The Colorado AI Act You Prepared For No Longer Exists. Here's What Takes Effect January 1.

If you spent part of 2025 building a risk-management program, drafting impact assessments, and reading the NIST AI framework because Colorado told you to, you can put most of that binder on the shelf. The law that required it, SB 24-205, the Colorado Artificial Intelligence Act, never took effect. In May 2026 the legislature repealed it and passed a much narrower replacement, SB 26-189, which Governor Polis signed on May 14, 2026. The new law takes effect January 1, 2027.

That is good news for most small businesses. It is not a reason to do nothing. The replacement is a notice-and-explanation statute, and it still reaches you if you use software that scores, ranks, or recommends people in decisions about jobs, credit, housing, insurance, health care, or education. Here is what changed, what you still have to do before January, and what nobody can answer yet.

How we got here

The short version of a long saga:

• May 2024. Colorado enacted SB 24-205, the first broad state law aimed at “algorithmic discrimination.” It put a duty of reasonable care on developers and deployers of “high-risk” AI systems, and required deployers to run risk-management programs and complete impact assessments.
• August 2025. In a special session, the legislature passed SB 25B-004, pushing the effective date from February 1, 2026 to June 30, 2026 to buy time for amendments.
• April 9, 2026. xAI sued Colorado's Attorney General in federal court in Denver (X.AI LLC v. Weiser, No. 1:26-cv-01515, D. Colo.), arguing the law violated the First Amendment and other constitutional protections.
• April 24, 2026. The U.S. Department of Justice moved to intervene as a plaintiff. The court granted the unopposed motion the same day, and the United States filed its own complaint in intervention.
• April 27, 2026. Magistrate Judge Cyrus Y. Chung entered a minute order granting a joint motion to stay. The Attorney General agreed not to begin enforcement of SB 24-205 for conduct on or before 14 days after the court rules on xAI's forthcoming preliminary-injunction motion.
• May 14, 2026. The Governor signed SB 26-189, which repeals SB 24-205 and reenacts a new framework in the same part of the Colorado Consumer Protection Act.

One clarification, because it has been widely misreported: the April order was a stipulated stay. The Attorney General agreed to it. No court has ruled on whether the 2024 law was constitutional, and with that law repealed, it may never need to.

What you can stop doing

The 2024 law's heaviest obligations are gone. Under SB 26-189, a business that uses AI in consequential decisions no longer has a statutory duty to:

• maintain a formal AI risk-management policy and program;
• complete annual impact assessments for each high-risk system; or
• meet a general “duty of reasonable care” to protect consumers from algorithmic discrimination.

At least one law-firm summary reports that the old affirmative defense for following recognized frameworks (NIST AI RMF, ISO/IEC 42001) is also gone. Governance documents you built for it are still good evidence of care. They are just no longer a Colorado requirement.

What did not go away: Colorado's ordinary anti-discrimination laws, federal employment law, and fair-lending law still apply to decisions you make with software, exactly as they apply to decisions you make by hand. Deleting your impact assessment does not delete your exposure under Title VII or the Equal Credit Opportunity Act. (We covered the hiring side in AI hiring tools and EEOC discrimination risk and the vendor-as-agent theory in AI hiring tools and vendor liability.)

What takes effect January 1, 2027

SB 26-189 regulates “automated decision-making technology,” or ADMT: technology that processes personal data and produces predictions, recommendations, classifications, rankings, scores, or similar outputs used to make or assist a decision. It applies when that technology “materially influences” a consequential decision, meaning a decision about access to, eligibility for, or compensation in employment, education, housing, financial or lending services, insurance, health care, or essential government services.

Ordinary business software is carved out. Summaries of the enacted bill list spam filters, firewalls, spell-checkers, calculators, databases, spreadsheets, scheduling tools, search, and tools that merely summarize, organize, translate, or present information for later human review. Customer-service triage, advertising, and product recommendations are also reported as excluded.

If you are a deployer, meaning the business that uses covered ADMT to make the decision, you will need four things:

1. A notice before use. Before the technology materially influences a decision about someone, you must give clear and conspicuous notice that it is being used and tell the person how to get more information. Summaries of the final bill say a prominent public notice that is reasonably accessible during the interaction can satisfy this, so an individual letter for every applicant may not be required.
2. An explanation after an adverse outcome. If the decision goes against the person (a rejected application, a terminated service, materially worse pricing), you have 30 days to give a plain-language description of the decision and the role the technology played, a simple way to ask for more information, and an explanation of the person's rights.
3. Two consumer rights. The person can ask you to correct inaccurate personal data the technology relied on, and can ask for meaningful human review and reconsideration, to the extent that is commercially reasonable.
4. Records. You must keep records showing compliance for at least three years after the decision.

Developers, meaning the companies that build and sell these tools, owe deployers documentation: intended uses, known limitations and risks, the categories of training data, and instructions for use, along with notice of material updates. That matters to you as a buyer, because the vendor's documentation is what you will use to write your notice and explanations.

Two more provisions are worth knowing. Several summaries report that the law voids contract clauses that try to make one party indemnify the other for its own discriminatory acts involving ADMT, which will affect your vendor agreements. And the law has industry-specific off-ramps: lenders that send ECOA and FCRA adverse-action notices, HIPAA-covered entities for most clinical decisions, state-regulated insurers already subject to Colorado's insurance algorithm rules, and FERPA-compliant schools are treated differently. If you are in one of those sectors, read the off-ramp language closely before assuming you are out.

There is no headcount exemption in the new law. The 2024 Act exempted many deployers with fewer than 50 employees from some duties. Our read of the summaries is that SB 26-189 does not reproduce that exemption. The obligations are lighter, but they apply to the 12-person property manager the same way they apply to a regional bank.

Enforcement: who can come after you, and how

Only the Colorado Attorney General can enforce SB 26-189. There is no private right of action. A violation is treated as a deceptive trade practice under the Colorado Consumer Protection Act, with civil penalties the legislature's fiscal analysis puts at up to $20,000 per violation.

Before the AG can bring an enforcement action, the AG must give you notice of the alleged violation and 60 days to cure it. That cure right does not apply to knowing or repeated violations, and it expires January 1, 2030. Treat the cure period as a safety net for honest mistakes in the first three years, not as a compliance strategy.

A typical scenario

Here is a typical scenario. Consider a small staffing agency with a Colorado office that uses a resume-screening tool that scores applicants against job descriptions. When SB 24-205 was still in force, the agency spent several months and a meaningful consulting budget on an impact assessment for that tool. When the replacement passed, the owner's first question was whether that money had been wasted.

Partly. The assessment is no longer required, but the work behind it was most of what the new law needs: the agency already knew which decisions the tool influenced, what data it used, and who could override it. Turning that into a pre-use notice for the careers page, a template for 30-day adverse-outcome explanations, and a short written human-review procedure took a few weeks, not months. The businesses that will struggle in December are the ones that never figured out where their software touches a hiring or credit decision.

Your to-do list before January 1

• Inventory. List every tool that scores, ranks, or recommends people in a decision about jobs, credit, housing, insurance, health care, or education. Include features inside software you already own, like an applicant-tracking system's “match score.”
• Ask your vendors for their developer documentation, in writing, and ask how they plan to support your adverse-outcome explanations.
• Draft your pre-use notice and decide where it will live (application page, intake form, point of sale).
• Build the 30-day adverse-outcome process. Who sends the explanation, from what template, and how do you track the deadline?
• Write down your human-review procedure. Who can change the outcome, and what do they look at besides the score?
• Set up record retention for three years after each covered decision.
• Review your vendor contracts for indemnity clauses that may be void under the new law.

What is still unknown

Three big questions remain open as of early October 2026.

The rules. SB 26-189 requires the Attorney General to adopt implementing rules by January 1, 2027. The AG's office ran a pre-rulemaking comment period through July 13, filed proposed rules on August 11, posted interim draft updates on September 23, and is taking comments through October 26, 2026, according to the Colorado AG's AI page. The AG's pre-rulemaking considerations document flags the open issues: what “materially influence” means in practice, what a “meaningful” human review looks like, and how detailed an adverse-outcome explanation must be. Final rules may land within weeks of the effective date. Plan to adjust your templates in December.

The litigation. The stay order in xAI v. Weiser speaks to SB 24-205, the repealed law. Practitioners disagree about what happens next. One firm's summary says the case is partly moot because the algorithmic-discrimination provisions xAI attacked are gone. Another reports that the parties' stipulation lets xAI seek a preliminary injunction within 28 days after final rules implementing the replacement law are adopted, and that the constitutional theories (compelled speech among them) could be aimed at the new disclosure duties. Our view is that you should plan to comply on January 1 and treat any injunction as a pleasant surprise, not a plan.

Federal preemption. The federal government's intervention in the xAI case was part of a broader push against state AI laws. Nothing in federal law today displaces SB 26-189, and nothing on the near horizon will before January.

Colorado's other 2026 AI laws, briefly

Colorado passed several narrower AI bills this session. The one most likely to matter to a general business is HB 26-1263, the conversational-AI (chatbot) safety law, signed May 29, 2026, with operator requirements beginning January 1, 2027. It requires operators of publicly available chatbots to tell users they are talking to AI, and adds age-estimation, self-harm protocols, and minor-protection duties. Its definition is broad, and the AG's proposed rules would carve out narrow, bounded-task bots. We cover that in our chatbot disclosure guide. According to the legislature's research staff, two other bills, HB 26-1139 and HB 26-1195, deal with AI in health-insurance utilization review and AI in psychotherapy. If you are not in those fields, they will not touch you.

If you also collect consumer data, Colorado's AI rules sit alongside its privacy law, covered in our state privacy law overview. For another state's approach, see Connecticut's 2026 AI law.

Frequently Asked Questions

For ongoing tracking

Colorado's rules are still being written and the litigation is live. We track changes like these at silvertonpublishing.com/ai-current.

This article reflects Colorado AI law as of October 2026. The Attorney General's rules and the federal litigation could change the details before January 1, 2027. Confirm the final rule text and the status of xAI v. Weiser before relying on it. Nothing in this article is legal advice for your specific situation.

This article is for educational purposes only and does not constitute legal, tax, or financial advice. Consult a qualified professional for guidance specific to your situation.