Strip SB 26-189 down to what you actually have to do, and it comes to three things you owe the people your AI helps make decisions about. None of them require a lawyer to draft. They require plain writing and a little planning.
1. A pre-use notice —> tell people you’re using it
Before AI helps make a consequential decision about someone, let them know, in plain terms, that automated technology is part of the process. This isn’t a wall of legalese. It’s a sentence or two in the places people already look such as an application form, a portal, an intake packet.
Example: “We use automated tools to help review applications. A member of our team reviews the results before any decision is made.”
2. A post-adverse explanation —> say what happened, and why
When a decision goes against someone, like a denial or a rejection, SB 26-189 gives you 30 days to provide a plain-language description of the main reasons. The goal is dignity and clarity: the person should understand what drove the outcome, not receive a black box.
Example: “Your application wasn’t approved. The main factors were X and Y. If any of the information we used is wrong, you can ask us to correct it and take another look.”
3. A path to human review —> let people be heard
People can ask to access and correct the data used about them, and request that a human reconsider the decision, where that’s commercially reasonable. For a small team, “commercially reasonable” means a realistic process and not a 24/7 appeals department. (More on what that looks like in the next post.)
What if you build or customize the AI?
If you’re a developer and you built the tool or substantially modified it, you also owe documentation of its intended uses, known limitations, and the categories of data it was trained on. If you bought your tool off the shelf, ask your vendor for this; it’s reasonable to expect it.
The test for all three: could a board member repeat it?
That’s the bar for good governance writing, and it happens to be the bar this law rewards. If your notice, your explanation, and your review process can each be described by a non-expert in a sentence, you’re in good shape.
Writing these from a blank page is the hard part. GOVERNBOX generates them for you → grounded in a control library, tailored to your organization, and held for your review before anything goes out.
→ Take the free AI Readiness Scorecard at GOVERNBOX.ai — five minutes, real answers.
General information about SB 26-189, not legal advice. — Jim Tunnessen, Gradient Descent LLC