Colorado law

Colorado AI Act: SB 24-205 and Its Replacement, SB 26-189

The 2024 AI Act never reached its compliance date. Its replacement trades risk assessments for notice, explanation and human review.

SD Frivolous Editorial · Published Nov 9, 2026 · 10 sources

Short answer

Colorado replaced its 2024 AI Act (SB 24-205) with SB 26-189, signed May 14, 2026, a narrower automated decision-making law that takes effect January 1, 2027. The 2024 law's duties, set for February 1, 2026 and then June 30, 2026, were repealed and reenacted before they ever applied. As of November 9, 2026, the attorney general's implementing rules are still in rulemaking.

At a glance
Current law	SB 26-189, Automated Decision-Making Technology
Replaces	SB 24-205, Consumer Protections for Artificial Intelligence (signed May 17, 2024)
Signed	May 14, 2026, by Gov. Jared Polis
Effective date	January 1, 2027
Covers	Developers and deployers of automated decision-making technology used to materially influence consequential decisions in education, employment, housing, lending, insurance, health care and essential government services
Enforced by	Colorado Attorney General, as a deceptive trade practice; 60-day cure period before January 1, 2030; no new private right of action
Status (Nov. 9, 2026)	Enacted, not yet in effect; attorney general rulemaking hearing opened October 26, 2026

Status at a glance

The bill page on the Colorado General Assembly site shows SB 26-189 introduced May 1, 2026, passed by the Senate 34 to 1 on May 7, passed by the House 57 to 6 on May 9, repassed by the Senate after concurring in House amendments on May 12, and signed by Governor Polis on May 14, 2026. Its prime sponsors were Senators Robert Rodriguez and James Coleman and Representatives Jennifer Bacon and Monica Duran.

The new law takes effect January 1, 2027. The Colorado Attorney General's office published a notice of proposed rulemaking covering SB 26-189 and a companion chatbot law, HB 26-1263, and opened the rulemaking hearing on October 26, 2026. An Akin Gump tracker entry reports that the Department of Law released an interim draft of the rules on October 6, 2026. Final rules had not been reported adopted as of November 9, 2026; the attorney general's AI page is the place to check.

What happened to the Colorado AI Act?

Colorado was the first state to pass a broad law on algorithmic discrimination in high-stakes decisions, and the first to rewrite it before it took effect. NCSL counts SB 26-189 as one of only two comprehensive AI bills enacted by any state in 2026, alongside Connecticut's SB 5, in its October 2026 legislative overview.

SB 24-205, the 2024 law

Governor Polis signed SB 24-205 on May 17, 2024. The General Assembly's summary of the act as enacted shows its core duties beginning on and after February 1, 2026: developers and deployers of high-risk AI systems had to use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination, with a rebuttable presumption of reasonable care for those who completed impact assessments, ran risk management programs, published statements and reported discovered discrimination to the attorney general within 90 days. Any business deploying an AI system meant to interact with consumers had to disclose that fact. The attorney general had exclusive enforcement and rulemaking authority.

In an August 2025 special session, the legislature passed SB 25B-004, signed August 28, 2025, which extended the effective date of SB 24-205's requirements to June 30, 2026. A McDermott Will & Schulte alert describes the delay as the result of lawmakers failing to agree on substantive amendments.

Two events in spring 2026 overtook the June 30 date. On April 9, 2026, xAI sued in the U.S. District Court for the District of Colorado (xAI v. Weiser, No. 1:26-cv-01515), and the Department of Justice filed a complaint in intervention on April 24. On April 27, the magistrate judge entered a stipulated order under which xAI will defer a preliminary injunction motion until 28 days after final rulemaking implementing SB 24-205 or a replacement law, and the attorney general will not enforce or investigate until 14 days after a ruling on that motion, as summarized by McDermott. Then the legislature repealed and reenacted the framework through SB 26-189.

Some secondary sources say SB 24-205 took effect in 2026. The legislature's own records support a narrower statement: the act became law on May 17, 2024, but its substantive duties were scheduled for February 1, 2026, moved to June 30, 2026, and were replaced on May 14, 2026, before that date arrived.

SB 26-189, the replacement

The enacted summary on the bill page states that the act repeals and reenacts SB 24-205's provisions with new requirements on automated decision-making technology (ADMT) in consequential decisions. According to Seyfarth Shaw, the new law removes the duty of care, the impact assessment requirement and the rebuttable presumption tied to frameworks such as the NIST AI Risk Management Framework, and substitutes disclosure, three-year recordkeeping and a cure period.

What SB 26-189 requires for automated decisions

The act defines ADMT as technology that processes personal data and uses computation to generate output, such as predictions, recommendations, classifications, rankings or scores, used to make, guide or assist a decision about an individual. A consequential decision is one relating to a person's access to, eligibility for or compensation in education, employment, housing, financial or lending services, insurance, health care, or essential government services and public benefits. The duties attach to a covered ADMT, meaning one used to materially influence a consequential decision (enacted bill summary).

Developer duties

Starting January 1, 2027, a developer must give each deployer technical documentation describing the covered ADMT's intended uses, categories of training data, known limitations, and instructions for appropriate use and human review, and must notify deployers of material updates. Developers and deployers both keep compliance records for at least three years.

Deployer duties and consumer rights

Clear and conspicuous notice to the consumer at the point of interaction with a covered ADMT.
Within 30 days after a consequential decision with an adverse outcome, a plain-language description of the ADMT's role in that decision. The attorney general must adopt rules clarifying this disclosure by January 1, 2027.
A right to request the personal data used and to correct factually incorrect data.
A right to request human review and reconsideration of an adverse decision.

Seyfarth adds that the law treats job applicants and Colorado employees as consumers, excludes tools that only organize or present information for human review, and excludes fraud prevention and identity verification activity. The McDermott alert notes that SB 26-189 drops SB 24-205's general duty to tell consumers they are interacting with any AI system; notice now applies only to covered ADMT in consequential decisions.

Liability between developers and deployers

The act does not create a new private right of action, but in civil actions alleging unlawful discrimination under existing law it allocates fault between developers and deployers. Seyfarth reports that developer liability is limited to uses the technology was intended or marketed for, and that indemnification clauses shifting discrimination liability contrary to that allocation are void.

Colorado AI Act effective date

SB 26-189's obligations begin January 1, 2027, according to the enacted bill summary and Seyfarth. That date replaces the June 30, 2026 date set by SB 25B-004, which had itself replaced the February 1, 2026 date in SB 24-205.

Two moving parts could still change the practical start. First, the attorney general's rules, which the statute requires by January 1, 2027, will define key terms. Second, under the April 27, 2026 stipulated order in xAI v. Weiser, xAI's preliminary injunction motion is keyed to final rulemaking on SB 24-205 or its replacement, and the attorney general agreed not to enforce until 14 days after the court rules on that motion (order; McDermott summary). Read together, the statute's effective date and the stipulation mean enforcement may lag the January 1, 2027 date.

Who it applies to and how it is enforced

The law reaches developers and deployers doing business in Colorado. Seyfarth notes exemptions for ADMT developed for research or internal development that is not made available to others for consequential decisions, and the bill summary exempts specified entities to the extent they comply with other legal obligations.

Enforcement belongs to the attorney general under the Colorado Consumer Protection Act, and a violation is a deceptive trade practice. Before January 1, 2030, the attorney general must give a developer or deployer 60 days' notice and a chance to cure if a cure is possible. Seyfarth reports that the cure opportunity is unavailable where the violation is knowing or repeated.

Colorado also enacted a separate chatbot measure in 2026. The attorney general's rulemaking notice covers HB 26-1263 alongside SB 26-189, and Akin Gump reports that its operator duties also apply from January 1, 2027.

Colorado AI Act text and summary

The official texts are on the Colorado General Assembly site. The signed act of SB 26-189 is posted as a PDF on the bill page, along with votes, amendments and the fiscal note. The signed act of SB 24-205 and its history remain on the SB 24-205 page, and the one-section delay bill is on the SB 25B-004 page.

In short: the 2024 law asked companies to prevent algorithmic discrimination and prove it through assessments; the 2026 law asks them to tell people when ADMT shaped a decision, explain adverse outcomes, fix bad data and offer human review. For employers, the overlap with hiring rules elsewhere is covered in our compliance guides, and the federal challenge that shaped the rewrite is part of the preemption picture on the legislation hub.

Bottom line

Nothing in Colorado's AI law applies yet. SB 26-189, signed May 14, 2026, replaced the 2024 AI Act before its duties ever took effect, and it starts January 1, 2027 for developers and deployers of automated decision tools used in consequential decisions such as hiring, housing and lending. The attorney general's rules are still in rulemaking, and violators get a 60-day cure period before 2030.

Key facts at a glance. Sources listed below.

What changed

2026-10-26: Attorney general rulemaking hearing on SB 26-189 and HB 26-1263 rules began.
2026-10-06: Department of Law released an interim draft of the proposed rules.
2026-05-14: Gov. Polis signed SB 26-189, repealing and reenacting SB 24-205; effective January 1, 2027.
2026-04-27: Stipulated order in xAI v. Weiser deferred enforcement of SB 24-205 pending a preliminary injunction ruling.
2026-04-24: U.S. Department of Justice filed a complaint in intervention supporting xAI.
2026-04-09: xAI sued the Colorado Attorney General over SB 24-205.
2025-08-28: SB 25B-004 signed, moving SB 24-205 duties to June 30, 2026.
2024-05-17: SB 24-205 signed, with duties set for February 1, 2026.

Frequently asked questions

Is the Colorado AI Act in effect?

Not yet. SB 24-205 was repealed and reenacted by SB 26-189 before its June 30, 2026 compliance date. SB 26-189 takes effect January 1, 2027, and the attorney general is still finalizing implementing rules as of November 9, 2026.

When does the Colorado AI law take effect?

January 1, 2027. A stipulated federal court order in xAI v. Weiser also bars enforcement until 14 days after the court rules on a preliminary injunction motion that xAI will file after final rulemaking.

What replaced Colorado SB 24-205?

SB 26-189, Automated Decision-Making Technology, signed May 14, 2026. It drops the impact assessment and duty of care model and requires notice, adverse-outcome explanations, data correction and human review for ADMT used in consequential decisions.

Who enforces the Colorado AI Act?

The Colorado Attorney General, under the Colorado Consumer Protection Act. There is no new private right of action, and until January 1, 2030 the attorney general must offer a 60-day cure period where a cure is possible.

Sources

Legal disclaimer

This page is journalism and commentary, not legal advice. AI law changes quickly; check the primary sources above and consult qualified counsel for your situation.