regulations us colorado
Colorado Rewrote Its AI Act: What SB 26-189 Changes Before 2027
The law most compliance teams were preparing for never took effect. Here is what replaced it, and what to do with the work you already started.
Correction, October 30, 2026. An earlier version of this post, published in July, said the effective date of Colorado's AI Act had moved again but that the core developer and deployer obligations had not changed. That was wrong: Governor Polis signed SB 26-189 on May 14, 2026, which repeals and reenacts SB 24-205 with a different set of obligations. We have rewritten the post and the Colorado AI Act page to match the official bill page.
What actually changed
SB 24-205 was scheduled to apply from February 1, 2026, then June 30, 2026, and never took effect. Its replacement regulates automated decision-making technology used in consequential decisions, and its duties begin January 1, 2027. The pieces that defined the old law, a duty of reasonable care against algorithmic discrimination and annual impact assessments for deployers, are not part of the replacement as described in the official summary.
What the new law centers on instead: developer documentation for deployers, notice at the point of interaction, a plain-language explanation within 30 days after an adverse decision, consumer rights to correct data and request human review, and at least three years of compliance records. The attorney general enforces it, with a 60-day notice-and-cure period for actions before January 1, 2030, and the attorney general's rules on post-decision disclosures are due by January 1, 2027.
What to do with work you already started
- Impact assessments you already ran are not wasted. Knowing which systems you use, what decisions they influence, and what data they consume is the starting point for every obligation above.
- Vendor documentation requests matter more now, not less. Developer documentation is the first thing deployers will depend on, so build it into contracts before January 1, 2027.
- Notice and review workflows are the new build. Deployers need a way to give notice, explain adverse decisions in plain language, and route requests for human review.
- Wait for the attorney general's rules before finalizing the wording of post-decision disclosures.
We will update this page when those rules are published. Read the enacted bill before relying on any single provision, and see our full Colorado page for the breakdown.
See every upcoming date on our AI compliance deadlines calendar.
Sources & references
Suggested next reading
regulations us colorado