Colorado AI Act (SB 24-205 and SB 26-189)

Colorado passed the first comprehensive state AI statute in the US, SB 24-205, in May 2024. That law never took effect. Its start date slipped from February 1, 2026 to June 30, 2026, and before any obligation applied, the legislature rewrote it: SB 26-189, signed by Governor Polis on May 14, 2026, repeals and reenacts SB 24-205 as a narrower law governing automated decision-making technology. If you are reading older guidance describing a duty of reasonable care, annual impact assessments, and a June 30, 2026 deadline, it describes a law that no longer exists.

What changed from SB 24-205

The original act classified systems as "high-risk artificial intelligence systems" and imposed a duty of reasonable care to prevent algorithmic discrimination, plus annual impact assessments for deployers. The replacement is organized differently. It regulates automated decision-making technology: technology that processes personal data and produces outputs such as scores or recommendations used to guide decisions about individuals. Its obligations attach when that technology is used in a consequential decision, meaning a decision affecting access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health care, or essential government services and public benefits.

What the new law requires

Based on the official bill summary, the obligations break down as follows:

• Developers must give deployers technical documentation: intended uses, categories of training data, known limitations, and instructions for use and human review. They must also notify deployers of material updates. These duties begin January 1, 2027.
• Deployers must give clear notice at the point of interaction, and within 30 days after an adverse consequential decision, a plain-language description of the role the technology played.
• Both developers and deployers must keep compliance records for at least three years.
• Consumers may request their personal data and correction of factually incorrect data, and may request meaningful human review and reconsideration after an adverse decision.

Enforcement and timing

The attorney general enforces the law under the Colorado Consumer Protection Act, and a violation is a deceptive trade practice. For actions taken before January 1, 2030, the attorney general must give 60 days' notice and a chance to cure, where a cure is possible. The law creates no new private right of action; it does set how fault is divided between developers and deployers in civil discrimination claims under existing law. The attorney general must adopt rules clarifying the post-adverse-outcome disclosure requirements by January 1, 2027, so the detail of that disclosure is still to come.

What this does not tell you

This page summarizes the official bill page for SB 26-189, not a clause-by-clause reading of the enacted text. We have not confirmed whether features of the old law, such as an affirmative defense tied to a recognized risk management framework like the NIST AI RMF, carried over. Do not assume they did. Before building a compliance program around any specific provision, read the enacted text and the attorney general's rules once they are published.

How it compares to other states

Colorado's rewrite moved it away from the broad duty-of-care model. Texas's TRAIGA asks whether a system was built or used with the intent to discriminate, and Utah's AI Policy Act is built around disclosure. Colorado's new law now sits closer to the disclosure-and-review end of that spectrum, with procedural rights for consumers rather than a foreseeability standard. At the federal level, the FTC reaches similar conduct through case-by-case deception and unfairness enforcement.

The federal preemption fight

Colorado's original act was the target of the federal government's most advanced attempt to have a state AI law declared preempted: xAI sued in April 2026, the Department of Justice intervened, and enforcement was stayed. The repeal and replacement in May substantially mooted that case before any court ruled. See our breakdown of the preemption debate and why the US still has no federal AI law for what would have to happen for federal law to displace a state statute like this one.

See every upcoming date on our AI compliance deadlines calendar.

Not sure which of these applies to you? Use our Which AI laws apply to me? checker.