Colorado replaces its AI Act with a narrower automated decisions law

Colorado’s landmark AI Act, one of the first broad state laws on high-risk AI systems, will never take effect in its original form. On May 14, 2026, Governor Jared Polis signed SB 26-189, which repeals and replaces it with a narrower law on automated decision-making technology (ADMT). The new rules start on January 1, 2027. Gone are the duty of care against algorithmic discrimination, annual impact assessments and the risk management program. In their place: a notice before a covered system is used, a plain language explanation within 30 days after an adverse decision, and a right to ask for human review.

If you spent 2025 building an AI governance program for Colorado, not all of that work is wasted. But the compliance target has moved, and your contracts with AI vendors may need another look.

How we got here

The original law, SB 24-205, was passed in 2024 and was due to take effect on February 1, 2026. In an August 2025 special session, the legislature passed SB25B-004 and pushed that date to June 30, 2026. Then, a few weeks before that deadline, SB 26-189 replaced the framework altogether.

What the new law requires

What’s covered

The law defines ADMT as technology that processes personal data and uses computation to produce predictions, recommendations, classifications, rankings, scores or similar outputs used to make, guide or assist a decision about an individual. It applies when covered ADMT materially influences a "consequential decision" in seven areas: education, employment, housing, financial or lending services, insurance, health care services and essential government services.

Deployers (the businesses using the tool)

• Notice before use. Clear and conspicuous notice at the point of interaction that covered ADMT is being used. A prominent posting or link where the consumer engages can satisfy this.
• Explanation after an adverse outcome. Within 30 days, a plain language description of the decision and the role the ADMT played.
• Consumer rights. On request, access to the personal data used, a way to correct factually incorrect data, and meaningful human review and reconsideration of the decision, to the extent commercially reasonable.

Developers (the businesses building or selling the tool)

Developers have to give deployers technical documentation describing intended uses, categories of training data, known limitations and instructions for appropriate use and human review, and tell them about material updates.

Records, enforcement and contracts

Both developers and deployers must keep records showing compliance for at least three years. The Attorney General has exclusive enforcement power; violations are treated as deceptive trade practices under the Colorado Consumer Protection Act, with penalties of up to $20,000 per violation. Until January 1, 2030, the AG has to give 60 days’ notice and a chance to cure before bringing an action (knowing or repeated violations aside). The AG must also adopt rules on the post-adverse outcome disclosures by January 1, 2027.

One contract point stands out. The law declares void, as against public policy, contract terms that indemnify a developer or deployer against liability for discrimination. If your AI vendor agreement has a broad indemnification clause, that part may not hold up in Colorado.

Who it affects

• Employers using AI tools to screen, rank or reject job applicants in Colorado.
• Landlords and property managers using tenant screening scores.
• Lenders, insurers and health care providers using automated scoring or triage.
• Software companies selling decision tools to any of the above.

Key dates

What it means in practice

Take Front Range Rentals, a Denver property manager handling 2,000 applications a year. It uses a screening tool that scores applicants and recommends approve or decline, and staff follow the recommendation in most cases. That’s covered ADMT influencing a housing decision.

From January 1, 2027, Front Range needs a clear notice on its application page that an automated tool is used. When it declines an applicant, it has 30 days to send a plain language explanation of the decision and the tool’s role. If the applicant asks, it must show the data used, fix factual errors and have a trained person with real authority to overturn the result review the decision.

Say 300 applicants a year are declined and the explanation letters go out late or not at all. At up to $20,000 per violation, the exposure adds up fast, cure period or not. The good news: the process itself is cheap. A template letter, a review queue and a log will cover most of it.

What to do now

1. Inventory every tool that scores, ranks or recommends in the seven decision areas.
2. Ask each vendor for the technical documentation the law requires, and put that duty in your contract.
3. Draft the pre-use notice and a template adverse decision explanation.
4. Set up a human review process with trained reviewers who can actually override the tool.
5. Build a three-year record keeping routine.
6. Review indemnities and limitation of liability terms in AI vendor agreements.
7. Watch for the AG’s rules, due by January 1, 2027.

As of June 2026, the AG’s rules haven’t been adopted, so the exact content of the adverse outcome notice may still change.

Sources

• Colorado General Assembly: SB26-189 Automated Decision-Making Technology
• Skadden: Colorado repeals and replaces its AI Act
• Ogletree: Colorado’s new AI Act targets automated decision-making
• Hunton: Colorado AI Act amended and effective date delayed

This article is general information, not legal or tax advice. Laws differ between countries and states and change over time, so check the rules that apply to you or speak to a qualified professional.