What a deployer actually owes

C.R.S. 6-1-1704 sets three obligations, and the second is the one that requires a template nobody has written yet.

A pre-decision notice. Before using a covered ADMT to materially influence a consequential decision, the deployer must give the consumer a clear and conspicuous notice that it did or will do so, plus how to get more information. Subsection (2) allows compliance through “a prominent public notice that is reasonably accessible at points of consumer interaction” — in practice, a line on the application form or the resident portal page.

A post-adverse-outcome disclosure within thirty days. Subsection (3) requires a plain-language description of the decision and the tool's role in it; instructions and “a simple-to-follow process” to request more information, including the tool's name, version number, developer, and “the types, categories, and sources of personal data used”; and an explanation of the consumer's rights under C.R.S. 6-1-1705.

Accessible delivery. Subsection (8) requires notices to be provided in a manner reasonably accessible to consumers with disabilities and consumers with limited English proficiency.

Two further duties sit outside 6-1-1704. C.R.S. 6-1-1703 requires records to be retained “for not less than three years after the date of a consequential decision” — longer than many associations' current retention schedules. And C.R.S. 6-1-1705 gives the consumer, after an adverse outcome, a right to correction of incorrect data and to meaningful human review. “Meaningful human review” at 6-1-1701(15) is defined: a designated individual with authority to approve, modify or override, who considers relevant available primary evidence, who is trained to conduct the review, and who “does not default to the system output.”

How it is enforced — and the trap in the enforcement clause

A violation is a deceptive trade practice under the Colorado Consumer Protection Act, enforceable exclusively by the Attorney General, with a right to cure. C.R.S. 6-1-1706 says plainly that “nothing in this part 17 creates a new private right of action.”

That is narrower relief than it looks. C.R.S. 6-1-1707(1) says a deployer “may be held liable in an action alleging unlawful discrimination under state anti-discrimination laws, including the ‘Colorado Anti-Discrimination Act’” arising from a consequential decision materially influenced by a covered ADMT. Subsection (9) closes the door harder: use of an ADMT “does not excuse, justify, or provide a defense to” any obligation or liability under state or federal law. And subsection (7)(a) voids as against public policy any indemnification clause that shifts a party's own anti-discrimination liability for ADMT use — so a management agreement that pushes that exposure onto the association is unenforceable as to that term.

What boards face before January 1, 2027

Inventory the AI in the stack, in writing. Ask every vendor — screening, collections scoring, violation detection or photo recognition, application triage, the resident portal — one question: does this product produce a score, ranking, recommendation, classification or prediction that we use in a decision about a lease, a purchase or transfer approval, or a job? The written answer determines whether the association is a deployer.

If the answer is yes, three deliverables. A pre-decision notice on the application or portal; a thirty-day adverse-outcome letter template; and a human-review path staffed by a named, trained person with override authority who does not rubber-stamp the model.

Set a three-year retention schedule for decision records, and push the developer disclosures upstream — C.R.S. 6-1-1702 obliges developers to give deployers the documentation a deployer needs, so put that obligation in the management agreement and the vendor contract.

The cheapest compliance route is to keep the human in front. If the tool only summarises or presents information for human review and emits no score, ranking or inference, it is outside the definition of ADMT altogether. For most Colorado associations, that is both the correct answer and the free one.

What to watch next

The Attorney General must adopt rules on or before January 1, 2027 clarifying the post-adverse-outcome disclosures under 6-1-1704(4)(b), and may adopt rules clarifying “materially influence” under 6-1-1706(5)(b). Those rules, not the statute, will determine how heavy this is for a volunteer board that has never thought of itself as an AI deployer.