Runtime Evidence Supporting a Colorado SB 26-189 Adverse Decision Explanation

What the statute asks a deployer to provide

As of November 2026, Colorado SB26-189 addresses automated decision-making technology (ADMT) used in consequential decisions. A consequential decision relates to an individual's access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits. A covered ADMT is one that materially influences such a decision.

When a covered ADMT makes a consequential decision that results in an adverse outcome, the deployer must give the consumer, within 30 days, a plain-language description of the decision and the role the covered ADMT played in it, along with an explanation of the consumer's rights. Those rights include requesting meaningful human review and reconsideration. Starting January 1, 2027, developers of covered ADMT must give deployers technical documentation covering intended uses, categories of training data, known limitations, and instructions for appropriate use and human review. The Attorney General must adopt rules clarifying the post-adverse-outcome disclosure requirements by January 1, 2027.

The sourced obligation is a plain-language description of the decision and the ADMT's role. It is narrower than a full technical explanation. Runtime records are not named as a requirement. They are best understood as supporting evidence that can help a deployer substantiate what the ADMT did, which is an interpretation to confirm with counsel.

What interaction-level and tool-call-level evidence can and cannot establish

Enforcement evidence is scoped to individual interactions and tool calls. It can show what the AI was permitted to do, what policy applied, what was stopped or modified, and whether a person approved an escalated action. That is difficult to reconstruct afterward from application logs, model outputs, and policy documents, because those sources rarely record which policy version was in force for a given request.

It does not, by itself, establish the final consequential decision, the rationale behind it, or the consumer's personal data. The ADMT definition covers outputs such as scores, rankings, and recommendations, and an enforcement point may see only some of them, depending on where it sits in the execution path. A runtime record can show that a call to a scoring tool was allowed. It cannot show how a downstream system weighed that score.

Three categories of evidence must therefore come from elsewhere. Decision-level records hold the determination and its inputs. Model and developer documentation describes intended uses, training data categories, and limitations. Workflow or case-management records capture how a human review of the decision was requested, assigned, and resolved. A useful exercise is to list each element of the consumer disclosure (decision description, ADMT role, consumer rights, human review) and name the system of record for each. Do not assume the runtime layer holds all of them.

Implementation decisions and tradeoffs

Start with an inventory of AI uses that could qualify as a covered ADMT, meaning uses where an ADMT output is a meaningful factor in a consequential decision. Then trace each one through the execution path and mark which steps are enforced and which are not. Gaps are often found at tool calls made by agents or coding assistants, and at human approval steps handled in email or chat rather than in a recorded workflow.

Test the 30-day window with a real exercise. Pick one past decision, then time how long it takes to assemble the runtime records alongside the decision, model, and workflow records. The result shows whether linkage between systems is adequate.

Retention involves a tradeoff. Longer retention improves the ability to answer a later regulator or auditor request, but it increases storage and data-handling obligations, including residency. Set periods once the applicable statutory language and Attorney General rules are confirmed, and keep them configurable so a rule change does not require re-architecture.

Teams that already map evidence to NIST AI RMF or sector requirements can reuse that mapping for runtime artifacts, but any link to Colorado's explanation and review provisions is a judgment for legal review. Treat an evidence map as an input to that review, not a compliance determination.

Trussed is one example of enforcement in the execution path that produces audit-ready evidence. It enforces policy at individual interactions and tool calls (allow, redact, block, rate limit, escalate for human approval), generates audit-ready evidence mapped to frameworks including NIST, and supports self-managed deployment in the customer cloud with configurable retention and data residency. It does not produce decision rationale, model documentation, or end-to-end workflow tracing, so those records still come from other systems.