time project. Vendor tools update their scoring algorithms. Portfolios add properties. New screening software gets onboarded. The ADMT inventory needs to be a living document, not a compliance checkbox.

Full SB 26-189 Compliance Guide

For a complete overview of SB 26-189 — what it replaced, how enforcement works, and what all the core obligations mean for deployers across industries — see our full compliance guide.

Read: Colorado AI Compliance Guide: SB 26-189 (ADMT Act) →

This is general information, not legal advice. Confirm your obligations with counsel.

Ready to Map Your Screening Workflow for SB 26-189?

Our Process Heatmap Audit identifies every automated tool touching your leasing decisions and designs the notice and human-review workflows SB 26-189 requires — before the January 1, 2027 deadline.

January 1, 2027 Is the Deadline

We'll map your leasing workflow for ADMT exposure, design the notice and human-review workflows SB 26-189 requires, and give you a sequenced implementation plan before the deadline.

ADMT inventory across your portfolio

Pre-use notice workflow design

Adverse-decision notice triggers

Human-review path and ownership

Consumer data access process

Prioritized implementation roadmap

Free consultation. We'll assess your ADMT exposure and compliance gaps.