A Software Company in Denver Writing the Packet Colorado Now Asks For

Updated November 2026 · Written and maintained by the Progression Agency strategy team

A customer’s compliance lead writes on December 31 asking for your tool’s intended uses and known limitations, and the question has a legal deadline behind it from the next morning. A software company in Denver that builds anything used in a consequential decision now owes that customer a documentation packet under Colorado’s S.B. 26-189, effective January 1, 2027. This page lists the packet as a table of contents, one line per item, then what the work costs. Progression is based in New York, works with Front Range product teams remotely, and offers on-site sessions on request.

A question on December 31

The email arrives late in the afternoon of the last day of the year. A bank’s vendor team uses your scoring tool, and its compliance lead wants to know what the tool is for and where it falls short. The company’s own year end is the least of the pressure: a Colorado law starts the next morning.

The email above is hypothetical, and it is the question this page is built to answer. A reply that opens with an attachment is a better reply than one that opens with a promise. The sections below build that attachment, one line at a time.

• Know which customers use your tool in a decision about a person.
• Write the packet before the email arrives, not after.
• Keep a dated copy, since the records duty covers what you gave and when.

What a software company in Denver owes its customers now

In 2024, Colorado enacted Senate Bill 24-205 on consumer protections in interactions with artificial intelligence systems. S.B. 26-189, signed in May 2026, repeals and reenacts those provisions with new requirements for automated decision-making technology in consequential decisions.

For a developer, the heart of it is a duty to the customer. Starting January 1, 2027, a developer of technology used to materially influence a consequential decision has to give the deployer technical documentation describing the technology’s intended uses, categories of training data, known limitations, and instructions for appropriate use and human review. Developers also have to notify deployers of material updates or modifications.

The Front Range has plenty of teams in this position. Metro Denver Economic Development Corporation reports a workforce of nearly 116,300 people in the region’s IT-software cluster in 2024, which means a large number of products that may sit inside a customer’s decision process. Ask counsel whether yours does.

What replaced the 2024 law?

The new act replaces it. According to the General Assembly’s summary, S.B. 26-189 repeals and reenacts the 2024 provisions, so the S.B. 24-205 text is no longer the one to follow. Read the signed act and ask counsel what changed for your product.

The packet, as a table of contents

Think of the documentation as a short book with a fixed list of chapters. The act names what the technical documentation must describe, and the rest of the list below is how a team keeps it true after launch. Each line says what goes in and who should write it.

1. Intended uses: what the tool is built to do, for which decisions, and for whom. Written by the product lead.
2. Categories of training data: the kinds of personal data the tool learned from or uses. Written by the data lead.
3. Known limitations: where the tool performs poorly or has not been tested. Written by the engineers.
4. Instructions for appropriate use: how a deployer should and should not apply the output. Written by product and support.
5. Instructions for human review: how a person checks and can override the output. Written by the product lead.
6. Update notice log: each material update or modification and the date the deployers were told. Owned by release management.
7. Retention plan: what is kept, where, for how long and by whom, so records last at least three years. Owned by the records owner.
8. What the work costs: see the price section below. Written once the other seven lines have a scope.

Item 2: categories of training data

List categories, not rows. A deployer needs to know whether the tool used employment history, payment history or location signals, and does not need a dump of the data set. Write each category in a sentence a customer’s compliance team can read, and say whether the data came from the customer, from the consumer or from a third party.

• Name each category of personal data the tool uses.
• Say where each category comes from.
• Note any category added or dropped after the last version.
• Keep the list in version control next to the model.

Item 3: known limitations, in writing

A limitation that only lives in an engineer’s memory cannot go to a customer. Keep a running list with the date each item was found, the test that showed it, and what a deployer should do about it. Include places the tool has not been tested as well as places it tested poorly.

The list should be honest and specific. A line such as “performance has not been measured on applicants over 70” is more useful to a deployer than a general caution, because the deployer can route those cases to a person.

The six cards above are the lines most teams write first. The last two, the notice log and the retention plan, are the ones that keep working after launch.

What writing the packet costs

The documentation is the smaller part of the bill. The larger part is the engineering that lets a team answer honestly: logs that record what the tool did, a way to hand a case to a person, and a data model that can find one consumer’s record. Progression quotes after a written scope.

Published bands for the builds behind a packet

The bands run from the typical low to the published high for each kind of build.

Hosting, licenses and security testing are on top of these. Our software development company page explains how a scope is written, and app development agency covers the app side. We publish no Denver price and no price for a packet.

Is your product covered?

The summary defines automated decision-making technology as technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores or other information, that is used to make, guide or assist a decision, judgment or determination concerning an individual.

A consequential decision is one that relates to an individual’s access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits. The developer duty reaches technology used to materially influence one of those decisions.

What if a person makes the final call?

The definition speaks of output that is used to make, guide or assist a decision. A human sign-off may not take the tool outside it. Whether a given arrangement counts as materially influencing a decision is a question for counsel, and the answer belongs in your file.

The summary also says specified entities are exempted from the requirements to the extent they comply with other legal obligations. Do not guess at an exemption. Ask counsel to name the one that applies and the obligation behind it.

What your customer has to show the consumer

A deployer has to give consumers clear and conspicuous notice at the point of interaction with a covered technology. After the technology makes a consequential decision with an adverse outcome, the deployer has to give a plain language description of the technology’s role within 30 days. The Attorney General must adopt rules clarifying these post-adverse disclosures by January 1, 2027.

That sentence tells you why the deployer will lean on you. To write a description of the technology’s role, the deployer needs to know what the tool looked at and how its output was used. The packet is the source, and a deployer with no packet has nothing to draw from.

• Draft a short role description a deployer can adapt for each decision type.
• Keep the description in plain language, since the act asks for it.
• Watch the Attorney General’s rules, which are due by January 1, 2027, and update the description when they appear.
• Give deployers the notice wording their product screens can show at the point of interaction.

Rights that reach back into your schema

Consumers have the right to request their personal data, to request correction of factually incorrect personal data used by a covered technology, and to request meaningful human review and reconsideration following an adverse outcome.

Each of those rights is a data question before it is a legal one. Can the system find every record about one person? Can a corrected value flow through to the next decision? Can a reviewer see what the tool saw and change the result? A team that cannot answer yes will find the packet hard to keep honest.

Can the system answer a request for one person’s data?

It can if every table that feeds the tool carries a stable person key, and if the tool keeps the inputs it used for each decision. Add the key now. Retrofitting identifiers after a request arrives is slow and error prone.

What does a correction change?

The factually incorrect value should be fixed at its source, and the fix should be visible to every later run. Log the correction with the date, who made it and which decisions used the old value.

• Add a person key to every table the tool reads.
• Store the inputs and output of each decision for later review.
• Build a review queue where a person can see inputs and override outputs.
• Record each override and the reason.

Three years of records

Developers and deployers both have to retain records necessary to demonstrate compliance with the act for at least three years. The act does not tell a team what format to use, so the design is yours, and the design decides whether a request in year three is a ten minute lookup or a month of digging.

Keep what you gave and when you gave it: each version of the documentation, each update notice and the list of deployers who received them. Keep the evidence behind each limitation. Keep the internal decisions about what counts as a material update. Ask counsel what else belongs on the list for your product.

How should the log be built?

Append only, dated, with the name or role of the person who made each entry. Store it away from the production database, with its own backup, so a rollback does not erase it. Our software teams build audit logging into custom systems as a normal part of the scope.

What the Attorney General can do

The Attorney General enforces the act through the Colorado Consumer Protection Act, and a violation is deemed a deceptive trade practice. Before January 1, 2030, the Attorney General must give a developer or deployer 60 days’ notice and a chance to cure, if a cure is possible.

The act creates no new private right of action. It does set how fault is allocated between developers and deployers in civil actions alleging unlawful discrimination under existing law, which is one more reason for each side to hold clear documents about who did what. Ask counsel how that allocation applies to your contracts.

Does a cure period mean waiting?

No. A cure period is a chance to fix a problem after a notice, and it is only offered when a cure is possible and for actions started before 2030. Teams that already have the packet and the records are the ones best placed to use it.

• Keep the current packet and every earlier version.
• Keep the update notices with their recipients.
• Keep the test reports behind each stated limitation.
• Keep a named contact who can answer a notice from the Attorney General.

A brief for your general counsel

Copy this card into a document and fill it in before the first call. A team that arrives with it can get coverage and exemption questions answered in one sitting, and can scope the packet and the supporting build from a written list.

Send the filled card with a link to your product. Our software development company page describes the builds that follow from it, and app development agency covers apps. If your Denver business also wants search help, SEO in Denver has its own page.

Related services and guides

Pages that sit beside this packet:

• Software development company
• App development agency
• SEO company in Denver

Frequently asked questions