Does the Colorado law apply to a small startup?

It can. The law follows the decision, not the size of the company: it applies to a person doing business in Colorado that uses the technology for a consequential decision. I haven't found a small-business exemption in the summaries I read. I recommend confirming that with counsel against the final text and the attorney general's rules.

What about other states?

Other states have their own laws, and they ask for different things. Texas has an AI law in force since 1 January 2026, and California has a transparency law for developers of frontier models. I'm starting to see the same building blocks in each: notice, documentation, records, and a human who can review. A team that builds those once can adapt them state by state.

Where would you start?

With an inventory. I list every place the product makes or shapes a decision about a person, and which states those people are in. The decision log comes next, because every other duty reads from it. Which decision in your product would be the hardest to explain to the person it affects?

All guides

Guide

US state AI laws for startups that ship AI features

What Colorado's SB 26-189 and other state AI laws ask of a team that builds or deploys automated decisions, read as engineering work.

The United States has no single AI law for private companies, so the states write their own. Colorado's is the one I get asked about. Governor Polis signed SB 26-189 on 14 May 2026, and it replaced the state's earlier AI Act before that law took effect. The new law applies to consequential decisions made on or after 1 January 2027.

I'm starting to see teams treat state AI law as a legal memo and nothing else. The Colorado law reads more like a product spec. It asks for a notice, an explanation, a way to correct data, a human who can review a decision, and records. Each of those is something a team builds, so this guide reads the law as engineering work.

This is an engineer's reading of the rules. I wrote it to help teams decide whether the rules touch their platform. It isn't legal advice. I recommend checking the current text with your own counsel before planning around a date or a threshold.

Does it apply to you?

If one of these lines describes your company, the rest of this guide applies. If none does, the rule probably sits outside your company. A thirty-minute call confirms that faster than the text can.

We use automated decision-making technology to make or shape decisions about people in Colorado: hiring, lending, insurance, housing, education, health care, or public benefits.
We build a model or a scoring product that our customers use for those decisions. The law calls us a developer and our customers deployers.
We sell to an employer, a lender, or an insurer that has started asking how our system reaches its results.
Our product recommends, ranks, or scores people, and a person at the customer usually accepts the result without changing it.
We operate in several states and want one design that holds up as more of them legislate.

What it asks of your platform

What a deployer builds

A deployer tells a person that automated decision-making technology is in use before the decision. After an adverse outcome, it explains in plain language what the technology did, within 30 days. The person can ask to correct inaccurate data and can ask for meaningful human review. In a product, that's a notice at the point of interaction, a stored reason for each decision, a correction flow, and a review queue with a human who can change the result.

What a developer hands over

A developer gives each deployer documentation. It covers the intended uses of the system, its known risks and limits, the categories of data used to train it, and instructions for appropriate use and human oversight. The developer also tells deployers about material updates. I treat this as a release artifact, written when the model ships and versioned with it.

Records for three years

The law asks developers and deployers to keep compliance records for at least three years. For a deployer, that means the decision, the inputs behind it, the notice, and any review can be found again. A decision log with one row per decision does this work. It links the model version, the input, the output, and the person who reviewed it.

Enforcement, and the rules still being written

The Colorado attorney general enforces the law under the Consumer Protection Act. Where a violation can be cured, the law gives 60 days to cure it, and that window ends on 1 January 2030. The attorney general also has to adopt rules by 1 January 2027 that set out what the disclosures contain. Those rules were proposed and not yet adopted when I checked on 14 November 2026.

How I help

The engineering behind the guide. Each one starts with a map of the platform as it runs today.

Book a call

Where to start

AI Implementation Sprint

We pick the one AI workflow, assistant, retrieval system, or automation that matters most. Then I ship it to production with business value we can measure.

$12,000 to $24,000

See what's included

Cloud security hardening

I find the gaps in your cloud accounts, identity, network, and data, rank them by what an attacker reaches first, and close them with your team.

AI integration

I do AI consulting and AI engineering for US teams. I put language models to work on the problems that matter, and I ship them to production.

SOC 2 and security questionnaires

What a SOC 2 report and an enterprise security questionnaire ask of a startup's cloud platform, and what to build before the first big deal.

FTC Safeguards Rule

What the FTC Safeguards Rule (16 CFR Part 314) asks of a non-bank fintech's cloud platform: a written program, encryption, MFA, testing, and vendor oversight.

New York rules

What New York's DFS cybersecurity regulation (23 NYCRR Part 500) and the SHIELD Act ask of a startup's cloud platform, and how they reach vendors.

AI-assisted development

My AI engineering workflow for a team: how I set up Claude Code, Codex, and similar agents with instruction files, retrieval, shared memory, and code review.

Securing AI-generated apps

What changes when an agent writes the code: the new attack paths, the controls that close them on AWS, Azure, and Google Cloud, and the evidence buyers ask for.

GitHub best practices (free)

A free guide to GitOps guardrails on GitHub: rulesets, independent reviewers, required pull requests and checks, Conventional Commits, and branch names.

Does the Colorado law apply to a small startup?: It can. The law follows the decision, not the size of the company: it applies to a person doing business in Colorado that uses the technology for a consequential decision. I haven't found a small-business exemption in the summaries I read. I recommend confirming that with counsel against the final text and the attorney general's rules.
What about other states?: Other states have their own laws, and they ask for different things. Texas has an AI law in force since 1 January 2026, and California has a transparency law for developers of frontier models. I'm starting to see the same building blocks in each: notice, documentation, records, and a human who can review. A team that builds those once can adapt them state by state.
Where would you start?: With an inventory. I list every place the product makes or shapes a decision about a person, and which states those people are in. The decision log comes next, because every other duty reads from it. Which decision in your product would be the hardest to explain to the person it affects?

Let's talk.

A 30-minute call, no pitch. We look at your current setup, your stage, and the thing that's bothering you about it. I give a straight opinion on what to change, what to leave alone, and whether the problem is the one it looks like. What's the one thing in your stack you'd fix tomorrow?

Book a call See pricing

Prefer email or phone? hello@netninjas.us or +1 (347) 486-4242