Colorado — ADMT law (SB 26-189) tracker

What happened to the Colorado AI Act

The short version: the first comprehensive US state AI law was repealed before it ever applied to anyone.

1. May 2024 — SB 24-205 signed: a horizontal statute imposing a reasonable-care duty against algorithmic discrimination, technical documentation, impact assessments, and consumer notices on developers and deployers of high-risk AI systems, effective 1 February 2026.
2. 28 August 2025 — SB 25B-004 delayed the effective date to 30 June 2026 after a special session failed to reach a broader compromise.
3. April 2026 — xAI sued the Colorado Attorney General (xAI LLC v. Weiser) challenging the Act on First Amendment, due-process, and Commerce Clause grounds; the US Department of Justice intervened in support — the first time the federal government joined a challenge to a state AI law. Enforcement of the Act was suspended by agreement pending the litigation and any legislative amendment.
4. 14 May 2026 — Governor Polis signed SB 26-189, which repeals and reenacts C.R.S. Title 6, Article 1, Part 17. The algorithmic-discrimination duty of care and the impact-assessment regime are gone; what remains is a notice, documentation, and consumer-rights framework for automated decision-making technology (ADMT), with duties applying on and after 1 January 2027.

Whether the April 2026 enforcement stay carries over to SB 26-189 has not been publicly resolved; the passage of SB 26-189 mooted the core claims aimed at the discrimination provisions. We track this below.

What SB 26-189 actually requires

SB 26-189 is disclosure-focused, but not disclosure-only: alongside notice and documentation duties it gives consumers enforceable correction and human-review rights. The framework, by section of the reenacted Part 17:

• Section 6-1-1701 — Definitions. "Covered ADMT" is technology that uses computation to make, or be a substantial factor in making, a consequential decision concerning a consumer — a decision materially affecting education, employment, housing, financial services, insurance, healthcare, or government services.
• Section 6-1-1702 — Developer duties (on and after 1 January 2027). Developers must give deployers reasonably understandable documentation covering intended uses, categories of training data, known limitations, and risks; notify deployers of material modifications; and retain required records for at least three years (6-1-1702(4)).
• Section 6-1-1703 — Deployer record-keeping. Deployers must retain records demonstrating compliance for at least three years after each consequential decision.
• Section 6-1-1704 — Consumer notice. Deployers must give clear and conspicuous notice that ADMT is being used, and after an adverse outcome must provide a plain-language description of the ADMT's role within 30 days.
• Section 6-1-1705 — Consumer rights. Consumers can correct inaccurate personal data and request meaningful human review and reconsideration of adverse outcomes; deployers must designate trained individuals with authority to override ADMT decisions. The Attorney General must adopt implementing rules for these procedures on or before 1 January 2027.
• Section 6-1-1706 — Enforcement. Exclusive enforcement by the Colorado Attorney General through the Colorado Consumer Protection Act (civil penalties under the CCPA, C.R.S. section 6-1-112). A 60-day right-to-cure applies (the cure provision sunsets 1 January 2030). No new private right of action.

What is not in SB 26-189 matters as much: the reasonable-care duty against algorithmic discrimination, mandatory impact assessments, and risk management programme requirements of SB 24-205 were not reenacted.

What Colorado developers and deployers should do today

The 1 January 2027 date gives organisations a real runway, but the documentation duties reward starting early. The practical sequence:

1. Map your Colorado exposure. If your system makes or substantially influences consequential decisions affecting Colorado consumers, you are in scope regardless of where you are headquartered. Enumerate each deployment path.
2. Produce developer documentation. Section 6-1-1702's categories — intended uses, training-data categories, limitations, risks — overlap heavily with EU AI Act Annex IV technical documentation. Regula's regula docs and regula conform commands generate scaffolds covering most of them.
3. Trace your human-review path. Section 6-1-1705's meaningful human review and reconsideration right requires a working override path. Regula's regula oversight command traces AI model outputs through call chains cross-file and flags where a human review gate is absent.
4. Stand up record retention. Both developers and deployers face three-year retention duties. Decide now what "records reasonably necessary to demonstrate compliance" means for your stack.
5. Watch the AG rulemaking. Mandatory implementing rules for post-adverse-outcome disclosures and consumer-rights procedures are due on or before 1 January 2027, and will define the notice formats that count.

Where Regula fits for Colorado teams

Regula was built primarily against the EU AI Act, but SB 26-189's documentation and human-review concepts map onto work Regula already does. Practical starting commands:

pip install regula-ai

regula discover .              # AI systems present in the project
regula check . --jurisdictions eu,colorado   # Risk indicators + Colorado obligation mapping
regula gap --project .         # Gap assessment (documentation coverage)
regula oversight .             # Cross-file human-review gate detection
regula docs .                  # Technical documentation scaffold
regula conform .               # Evidence pack
regula sbom --ai-bom .         # AI Bill of Materials (CycloneDX 1.7)

Regula's Colorado jurisdiction config (references/jurisdictions/colorado.yaml) maps detected domain concepts (employment, credit, housing, insurance and others) to the specific Part 17 sections above.

What Regula does not do for Colorado: issue your consumer notices, operate your human-review process, or act as a compliance certificate. The statute is enforced by the Colorado AG against real organisations — Regula helps you produce the evidence, not the legal conclusion.

Historical: what SB 24-205 would have required

The duties in this section were repealed by SB 26-189 before taking effect and do not apply. They are preserved because SB 24-205 shaped every subsequent US state AI bill, and because a future General Assembly could revisit the model.

SB 24-205 would have required developers to use reasonable care to prevent algorithmic discrimination, publish statements about their high-risk systems, provide technical documentation, and notify the AG of discovered discrimination within 90 days. Deployers would have needed a risk management programme, pre-deployment and annual impact assessments, consumer notices, and website disclosures — with a rebuttable presumption of reasonable care for documented adherence to the NIST AI RMF or ISO/IEC 42001.

What we are tracking for the Colorado page

This page will be updated as the Colorado landscape moves. Specifically we are watching for:

1. Colorado Attorney General implementing rules — mandatory rules for post-adverse-outcome disclosures and section 6-1-1705 consumer-rights procedures are due on or before 1 January 2027; broader clarifying rules are discretionary under section 6-1-1706(5). No rules published as of 2026-07-16.
2. xAI LLC v. Weiser — whether the April 2026 enforcement stay is treated as reaching SB 26-189, and any ruling that affects the 1 January 2027 date.
3. Federal preemption pressure — the DOJ AI Litigation Task Force's posture toward state AI laws generally.
4. Enforcement signals — the first AG action under the reenacted Part 17.

If you spot something we have missed, please open an issue.

Frequently asked questions

Sources