Colorado’s AI Act was repealed and replaced by SB 26-189.

What is Colorado’s AI law now?

Colorado’s governing AI statute is SB 26-189, titled “Automated Decision-Making Technology,” signed by Governor Polis on May 14, 2026. It repeals and reenacts the 2024 Colorado Artificial Intelligence Act (SB 24-205, the law originally codified at C.R.S. § 6-1-1701 et seq.) with a far narrower transparency and disclosure framework. Substantive compliance begins January 1, 2027.^[CO1]

The original 2024 Act never took effect. It was first scheduled for February 1, 2026, then delayed to June 30, 2026 by SB 25B-004 — but neither date went live, and SB 26-189 superseded the framework entirely. Colorado was still the first US state to enact comprehensive AI legislation; what changed is the substance, not that distinction.^[CO1]

SB 26-189 drops the 2024 Act’s “high-risk AI system” / reasonable-care model. Instead, it regulates covered automated decision-making technology (ADMT) — technology used to materially influence a consequential decision about an individual — and imposes transparency, notice, disclosure, documentation, and consumer-rights duties on developers and deployers. It is closer in spirit to a disclosure regime than to the EU AI Act’s prescriptive, risk-tiered conformity model.^[CO1]

Legislative History and Timeline

The 2024 framework was superseded outright rather than refined: SB 26-189 reflects industry and legislative concerns about the feasibility of the reasonable-care and impact-assessment model, and replaces it with a leaner set of transparency and disclosure duties.

Scope and applicability

SB 26-189 applies to any person or entity “doing business in Colorado” that develops or deploys a covered ADMT. This broad jurisdictional language means that organizations headquartered outside Colorado must comply if they serve Colorado residents or make ADMT-driven decisions affecting them. Note that SB 26-189 has no size-based exemption — the 2024 Act’s fewer-than-50-employee deployer carve-out is gone.^[CO1]

Who Must Comply

The law establishes two distinct regulated parties with different obligations:

Important note: An organization can be both a developer and a deployer. For example, a healthcare system that builds its own clinical decision support AI and deploys it internally must comply with both sets of requirements.

What Qualifies as Covered ADMT

Technology is covered ADMT when it is used to materially influence a consequential decision — that is, when it is a non-de-minimis factor in the outcome (replacing the 2024 Act’s “substantial factor” trigger). Incidental, trivial, or clerical uses are excluded, and the Colorado Attorney General must adopt mandatory rules clarifying the line by January 1, 2027. SB 26-189 covers consequential decisions about access to, eligibility for, or compensation related to seven domains:^[CO1]

Notable Exemptions

SB 26-189 excludes incidental, trivial, and clerical uses from the “materially influence” trigger, and provides sector-specific deemed-compliance carve-outs for activity already governed by other regimes. These are regulatory-alignment exemptions, not a framework safe harbor:^[CO1]

• Financial and credit notices: activity covered by FCRA/ECOA adverse-action requirements and insurers operating under existing Colorado rules
• Health and education: FDA-regulated devices, HIPAA-governed activity, and FERPA-covered education records
• Financial privacy: activity governed by the Gramm-Leach-Bliley Act (GLBA)

There is no size-based exemption: the 2024 Act’s fewer-than-50-employee deployer carve-out did not survive. Entity-type and regulatory-status exemptions apply, but small organizations meeting the definitions are still in scope.^[CO1]

Key definitions

Understanding SB 26-189 requires familiarity with the terms that structure its obligations — the most important being covered ADMT, materially influence, and consequential decision:

Discrimination Is Handled Outside the AI Law Now

SB 26-189 removes the 2024 Act’s standalone duty of reasonable care against “algorithmic discrimination.” Discrimination involving ADMT is now addressed through existing Colorado anti-discrimination law rather than a bespoke AI duty — with liability allocated by relative fault and developer liability limited to intended uses. That existing law continues to protect against unlawful differential treatment or impact on the basis of an individual’s actual or perceived:

• Age
• Color
• Disability
• Ethnicity
• Genetic information
• National origin
• Race
• Religion
• Sex (including pregnancy, childbirth, and related medical conditions)
• Sexual orientation
• Other classifications protected under Colorado or federal law^[CO1]

This distinction still matters, but the legal mechanism changed. Under SB 26-189, AI-related discrimination is policed through general anti-discrimination law rather than an AI-specific reasonable-care duty — so the analysis turns on unlawful treatment of protected classes, not on whether an organization followed an AI risk framework.

Consequential Decision

A consequential decision is any decision that has a material legal or similarly significant effect on the provision or denial to any consumer of:

• Education enrollment or opportunity
• Employment or employment opportunity
• Financial or lending services
• Essential government services or public benefits
• Health-care services
• Housing or residential real estate
• Insurance^[CO1]

The trigger phrase is now materially influence — defined as a non-de-minimis factor in the outcome, replacing the 2024 Act’s “substantial factor.” An ADMT need not make the final decision autonomously to be covered; it only needs to be a non-trivial factor. This captures systems where humans retain final authority but rely on ADMT-generated recommendations, while excluding incidental and clerical uses. The Attorney General must issue mandatory rules clarifying these contours by January 1, 2027.^[CO1]

Developer vs. Deployer

The law creates a two-party framework with distinct obligations:

Developer requirements

Under SB 26-189 (new C.R.S. § 6-1-1702), developers of a covered ADMT must give each deployer the documentation needed to use the technology responsibly and to meet their own duties. The duties are documentation and disclosure — the 2024 Act’s reasonable-care duty, public-summary registry, and 90-day AG discrimination reporting did not survive. These obligations commence January 1, 2027, and records must be retained at least three years.^[CO1]

1. Documentation Provided to Deployers

Developers must provide each deployer documentation covering:^[CO1]

Artifacts such as model cards and dataset cards remain a practical way to package this documentation, even though the statute no longer requires a specific format. Crucially, developers are not required to disclose proprietary source code, model weights, or trade secrets to satisfy these duties.^[CO1]

2. Recordkeeping

Developers must retain the documentation supporting these disclosures for at least three years. The emphasis is on demonstrable records rather than a public registry — there is no longer a requirement to publish summaries of systems offered or to report discrimination risks to the Attorney General within 90 days.^[CO1]

Deployer requirements

Under SB 26-189, deployers of a covered ADMT have four operational obligations, all centered on the consequential-decision context, with at least three-year recordkeeping. The 2024 Act’s mandatory risk-management program, annual impact assessments, and reasonable-care duty are gone. These obligations commence January 1, 2027.^[CO1]

1. Pre-Use Notice

Deployers must give clear-and-conspicuous notice before a covered ADMT is used to materially influence a consequential decision. This can be satisfied through a prominent public notice — for example, an accessible link describing the use.^[CO1]

2. Post-Adverse-Outcome Disclosure (within 30 days)

When a covered ADMT contributes to an adverse decision, the deployer must provide, within 30 days, a plain-language description of the ADMT’s role in that decision plus the consumer’s rights and how to exercise them.^[CO1]

3. Data Correction

On a consumer’s request, the deployer must allow access to, and correction of, factually inaccurate personal data the ADMT used. This is a consumer-request-triggered right tied to the adverse-outcome context, not a standalone affirmative duty.^[CO1]

4. Meaningful Human Review

On request, the deployer must offer meaningful human review or reconsideration of the decision, to the extent commercially reasonable. As with data correction, this is triggered by the consumer in the adverse-outcome context.^[CO1]

Consumer rights

SB 26-189 gives consumers rights that attach to the adverse-outcome context and create enforceable obligations for deployers. These rights take effect January 1, 2027.^[CO1]

Right to a Plain-Language Explanation

After an adverse decision in which a covered ADMT played a role, the consumer is entitled — within 30 days — to a plain-language description of:

• The role the ADMT played in the decision
• The consumer’s rights under SB 26-189
• How to exercise those rights

The explanation must be in plain language, not technical jargon. For example, a job applicant rejected with the help of an ADMT screening tool can learn how the ADMT factored into the rejection and what they can do next.^[CO1]

Right to Correct Data

On request, a consumer may access and correct factually inaccurate personal data the ADMT used. The deployer should:

• Provide a mechanism for consumers to submit correction requests
• Investigate disputed data
• Correct verified inaccuracies
• Keep records of the request and resolution

Right to Meaningful Human Review

On request, and to the extent commercially reasonable, the consumer may obtain human review or reconsideration of the decision. A qualified human must be able to substantively evaluate the matter rather than rubber-stamp the ADMT’s original output.^[CO1]

Opt-Out Rights Under Colorado Privacy Act

SB 26-189 sits alongside the existing Colorado Privacy Act (CPA). Consumers retain the CPA right to opt out of the processing of personal data for profiling in furtherance of decisions that produce legal or similarly significant effects — which can overlap with covered ADMT.^[CPA]

Enforcement and penalties

SB 26-189 grants the Colorado Attorney General exclusive enforcement authority. There is no private right of action — only the AG can bring enforcement actions. Note that these duties are enacted but not yet enforceable; they become operative January 1, 2027.^[CO1]

Enforcement Mechanisms

Violations are treated as deceptive trade practices under the Colorado Consumer Protection Act (C.R.S. 6-1-112). This classification subjects violators to:

• Civil penalties up to $20,000 per violation (up to $50,000 per violation where the victim is an elderly person)
• Injunctive relief requiring cessation of unlawful practices
• Each consumer or transaction treated as a separate violation

The "per violation" structure means penalties can accumulate rapidly. If a deployer fails to provide required disclosures to 1,000 Colorado consumers, each instance could constitute a separate violation — creating potential exposure of $20 million. (The dollar figures flow from C.R.S. 6-1-112 generally; verify the current statutory text before relying on them in a legal or contractual context.)^[CO1]

60-Day Notice and Cure

The Attorney General must give 60 days’ notice and an opportunity to cure where a cure is possible — except for knowing or repeated violations. This right to cure sunsets January 1, 2030. After that date, the cure window no longer applies.^[CO1]

No Framework Safe Harbor

Unlike the 2024 Act, SB 26-189 provides no rebuttable-presumption safe harbor for following the NIST AI Risk Management Framework or ISO/IEC 42001. Following those frameworks is no longer a codified legal defense in Colorado. They remain strong operational practice for building the notice, disclosure, correction, and human-review workflows the new law expects — just not a statutory shield.^[CO1]

Rulemaking Authority

The Attorney General must adopt clarifying rules by January 1, 2027. Expected guidance includes:

• The contours of “materially influence” (presumptions and illustrative examples)
• Notice and disclosure mechanics for covered ADMT
• How developer and deployer documentation duties are evidenced
• Interaction with sector-specific deemed-compliance carve-outs^[CO1]

Comparison to the EU AI Act

The 2024 Colorado AI Act was often described as “US-style EU AI Act regulation.” SB 26-189 moved Colorado further from that model — toward a leaner transparency regime. Here’s a comparative analysis:

Key Similarities

• Decision-focused scope: Both concentrate on AI that affects high-stakes decisions about people
• Transparency obligations: Both mandate disclosure to affected individuals
• Documentation flow: Both push documentation from upstream developers/providers to downstream deployers

Key Differences

• Lighter touch: SB 26-189 is a transparency-and-disclosure regime — no risk-management program, impact assessments, or framework safe harbor — whereas the EU imposes detailed technical requirements
• Penalty severity: EU penalties are orders of magnitude higher, creating stronger deterrent effects
• Prohibited uses: The EU AI Act bans certain applications (social scoring, real-time biometric identification); Colorado does not
• Extraterritoriality: The EU AI Act has broader extraterritorial reach covering any AI system used in the EU market^[EU]

For healthcare vendors

Healthcare AI teams have specific hooks under SB 26-189. Clinical technology is more likely to be covered ADMT when it materially influences consequential decisions about:

• Access to health-care services
• Cost or terms of health-care services
• Coverage or prior-authorization workflows that materially affect access or cost

Whether a given clinical workflow qualifies turns on the facts — and the law provides a deemed-compliance carve-out for HIPAA-governed activity and FDA-regulated devices, so much routine clinical AI may sit outside scope. The closer a system is to access, cost, or coverage decisions, the more likely it is covered. Vendors building or substantially modifying these systems act as developers; health systems and payers using them to materially influence consequential decisions act as deployers. Many organizations will be both.

The good news for healthcare teams already behind on this: SB 26-189 asks for less than the 2024 framework did. There is no mandatory risk-management program and no annual impact assessment. The work is practical — give consumers clear pre-use notice, explain an adverse decision in plain language within 30 days, allow data correction, and offer meaningful human review. Keeping the supporting records (at least three years) is what turns those steps into something you can stand behind, and you have until January 1, 2027 to get there.

For background on how the EU AI Act, Colorado, and California rules overlap for healthcare teams, see our EU AI Act guide and HIPAA-compliant AI guide.

Compliance roadmap

With the January 1, 2027 compliance date set, here’s a practical implementation roadmap prioritizing evidence generation over documentation theater:

GLACIS Framework

Colorado SB 26-189 Compliance Sprint

1

Inventory & ADMT Classification (Weeks 1-3)

Catalog all AI systems used in your organization. Classify each against the seven consequential-decision domains and ask whether it materially influences (is a non-de-minimis factor in) a decision. Prioritize systems touching employment, housing, credit, or healthcare. Document whether your organization acts as developer, deployer, or both for each system.

2

Framework Alignment (Weeks 4-8)

Adopt NIST AI RMF or pursue ISO 42001 as operational backbone. These are no longer a codified legal defense in Colorado, but they remain the most efficient way to stand up notice, disclosure, correction, and human-review workflows. Map current practices to the framework and identify gaps in governance, testing, and documentation.

3

Testing & Evidence Generation (Weeks 9-14)

Even though SB 26-189 drops the AI-specific discrimination duty, existing Colorado anti-discrimination law still applies — so fairness testing remains worthwhile. Test for disparate impact across protected characteristics (race, gender, age, disability). Generate verifiable evidence of testing — not just internal reports but cryptographic attestations that testing occurred and results were reviewed. The same evidence supports your ADMT documentation and human-review records.

4

Documentation & Disclosures (Weeks 15-20)

If you’re a developer, assemble the deployer-facing documentation SB 26-189 requires (intended uses, training-data categories, limitations, monitoring and human-review instructions) — model cards and dataset cards remain a handy format. If you’re a deployer, prepare pre-use notice and post-adverse-outcome disclosure templates, and set a retention plan for at least three years.

5

Operational Readiness (Weeks 21-24)

Train personnel on the new ADMT requirements. Implement consumer notice mechanisms (e.g., website notices, application disclosures). Establish data-correction and meaningful-human-review processes, and a workflow to deliver post-adverse-outcome disclosures within 30 days.

6

Continuous Monitoring (Toward Jan 2027)

Keep production monitoring in place and your three-year records current. Watch for the Attorney General’s clarifying rules — due by January 1, 2027 — especially on what “materially influence” means in practice, and adjust notice, disclosure, and review workflows accordingly.

Critical insight: January 1, 2027 looks distant, but the AG’s clarifying rules and the build-out of notice, disclosure, and human-review workflows take time. Standing up durable evidence — records that show your disclosures went out and your reviews happened — is far easier to start now than to reconstruct later.

Role-Specific Action Items

Frequently asked questions

References