Colorado AI Act (repealed and reenacted by SB 26-189)

Colorado SB 24-205, repealed and reenacted by SB 26-189 (signed May 14, 2026) | Effective January 1, 2027 | Exclusive AG enforcement, no private right of action

---

What Changed With SB 26-189

If you built (or planned) a Colorado AI Act compliance program around the 2024 law, stop and re-scope it. The obligations you were preparing for no longer exist.

SB 26-189 was passed by the legislature and sent to the Governor on May 12, 2026, and Governor Polis signed it into law on May 14, 2026. It did not merely amend the 2024 Colorado AI Act (SB 24-205): it repealed and reenacted the statute, replacing one regulatory model with a fundamentally different one.

The 2024 law was an EU-style, risk-management framework built around a freestanding duty of reasonable care to prevent algorithmic discrimination. The new law throws that out. In its place is a narrower disclosure-and-rights regime for automated decision-making technology (ADMT): tell consumers when covered ADMT is used, explain adverse outcomes, let consumers correct their data and ask for human review, and keep records.

The key changes:

• Effective date moved from June 30, 2026 to January 1, 2027. The original deadline is gone.
• The risk-management framework was eliminated. No more mandatory risk management program, no annual impact assessments, no freestanding duty of reasonable care (see the next section).
• New ADMT disclosure and consumer-rights obligations replace those duties (covered in "What Deployers Must Do").
• The under-50-employee small-business exemption from the 2024 law was removed. No size-based exemption replaced it: the new law applies to deployers regardless of headcount.
• Mandatory AG rulemaking: the Attorney General must adopt implementing rules by January 1, 2027.
• Enforcement is currently stayed under a federal court order in xAI v. Weiser dated April 27, 2026.

The practical implication: you have more time than the old calendar suggested, but the substance of what you must build has changed entirely. Building to the 2024 obligations now is wasted effort.

---

What Was Repealed (Do Not Build to the Old Law)

This is the most important section on this page, because a lot of guidance still circulating online describes the repealed 2024 law as if it were current.

The following obligations were part of SB 24-205 and no longer exist under the reenacted statute:

• The duty of reasonable care to prevent algorithmic discrimination: eliminated. (Existing federal and Colorado anti-discrimination laws still apply; they always did. But there is no standalone AI "reasonable care" duty.)
• The mandatory risk management program: eliminated.
• Annual impact assessments: eliminated.
• The NIST AI RMF / ISO 42001 safe harbor (a rebuttable-presumption affirmative defense for documented, framework-aligned programs): not carried forward.

One addition on the discrimination side is new, not repealed. The reenacted statute adds C.R.S. 6-1-1707, which governs claims of algorithmic discrimination brought under existing state anti-discrimination law: fault is allocated between developer and deployer with no joint and several liability; a developer is liable only where the deployer used the system as intended and the ADMT materially influenced the outcome; and any developer-deployer contract provision that indemnifies a party for its own violations of anti-discrimination law is void.

If a checklist tells you to "conduct an annual impact assessment," "maintain a documented risk management program," or "rely on the NIST safe harbor as your primary defense" under Colorado law, that checklist is describing the law that was repealed in May 2026.

---

Are You a Deployer? Run This Test First

Most compliance work falls on deployers (the companies using ADMT to make decisions), not developers. If you build an AI product for someone else, your obligations are narrower (primarily technical documentation and disclosure to deployers downstream from you).

You are a deployer under the Colorado AI Act if:

All of these are true:

1. You are doing business in Colorado (the statutory deployer definition requires it)
2. You use automated decision-making technology (ADMT) that makes, or materially influences, a consequential decision
3. That decision affects a Colorado consumer
4. The decision is in one of these enumerated domains:
   • Employment: hiring, promotion, termination, compensation, and similar decisions
   • Education: admissions, financial aid, academic evaluation, credentialing
   • Housing: rental applications, purchase decisions, pricing
   • Financial or lending services: loan approvals, credit limits, interest rates
   • Insurance: applications, underwriting, claims decisions, pricing
   • Health care: access to and eligibility for health-care services
   • Essential government services and public benefits

"Materially influences" is a defined term (C.R.S. 6-1-1701(13)), not a loose descriptor: the ADMT output must affect the outcome of the decision, for example by constraining it, or by ranking, scoring, recommending, or classifying. Incidental, trivial, or clerical uses do not qualify. (The "substantial factor" language you may see in older guidance comes from the repealed 2024 law and appears nowhere in the enrolled act.)

"ADMT" is defined broadly: technology that processes personal data and uses computation to generate output (predictions, recommendations, classifications, rankings, scores) used to make, guide, or assist a consequential decision.

The statute also expressly excludes several categories from "consequential decision," so coverage is narrower than the broad ADMT definition suggests. Excluded are: advertising, marketing, product recommendations, search, and content moderation; cybersecurity, anti-fraud, anti-money-laundering, and sanctions-compliance tools; spreadsheets that require manual human analysis and do not use machine learning or foundation models; tools that only summarize, organize, or present information for human review without producing a score or inference that materially influences the decision; and low-stakes routine processes.

You do not need to be headquartered in Colorado, but you must be doing business in Colorado. The statute defines a deployer as "a person doing business in Colorado that deploys a covered ADMT." An organization with no Colorado business activity is not a deployer, even if its systems touch Colorado residents.

If you're still not sure: ask, "Do we do business in Colorado, and does this system's output affect whether a Colorado resident gets a job, a loan, an apartment, insurance, health care, education, or a government benefit?" If yes to both, treat yourself as presumptively in scope, then check the entity carve-outs below.

Entity carve-outs: Two of the listed domains are largely carved out at the entity level. Insurers subject to C.R.S. 10-3-1104.9 (and their affiliates) are deemed in compliance with this part of the statute in the practice of insurance, except for employment-related decisions. HIPAA covered entities and business associates are excluded from sections 6-1-1701 through 6-1-1706, except for consequential decisions related to employment. A separate notice requirement for health-care providers, C.R.S. 6-1-1708(3), applies only when the provider operates from a Colorado location; it does not condition the HIPAA exclusion above. If you are in insurance or health care, check these carve-outs before building a compliance program.

Note on scope: The 2024 law's broad list once referenced categories like "legal services." The reenacted law's enumerated domains are the seven listed above. Confirm any edge-case domain against the enrolled bill text.

---

What Deployers Must Do

Under SB 26-189, deployer obligations are disclosure and consumer-rights duties, not a risk-management program. There are four core operative duties, effective January 1, 2027.

1. Provide Pre-Use Notice

Before using covered ADMT to make or materially influence a consequential decision, give the consumer clear and conspicuous notice that ADMT will be used, with instructions for how to obtain additional information. A deployer can generally satisfy this with a prominent, reasonably accessible public notice at points of consumer interaction.

2. Explain Adverse Decisions (Within ~30 Days)

When a consequential decision results in an adverse outcome for the consumer, the deployer must provide, within 30 days, a plain-language description of:

• The decision and the adverse outcome
• The role the covered ADMT played in the decision
• Instructions for requesting additional information about the ADMT
• How the consumer can exercise their rights (below)

3. Honor Consumer Rights: Inspect, Correct, and Human Review

A consumer who receives an adverse outcome can request:

• Access and correction of the personal data the ADMT used in the decision (consistent with the Colorado Privacy Act)
• Meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable

You need a process to receive and respond to these requests.

4. Keep Records for Three Years

Retain records sufficient to demonstrate compliance for at least three years from the date of the consequential decision.

What's gone: Notice there is no impact-assessment requirement, no documented risk management program, and no "reasonable care" standard in this list. Those were the heart of the 2024 law and were repealed.

---

What Developers Must Do

If you build covered ADMT and supply it to deployers, your obligations are primarily about giving deployers the information they need:

• Document and disclose to deployers the technical information about the system (including the categories of data used to train the system, known limitations/constraints, and the inputs tied to decision-making) so deployers can meet their disclosure duties.
• Retain compliance records for at least three years.
• Cooperate with deployers' consumer-facing obligations where your system is involved.

Developer duties are about transparency downstream to deployers, not managing consumer relationships directly.

---

Is There Still a NIST Safe Harbor?

No. This is a common and dangerous misconception, because the repealed 2024 law did include one.

Under SB 24-205, a deployer (or developer) who maintained a program aligned with the NIST AI Risk Management Framework (or an equivalent like ISO/IEC 42001) could claim a rebuttable presumption, effectively an affirmative defense, that it had used reasonable care. SB 26-189 did not carry that forward. With the reasonable-care duty itself repealed, there is nothing for a NIST-aligned program to be a "safe harbor" against.

What this means in practice:

• There is no codified NIST safe harbor or affirmative defense under current Colorado law.
• NIST AI RMF and ISO 42001 are still worthwhile as a documentation and governance backbone, and they help with overlapping obligations (the Colorado Privacy Act, anti-discrimination law, other state AI laws). But do not present them, internally or to a vendor, as a statutory Colorado defense.
• Your real exposure-reduction levers under the new law are doing the disclosures correctly, responding to consumer rights requests, and keeping the three-year records that prove you did.

---

The Penalty Structure

Enforcement is exclusive to the Colorado Attorney General. There is no private right of action (no class-action plaintiffs).

Legal basis: A violation is treated as a deceptive trade practice under the Colorado Consumer Protection Act (CCPA).

Maximum penalty: up to $20,000 per violation.

Right to cure (conditional, with a sunset): If the AG deems a cure possible, the AG must give 60 days' written notice and an opportunity to cure before bringing an enforcement action (C.R.S. 6-1-1706(3)(a)). The limits:

• The AG decides whether a violation is curable, so the 60-day window is not guaranteed.
• The right-to-cure provision sunsets on January 1, 2030. After that date, the AG is not required to offer a cure period.
• No cure period applies to knowing or repeated violations.

The $20,000-per-violation figure scales quickly in high-volume contexts: a disclosure failure applied across thousands of Colorado consumers is a large theoretical exposure even before any per-consumer multiplication the AG might pursue.

---

The Enforcement Reality

Current status: enforcement is suspended by a federal court order. In xAI v. Weiser (U.S. District Court for the District of Colorado), the court, on a joint motion, entered an order dated April 27, 2026 providing that the Colorado AG shall not initiate enforcement (including opening an investigation) of the Colorado AI Act, or any legislation replacing or amending it enacted this session (i.e., SB 26-189), until 14 days after the court rules on xAI's forthcoming preliminary-injunction motion. That motion is not due until 28 days after the AG completes rulemaking. The U.S. Department of Justice has intervened in the case.

AG rulemaking: SB 26-189 directs the AG to adopt implementing rules by January 1, 2027. On August 11, 2026, the Department of Law filed proposed Automated Decision-Making Technology and Chatbot Safety rules with the Secretary of State, opening a public comment period that runs through October 26, 2026. Comments submitted by September 4, 2026 will be considered for a revised proposed draft, expected no later than September 23, 2026, and a rulemaking hearing is scheduled for October 26, 2026 at the Ralph L. Carr Judicial Center in Denver (remote attendance available). The rules are still in draft form and have not been finalized.

What this means for your program: the new obligations are narrower and more concrete than the old framework, which makes them easier to operationalize. Don't pause indefinitely on the strength of the stay — it is litigation-driven and could lift, and the law's effective date is January 1, 2027. Build the disclosure, consumer-rights, and recordkeeping plumbing now, and watch the AG rulemaking for the operational details.

---

Your Compliance Checklist

Work through these before January 1, 2027. This reflects the reenacted law (SB 26-189), not the repealed 2024 framework.

Phase 1: Scope assessment (do this first)

• Inventory all systems that use covered ADMT to make, or materially influence, consequential decisions about Colorado residents
• Confirm which fall in the seven enumerated domains (employment, education, housing, financial/lending, insurance, health care, essential government services), and screen out the statutory exclusions (advertising/marketing/search/content moderation, security and anti-fraud tools, and the other carve-outs from "consequential decision")
• If you are an insurer subject to C.R.S. 10-3-1104.9 or a HIPAA covered entity or business associate, check the entity carve-outs before going further
• Identify which third-party ADMT products you deploy that qualify, and remember the under-50-employee exemption is gone, with no size-based exemption in its place

Phase 2: Pre-use disclosure

• Draft clear-and-conspicuous pre-use notices stating that ADMT is used and how to get more information
• Decide where notice lives (point-of-interaction notice vs. a prominent public notice)

Phase 3: Adverse-outcome process

• Build a process to issue plain-language adverse-decision explanations within 30 days
• Include the ADMT's role and instructions for requesting more information and exercising rights

Phase 4: Consumer rights

• Stand up intake for data access/correction requests (align with your Colorado Privacy Act processes)
• Build a meaningful human-review-and-reconsideration path (to the extent commercially reasonable)

Phase 5: Recordkeeping and vendor management

• Retain compliance records for at least three years per consequential decision
• Collect developer technical documentation for third-party ADMT and confirm it supports your disclosures
• Update contracts to allocate ADMT compliance responsibilities, but note that under C.R.S. 6-1-1707, provisions indemnifying a developer or deployer for its own violations of anti-discrimination law are void

Phase 6: Watch rulemaking

• Review the AG's proposed rules (public comment period open August 11–October 26, 2026, a revised draft expected by September 23, and a rulemaking hearing on October 26) and track the xAI v. Weiser docket; adjust your disclosures when rules are finalized

For a step-by-step version of this checklist with implementation detail, see the Colorado AI Act Compliance Checklist.

---

Official Resources

• SB 26-189 — Automated Decision-Making Technology (Colorado General Assembly)
• SB 24-205 (original 2024 law, repealed and reenacted)
• Colorado AG — ADMT & Chatbot Safety Rulemaking