After two years of delays, unsuccessful amendments, and a federal lawsuit, Colorado has replaced its sweeping 2024 AI law with a narrower and more practical framework. Companies that use automated tools to make or influence consequential decisions about Colorado residents should assess whether the new law applies to them and begin building their compliance infrastructure ahead of the law’s January 1, 2027, effective date.
Colorado SB 26-189: Automated Decision-Making Technology Act
Effective: January 1, 2027
Gov. Jared Polis signed SB 26-189 on May 14, 2026, which replaces Colorado’s original AI Act (SB 24-205) with a framework focused on transparency, notice, and consumer recourse rather than comprehensive risk assessment and algorithmic discrimination governance. The shift marks a significant recalibration of Colorado’s approach to AI regulation.
Who Is Covered
The law regulates developers and deployers of “automated decision-making technology” (ADMT). While certain uses of AI fall within its scope, the statute avoids the term “artificial intelligence” entirely. The law defines ADMT instead as any technology that processes personal data and uses computation to generate outputs (meaning predictions, recommendations, classifications, rankings, or scores) that are used to make, guide, or assist decisions about individuals. Basic infrastructure that does not use machine learning is excluded, as are tools used solely for administrative tasks such as summarizing or routing information for human review.
Obligations under the law begin when a system becomes “covered ADMT,” meaning the ADMT materially influences a “consequential decision.” This means a decision affecting an individual’s access to, eligibility for, or pricing of opportunities in these covered domains:
- Education enrollment,
- Employment,
- Lease or purchase of residential real estate in Colorado,
- Financial and lending services,
- Insurance,
- Healthcare, and
- Essential government services.
The law no longer contains a small business exemption and removes the safe harbor previously available to companies following recognized AI risk management frameworks such as NIST AI 100-1 or ISO/IEC 42001.
Key Obligations Under the New Law
Developers must provide deployers with technical documentation covering the ADMT’s intended uses, categories of training data, known limitations and inappropriate uses, and instructions for meaningful human review. Developers must also notify deployers of material updates. For deployers, the primary obligations are consumer-facing. Before using covered ADMT in a consequential decision, a deployer must provide clear and conspicuous notice that an automated system is or will be involved and explain how the consumer can obtain more information. This can be satisfied through a prominent public disclosure accessible at points of consumer interaction, such as an online application portal. Deployers must retain their records for at least three years following a consequential decision using ADMT.
If covered ADMT results in an “adverse outcome,” which means a denial, termination, material reduction in benefits, or significantly worse pricing, the deployer must, within 30 days, provide a plain-language description of the decision and the ADMT’s role, information about the personal data used, and an explanation of the consumer’s rights. Consumers may also request correction of inaccurate personal data and seek “meaningful human review” by a trained individual with actual authority to override the system’s output.
Violations are treated as deceptive trade practices under the Colorado Consumer Protection Act and carry fines of up to $20,000 per violation. There is no private right of action, and the Colorado attorney general (AG) has exclusive enforcement authority. Before bringing an enforcement action, the AG must provide 60 days’ notice and an opportunity to cure, except for knowing or repeat violations. The cure opportunity sunsets on January 1, 2030.
xAI Litigation and Federal Pressure
SB 26-189’s narrower approach appears to have been influenced, at least in part, by litigation brought by xAI. On April 9, 2026, xAI filed suit challenging the original Colorado AI Act on First Amendment, due process, and Commerce Clause grounds. xAI argued that designing an AI model constitutes protected speech and that the law’s algorithmic discrimination requirements impermissibly compelled the company to redesign its product to reflect Colorado’s views on fairness.
The litigation escalated quickly. On April 24, 2026, the U.S. Department of Justice (DOJ) moved to intervene, marking the first time the DOJ had joined a challenge to a state AI law. Executive Order 14365, which directed the DOJ to establish an AI Litigation Task Force, specifically called out the prior Colorado AI legislation as an example of excessive state AI regulation. xAI and the Colorado attorney general jointly moved to stay enforcement, and the federal court granted the stay on April 27, 2026. SB 26-189’s passage renders many of xAI’s claims moot by eliminating the algorithmic discrimination obligations at the core of the lawsuit.
Preparing for Compliance
With a quickly approaching effective date and AG rulemaking underway, companies should begin preparing now. Key considerations include:
- Audit your business’s use of AI and automated systems against the new ADMT definitions. If your business uses ADMT, build pre-decision notice and post-adverse-outcome disclosure infrastructure and designate individuals capable of conducting meaningful human review.
- Review your contracts with vendors that may provide ADMT services and consider updating these agreements to take into account SB 26-189’s compliance requirements.
- Monitor the AG’s rulemaking closely, as final rules will shape specific compliance requirements, and those rules may be finalized close to the effective date.
Companies operating in Colorado should treat SB 26-189 as one piece of a still-developing regulatory picture. If you have questions about this law or its impact on your operations, please contact the authors.