Picture a rental applicant in Denver who is denied an apartment in January. Before, a standard adverse action letter might have closed the file. Starting January 1, 2027, the applicant may also be owed an explanation of how an automated tool shaped the decision. They may also get the right to have a person take a second look.

That is the practical effect of Colorado SB 26-189, signed May 14, 2026. It replaces the state’s earlier AI Act before that law ever took effect. The new version is narrower and focused on transparency. Rental housing is squarely in scope.

Leasing decisions are covered

The law applies to “automated decision-making technology” used to materially influence consequential decisions. “The lease or purchase of residential real estate in Colorado” is one of the covered areas.

If a tool scores, ranks, or recommends an outcome, and that output plays more than a trivial role, it likely qualifies. Tenant screening is the obvious example.

Many everyday AI uses fall outside the law. Exclusions include:

• Scheduling, customer service triage, and workflow tools
• Marketing and search
• Fraud prevention and identity verification

Three new resident-facing obligations

Tell applicants up front. Before the decision, operators must give a clear and conspicuous notice that an automated tool is being used. A prominent link at the point of application can satisfy this.

Explain adverse outcomes within 30 days. After a denial or materially worse terms, the applicant must get a plain-language explanation of the tool’s role. They must also get a way to request details about the tool and the data it used. The law’s duplicate-notice safe harbor is written for lenders. Don’t assume your current FCRA letter covers everything.

Offer correction and human review. On request, applicants can correct inaccurate personal data. Operators must also offer meaningful human review “to the extent commercially reasonable.” “Meaningful” means a trained reviewer with authority to override the result, who doesn’t simply defer to the score.

Behind the scenes: records and vendors

Operators must keep compliance records for at least three years after each decision. Technology vendors must give operators documentation on intended uses, limitations, and human review. They must also give operators what they need to prepare their notices.

The law also leaves discrimination exposure in place. Both vendors and operators can be liable under Colorado’s anti-discrimination law. Contract clauses that shift a party’s own liability are void.

What’s at stake

The Colorado Attorney General enforces the law, and violations are treated as deceptive trade practices. Penalties under Colorado’s consumer protection law can reach $20,000 per violation, counted per consumer or transaction.

There is a 60-day cure period for fixable violations, though not for knowing or repeated ones. The Attorney General declined to add a formal grace period. Final implementing rules are due by January 1, 2027, so details on notice content may still shift.

Your next steps

With roughly nine weeks until the effective date, it’s a good time to start taking inventory:

• Evaluate your automated tools. List anything that uses automated technology to make or influence housing decisions for Colorado applicants and residents.
• Update your application flow. Add a clear pre-use notice.
• Build your adverse outcome notice. Set up a 30-day tracking process.
• Define human review. Decide who reviews, how they’re trained, and what authority they have.
• Set retention rules. Keep records for three years.
• Watch for the Attorney General’s final rules. Adjust when they’re published.

Entrata is preparing for SB 26-189 alongside our customers. Resident Verify will support applicant disclosures, notice in the case of an adverse action, and the opportunity for human review.  Our goal is to help Colorado operators meet these requirements without slowing down leasing.

*This post is for general information and is not legal advice. Consult your counsel about your specific obligations.*