The law starts January 1, 2027.
Are you ready?
Colorado replaced its original AI Act (SB 24-205) with SB 26-189 in May 2026. Its duties begin January 1, 2027. If your nonprofit uses AI that materially influences decisions about people, it will apply to you.
This is a plain-language guide, not legal advice. We wrote it for Executive Directors, not lawyers. It explains what the law asks of you, and it tells you honestly where Candela helps and where the work stays on your desk.
Four duties, in language you can act on
Notice
Tell people clearly, before you use it, when an automated tool will materially influence a consequential decision about them. In a nonprofit that often means AI used in hiring, in case management, or in deciding who gets into a program.
Records
Keep records that show how you comply, for three years. If someone asks whether AI touched a decision, you should be able to point to what was used, by whom, and when. A durable log is the difference between a claim and proof.
Adverse-decision rights
If AI materially influenced a decision that goes against someone, explain its role in plain language within 30 days, let them correct their data, and offer human review on request.
Accessible notices
Notices and explanations have to reach the people they are for, including people with disabilities and people with limited English.
A few terms of art, defined once. A consequential decision is one that materially affects access to things like employment, housing, education, health care, or benefits. A deployer is the organization using the tool. An automated decision-making technology is a tool that materially influences that decision. Tools that only summarize, draft, or route information for a person to decide are excluded. Deciding which of your tools fits that last definition is a legal call, and it belongs to you and your counsel.
What the law asks. What we cover. What stays with you.
Some of these Candela handles. Some it does not, and pretending otherwise would not help you. Both kinds of row are here, side by side.
Give notice before AI influences a consequential decision
Tell people clearly, before use, that an automated tool will materially influence a decision about them, and how to learn more.
Candela covers thisCandela records a disclosure footer on AI-assisted outputs and tracks disclosed vs undisclosed AI use in the governance disclosure log.
Keep a record of your AI use
Maintain a durable log of when AI was used, by whom, and on what, so you can show compliance if asked, and keep it for at least three years.
Candela covers thisThe §4.8 universal audit trail records who changed what and when across the platform; the governance activity log surfaces AI calls.
Track compliance deadlines you already carry
Stay ahead of contract, grant report, and federal compliance dates so nothing lapses while you sort out AI governance.
Candela covers thisThe free Compliance Inbox pulls contract, grant report, and federal compliance deadlines into one sorted view.
Set and hold your own risk thresholds
Decide in advance what counts as too concentrated or too stale, and have the system flag it, rather than eyeballing it.
Candela covers thisOrg governance settings let admins set funder over-concentration thresholds and how often dismissed gaps resurface.
Notify a person when an AI-influenced decision goes against them
Within 30 days of an adverse decision, explain the tool's role in plain language, let the person correct their data, and offer meaningful human review on request.
You handle thisCandela does not run consumer-facing adverse-decision notices. You still need a process to explain, correct, and appeal, usually in your existing case or HR system.
Decide whether a given tool is covered
Make the legal call about whether a specific AI tool materially influences a consequential decision and triggers the deployer obligations.
You handle thisThis is a legal judgment. Candela gives you the usage records to inform it, but the determination stays with you and a qualified attorney.
Cover vendor and developer side obligations for outside tools
If you build or resell an AI hiring tool, meet the separate developer duties the law places on that role.
You handle thisCandela addresses your deployer duties for AI use inside the platform. Developer-side duties for third-party tools you build or resell are outside its scope.
The Compliance Inbox is the free Starter tier
Create an account and start tracking your contract, grant report, and federal compliance deadlines in one place. See how Candela documents AI use before you decide whether a paid tier earns its keep. No credit card, no sales call required.
Create your free account →Plain answers
When does Colorado's AI law apply?
January 1, 2027. The original act, SB 24-205, never took effect: a federal court paused it and lawmakers replaced it with Senate Bill 26-189, signed May 14, 2026. The new duties apply to decisions made on or after January 1, 2027.
Does the law apply to a nonprofit like ours?
It can. The act covers deployers, meaning any organization that uses automated decision-making technology that materially influences a consequential decision about a Colorado resident. A consequential decision is one that affects access to things like employment, housing, education, health care, or essential services. If you use AI to screen job applicants, prioritize a waitlist, or route people to services, read this page carefully. If you only use AI to draft a newsletter, the law is unlikely to apply, though the honesty of good disclosure still helps you.
What is a consequential decision?
A consequential decision is one that has a material legal or similarly significant effect on a person. In a nonprofit that usually means hiring and staffing decisions, decisions about who gets into a program or service, and decisions that affect someone's benefits or eligibility. Deciding what color to make a flyer is not consequential. Deciding who moves up a housing waitlist is.
What does Candela actually do for compliance?
Candela gives you a running record of your AI use and your deadlines. The free Compliance Inbox tracks contract, grant report, and federal compliance deadlines in one place. On paid tiers, the governance dashboard adds a disclosure tracker and a review log, an audit trail records who changed what and when, and org governance settings let you set thresholds like funder over-concentration and how often dismissed gaps resurface. These features help you document reasonable care. They do not replace a lawyer.
Does Candela make us compliant on its own?
No, and any tool that claims to is not being honest with you. Candela covers documentation, disclosure, and audit trail for AI use inside the platform. It does not handle consumer notification workflows when an AI-influenced decision goes against someone, it does not run the human-review process for you, and it cannot make the legal judgment of whether a given tool materially influences a consequential decision. Those steps stay with your organization and your counsel.
Do we still need an impact assessment?
No longer required of deployers. SB 26-189 removed the impact assessment and risk-management program duties. You do need to keep records showing compliance for three years, and Candela's audit trail helps with that.
How much does this cost to get started?
Nothing. The Compliance Inbox is part of the free Starter account. No credit card is required. You can create an account, start tracking your deadlines, and see how Candela documents AI use before you decide whether a paid tier is worth it.
Is this page legal advice?
No. This is a plain-language summary written for nonprofit leaders, not lawyers. It is not legal advice and it does not create a relationship of any kind. For a decision about whether the Colorado AI Act applies to a specific system in your organization, talk to a qualified attorney and read the statute itself.
This page is a plain-language summary written for nonprofit leaders. It is not legal advice, and reading it does not create an attorney-client relationship. For a decision about whether the Colorado AI Act applies to a specific system in your organization, talk to a qualified attorney and read the statute itself: Colorado Senate Bill 26-189.