EU AI Act vs Colorado SB 26-189: Deployer Duties for Insurers and Lenders

What changed in Colorado

Teams that built a Colorado program around SB 24-205 need to revisit it. SB 26-189, Automated Decision-Making Technology, repeals and reenacts the SB 24-205 provisions with new requirements. The earlier high-risk system and algorithmic-discrimination structure, including the deployer reasonable-care duty with its February 1, 2026 date, is superseded. Do not assume that a duty in the old statute carries into the new one.

The new statute is built around covered ADMT, meaning technology used to materially influence a consequential decision. The developer of covered ADMT must give deployers technical documentation starting January 1, 2027. That documentation covers intended uses, categories of training data, known limitations, and instructions for appropriate use and human review. Developers must also notify deployers of material updates or modifications.

The Colorado attorney general enforces the statute under the Colorado Consumer Protection Act, and a violation is a deceptive trade practice.

Scope: high-risk systems versus covered ADMT

The two regimes draw the line differently. The EU AI Act regulates a defined class of high-risk AI systems and then allocates duties between providers and deployers. Many requirements, such as risk management, technical documentation and robustness, fall on providers. Deployer duties are narrower and centre on how the system is used, who oversees it, and what affected people are told.

Colorado's line is functional. A system is in scope when it is covered ADMT that materially influences a consequential decision. Underwriting, pricing, claims and credit decisions are the use cases insurers and lenders will test against that definition. The test turns on how much the technology influences the outcome, not on membership of a listed category.

In practice, one underwriting model or claims triage tool can be in scope under one regime and not the other. Classify each in-house and third-party system separately against the EU high-risk categories and Colorado's consequential decision definition, using the statutory text. Record the reasoning, because the classification itself is something an auditor will ask to see.

Deployer duties side by side

The table maps each duty to the control that supports it. Where a regime states no matching deployer duty in the text reviewed, the cell describes the closest related obligation instead of implying one.

• Use per instructions and provider documentation: EU: deployers take technical and organisational measures to use the system per the instructions for use. Colorado: developers supply documentation including instructions for appropriate use and human review, and notify deployers of material updates. Control type: organizational, with runtime policy reflecting the instructions.
• Human oversight and review: EU: oversight is assigned to natural persons with competence, training, authority and support. Colorado: developer instructions for human review shape the deployer's review design. Control type: runtime escalation for human approval evidences review in specific cases; assigning and training reviewers is organizational.
• Monitoring, risk and incident reporting: EU: deployers monitor operation, inform providers where relevant, and on a risk or serious incident notify the provider, importer or distributor and market surveillance authorities in a set order. Colorado: developer notice of material updates feeds deployer change monitoring. Control type: blocking and records are runtime; notification is organizational.
• Input data: EU: where the deployer supplies input data, it must be relevant and sufficiently representative for the intended purpose. Colorado: no separate deployer input-data duty is described here. Control type: partly runtime, as input checks can run per interaction.
• Notices and explanations: EU: affected persons are informed where a high-risk system makes or assists decisions about them, with a clear and meaningful explanation on request. Colorado: clear and conspicuous notice at the point of interaction, then a plain-language description of the ADMT's role within 30 days of an adverse outcome. Control type: point-of-interaction notice is runtime; explanations are a process.
• Record retention: EU: deployers keep records as appropriate to support monitoring and use. Colorado: developers and deployers retain records needed to demonstrate compliance for at least 3 years. Control type: runtime generation, with retention and queryability configured by the organization.

What runtime enforcement can and cannot support

Some duties attach to individual interactions, and those can be enforced in the AI execution path. A point-of-interaction notice can be presented when a covered system is invoked. Input data can be checked or redacted before it reaches a model. A call can be allowed, blocked or escalated to a person for approval. Use can be paused when a risk is identified, which is how a deployer would act on the EU duty to suspend use. Each of these produces a record tied to a specific interaction or tool call. These are design hypotheses to validate with counsel, not legal conclusions.

Runtime controls have limits. An escalation record can show that a review took place, but not that the reviewer had the competence or authority the EU requires. A retained record supports the 3-year Colorado requirement only if the organization sets retention and can retrieve it. Neither runtime enforcement nor retained records can produce the plain-language adverse-outcome description or notify a market surveillance authority. They supply the facts that those processes rely on.

Trussed enforces policy in the execution path across models, agents, tools and MCP servers, with allow, redact, block, rate limit and escalate for human approval at the level of individual interactions and tool calls. The audit-ready evidence that enforcement generates is mapped to the EU AI Act, NAIC and NYDFS requirements. It does not replace the organizational duties described next.

Duties that remain organizational

Several duties depend on people and process. The EU requires oversight personnel with competence, training, authority and support, and AI literacy measures for staff. Deployers that are public authorities or provide public services must complete a fundamental rights impact assessment before first use, so private insurers and lenders should confirm whether any of their activities reach that threshold. Where a system is deployed in the workplace, employees and their representatives must be informed beforehand.

Incident handling is also organizational. The EU sequence differs by trigger: a possible risk goes to the provider or distributor and the market surveillance authority, while a serious incident goes first to the provider, then to the importer or distributor and the authorities. Someone has to own that escalation path and rehearse it.

Vendor management carries Colorado exposure. Developer documentation and update notices are contractual outputs, so procurement terms should secure them before January 1, 2027. A deployer that cannot show what its vendor told it about intended uses and limitations will struggle to show how it designed human review.