A SaaS Lawyer on Colorado’s AI Law: It’s Not All on the Customer Anymore

As a SaaS lawyer, here is the short version of Colorado’s new AI law: if your product ranks, scores, or recommends people, and your customers use it for hiring, lending, housing, or insurance decisions, you can now be pulled into a discrimination lawsuit even though your customer made the call. The old “customer is responsible for everything” clause will not get you out. But there is a defense, and it is simpler than you might think.

I represent lots, literally 100s and 100s, of SaaS vendors. Here is what changed and what to do about it.

What Changed.

Colorado replaced its 2024 AI law with SB 26-189. It applies to decisions made on or after January 1, 2027.

• You count, even if you did not build the AI. If you sell a tool that helps make hiring, lending, housing, insurance, health care, or education decisions, the law calls you a “developer.” Building on someone else’s AI model does not change that.
• You can be sued over your customer’s decision. If your tool influenced a decision that broke discrimination law, you can be held responsible for your share.
• You cannot contract your way out. A clause making the customer cover your own share is void.
• You have paperwork to do. You must give customers documentation of what the tool is for, its limits, and how a person should review its results.

Where Things Stand Right Now.

The law is on the books, the Attorney General’s enforcement is on hold because of a federal lawsuit, and the rules are still being written. Comments are due October 26.

Don’t treat the pause as a pass. It stops the Attorney General. It does not stop a rejected job applicant from suing after January 1.

The Middleman Problem.

Picture the chain. An AI company builds the model. You build a feature on top of it and sell it. Your customer makes the decision.

The model company is usually not covered. Your customer is. And now so are you, the vendor in the middle.

My opinion: that goes too far. Vendors can get dragged into lawsuits over decisions they never made, and nobody knows yet how a court will split the blame. I hope the legislature takes another look. Until then, you need a plan.

Is This Strict Liability?

Not quite, but close. You do not have to do anything wrong to get pulled in. You are in if your tool influenced the decision and the customer used it the way you built, sold, or described it. Blame is then divided based on fault. And following the law’s paperwork rules is not a defense on its own.

The worst case is a customer that does nothing. It lets your tool make the call with no person looking. Then your tool did not just influence the decision. It made it.

The Defense: Keep a Human in the Loop.

The law gives you an out. Under Section 6-1-1707(5)(b), you are not responsible for uses you did not intend, document, market, advertise, configure, or contract for. So make the customer’s person the decision-maker, in writing and in the product:

• Say it in the intended use. “This tool helps your team review applicants. It is not to be used as the only basis for any decision. A trained person must review every result before acting on it.”
• Put it in the contract. The customer agrees that a person reviews every decision, that it gives the required notices, and that it is responsible for any decision made without that review.
• Build it into the product. No auto-reject by default. A person has to click before anyone is turned down.
• Keep sales on script. If the demo says “automate your hiring,” you just made automated hiring an intended use.
• Keep records. Log the settings and overrides your customer chose. If blame gets divided, that log is your evidence.

Do that, and if the customer skips the human review, the decision is on them, not you. As long as you have done your paperwork, a customer promise to cover you for that kind of misuse should also hold up. It is not a guarantee. A court will look at what you actually built and sold, not just what the document says. But it is the strongest protection this law gives you.

What Your SaaS Lawyer Should Be Doing Before January.

• Sort your features. Routine scheduling and workflow tools are generally out. Tools that rank, score, or screen people are likely in.
• Write the human-review intended use and use it everywhere: contract, documentation, and product screens.
• Replace the catch-all clause. Swap “customer is responsible for everything” for specific duties (a responsibility matrix helps): human review, required notices, and staying inside the intended use.
• Get documentation from your AI model provider so you can describe how the tool works.
• Keep your liability cap for ordinary customer claims, and check your insurance for AI exclusions.
• Weigh in by October 26 if the draft rules hit your product.

Questions I Get.

We are not in Colorado. Are we covered? Probably, if your customers use your tool on Colorado people or for Colorado jobs. Your headquarters does not decide it, and neither does the governing law clause in your contract.

Do we have to hand over our source code? No. The documentation has to be understandable, and trade secrets are protected.

Can our customer just agree to cover us? Not for your own share. It can agree to cover you when it uses the tool in ways you said not to.

If your product touches hiring, lending, housing, insurance, or health care decisions, now is the time to talk to a SaaS lawyer who represents vendors (that is all we do). Let’s talk.

I hope this helps.

Resources:

• AI Features and Automated Decision Making: What You Owe Your Customers
• Responsibility Matrix for SaaS: Onboarding, Operation, Offboarding
• Limitation of Liability Clause: The One Word That Cost a Vendor $1.88 Million

Disclaimer:

This post is for informational and educational purposes only, and is not legal advice. You should hire an attorney if you need legal advice, which should be provided only after review of all relevant facts and applicable law.