Colorado AI Act: Repealed Before It Took Effect

Colorado AI Act summary: the first comprehensive state AI law

The Colorado AI Act, formally SB24-205, was set to require developers and deployers of high-risk AI systems to take reasonable care against algorithmic discrimination from February 1, 2026. Governor Polis signed it on May 17, 2024, and the law firm Ballard Spahr calls it the first comprehensive state AI law.

The developer is the company that builds a high-risk system, and the deployer is the company that uses it. The law covered "consequential decisions", those that affect a person's access to work, housing, care, insurance, schooling, credit, legal help or essential public services.

It relied on a "rebuttable presumption", a legal assumption that holds unless someone proves otherwise. A party that completed the listed steps was presumed to have taken reasonable care.

Developers, deployers and others could also claim an affirmative defense by following a nationally or internationally recognized AI risk management framework and taking set steps to find and fix violations. The attorney general had rule-making power and sole enforcement authority, and a violation counted as a deceptive trade practice under the Colorado Consumer Protection Act.

There was no private right of action, Ballard Spahr notes. Insurers, banks and credit unions were treated as compliant if they met conditions the bill set out.

Colorado AI Act delay: the effective date moved to June 30, 2026

SB25B-004, signed by the governor on August 28, 2025, pushed the effective date back once, from February 1 to June 30, 2026. Polis had signed the original act with reservations and asked lawmakers to revisit it in the 2025 session, Ballard Spahr reports.

The general session ended without a deal. In the 2025 special session, lawmakers agreed only to extend the date, and the bill's title itself limits it to measures taking effect no later than June 30, 2026.

The extension left the substance unresolved. A working group of legislators, staff from the Governor's and Attorney General's offices and other stakeholders formed in fall 2025 and published a proposal on March 17, 2026. Ballard Spahr says even its own members thought it needed more work.

Then came litigation. In early April 2026, Norton Rose Fulbright reports, X.AI sued to block enforcement and the federal government moved to intervene, which the firm calls the first federal intervention in a challenge to a state AI governance law. The Colorado Attorney General agreed to hold off on enforcement while X.AI's motion for a preliminary injunction and any amendment by the General Assembly were pending.

Colorado AI law repealed: how SB26-189 replaced it on May 14, 2026

When the governor signed SB26-189 on May 14, 2026, it repealed and replaced the Colorado AI Act before the SB24-205 requirements ever applied. Ballard Spahr says the bill was introduced on May 1, near the end of the session, then cleared committees in both chambers and a full Senate vote before the House passed it on third reading on May 9.

The bill page shows it went to the governor on May 12 and was signed two days later, and the official summary says the act repeals and reenacts the earlier provisions with new requirements for automated decision-making technology. The SB24-205 requirements were due on June 30, 2026 after the delay, and because the replacement was signed first, they never took effect. The new law drops the term "artificial intelligence" and regulates "automated decision-making technology", or ADMT, which it defines in detail.

SB26-189 summary: what the replacement law requires from 2027

From January 1, 2027, SB26-189 replaces the old duty of care with documentation, notice, correction and human-review duties built around "covered ADMT". Ballard Spahr calls it a move from the broad "high-risk artificial intelligence system" and "algorithmic discrimination" framework to a narrower regime.

Under the law, ADMT is technology that processes personal data and uses computation to produce output used to make, guide or assist a decision about an individual. It is covered ADMT when used to materially influence a consequential decision, one about a person's access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits.

Norton Rose Fulbright lists what was dropped: the duty of care to reduce algorithmic discrimination risks, the annual impact assessments and the risk management program. Developers must now give deployers technical documentation on intended uses, training data categories, known limitations and instructions for proper use and human review, and tell them about material updates. Developers and deployers alike must keep compliance records for at least 3 years.

Deployers must give consumers clear and conspicuous notice when they interact with a covered ADMT, and a public notice posted where consumers interact can count. After an adverse outcome, the deployer has 30 days to explain the ADMT's role in plain language, and the attorney general must adopt rules on these disclosures by January 1, 2027.

Consumers can request their personal data, ask for factually incorrect data to be corrected, and seek meaningful human review and reconsideration after an adverse outcome. Human review applies to the extent commercially reasonable, Norton Rose Fulbright adds, and the deployer must name a trained person with authority to potentially override the decision.

Enforcement belongs to the attorney general under the Colorado Consumer Protection Act, with a violation counting as a deceptive trade practice. Before January 1, 2030, the attorney general must give a 60-day notice and chance to cure, where a cure is possible, before bringing an action.

The law creates no new private right of action and sets out how fault is split between developers and deployers in civil suits alleging unlawful discrimination under existing law. The official summary also exempts specified entities to the extent they meet other legal obligations.

Norton Rose Fulbright compares it with the California Consumer Privacy Act regulations on ADMT. Colorado's ADMT definition is broader and covers developers as well as deployers, while the California rules mostly regulate businesses that use ADMT.

Effective date of SB26-189: what to check before January 1, 2027

SB26-189 takes effect on January 1, 2027, the same deadline the attorney general faces for rules on disclosures after an adverse outcome. Norton Rose Fulbright advises organizations to track the rulemaking before the law starts, and Ballard Spahr tells companies that build or use decision-support tools in Colorado to revisit their compliance roadmaps now.

Mapping covered ADMTs and building the overall framework need not wait for the rules, Ballard Spahr says, while operational changes for consumer rights may take several months. The same firm has a related post titled "Colorado publishes draft ADMT regulations", dated September 9, 2026.

For the details, read the draft regulations themselves. Three checks cover most of the preparation:

1. Does any decision your product informs fall in the listed fields, and does the ADMT materially influence it?
2. Are you a developer, a deployer or both, since the law assigns separate duties to each?
3. Can you answer a consumer's request for data, correction, human review and a 30-day explanation of an adverse outcome?