Ctrl + Alt + Legislate: Colorado reboots its AI act
On May 14, 2026, Colorado Governor Jared Polis signed into law a compromise bill that replaces the state’s landmark AI statute, the Colorado AI Act, SB 24-205. The Colorado legislature acted in response to widespread industry objections to SB 24-205 as overly burdensome and following a US District Court of Colorado order suspending enforcement of the statute for the foreseeable future.1 The new automated decision-making technologies (ADMT) law, SB 26-189,2 takes a fundamentally different approach to AI regulation, trading comprehensive algorithmic discrimination protections for a leaner, less burdensome documentation-and-disclosure framework.
If you have been preparing for the June 2026 compliance deadline for SB 24-205, the new ADMT law is a significant course correction. Here is what has changed:
- The effective date has been pushed to January 1, 2027.
- Deployers are no longer required to implement risk management frameworks or conduct AI impact assessments.
- The Colorado Attorney General (AG) has clear deadlines to complete further rulemaking to clarify developers’ and deployers’ obligations. The AG retains exclusive enforcement authority, with consumers still having no private right of action.
The new statute will affect how companies develop and deploy ADMT across industries, especially in the financial services, employment, health, and education sectors, while insurers will now need to comply with respect to their employment practices. With these changing statutory requirements and terminology, companies may want to audit their AI systems against the new definitions; prepare to comply with the statute’s notice, disclosure, and post-decision appeal requirements; and mitigate sources of risk for anti-discrimination liability from ADMT.
Narrower Scope and Clearer Rules
The new law swaps out the Colorado AI Act’s broad definitions of “artificial intelligence system” and “high-risk AI system” for more precise concepts: ADMT3 and covered ADMT.4 New definitions for “consequential decision,”5 “materially influence,”6 and “adverse outcome”7 clarify exactly when compliance obligations kick in and address concerns about how ambiguous terminology in the original statute would have been applied or enforced. While most AI systems that would have been classified as high risk under the old law will still qualify as covered ADMT, the added specificity gives companies a clearer framework for determining whether the AI systems they develop or deploy will require compliance with the law.
Who Needs to Comply and Who Is Excluded
The new law will have broad application in the employment, financial services, education, and health sectors. All developers and deployers of ADMT involved in making or materially influencing consequential decisions related to the following seven “covered domains” are regulated under the statute:
- an education enrollment or an education opportunity;
- employment or an employment opportunity that creates or may create an employer-employee relationship;
- the lease or purchase of residential real estate in Colorado;
- a financial or lending service;
- insurance, including underwriting, pricing, coverage, claims adjudication, or other determinations that materially affect access to benefits;
- health care services; and
- essential government services and public benefits, including eligibility and renewal determinations.
Insurance is a covered domain, but SB 26-189 excludes insurers that are already regulated under an earlier Colorado law (SB 21-169, codified at C.R.S. §10-3-1104.9) regulating insurers’ use of AI and external consumer data information sources in connection with their insurance practices. However, SB 26-189 explicitly applies to all insurers that use ADMT in their employment practices or employment opportunities. This is a notable difference from SB 24-205, which had an entity-level exemption from the law’s provisions for most insurers.
Developer Obligations: Lighter but Still Meaningful
It is recommended that developers still develop documentation about their covered ADMT (e.g., describing intended uses, categories of training data, and known limitations), but this information is now only required to be shared with deployers, not publicly posted or shared with the AG. Crucially, these obligations only apply where the ADMT was marketed or sold for use in consequential decisions, giving developers clearer control over when their products are in scope. While developers have an ongoing duty to notify deployers of material updates and changes to intended uses of their ADMT, the statute no longer imposes strict requirements on developers to engage in ongoing monitoring and evaluation of the systems they offer to deployers.
Deployers: Governance Frameworks Are Out, Consumer Notices Are In
The most dramatic shifts are those impacting deployers. Gone are comprehensive risk management programs and routine impact assessments. What remains is a set of consumer-facing notice requirements: clear disclosure before using covered ADMT in a consequential decision and, if that decision produces an adverse outcome, a plain-language explanation of what happened and what the consumer can do about it. Consumers also retain the right to review and correct their personal data and to request “meaningful human review” of adverse decisions. “Meaningful human review” is a defined term in SB 26-189 that requires deployers to designate an individual who is trained in, has the authority to override a consequential decision of, and has specific understanding of the workings of the ADMT to enable a meaningful reevaluation of the adverse consequential decision experienced by a consumer.
Enforcement and Liability
Violations are treated as deceptive trade practices under the Colorado Consumer Protection Act and carry fines of up to $20,000 per violation. Before bringing an enforcement action, the AG has to provide the developer or deployer notice and an opportunity to cure their violation, unless a violation is committed knowingly or by a repeat violator; however, the requirement for the AG to provide a cure period is temporary and sunsets after three years. Notably, the law preserves other remedies available under the Colorado Anti-Discrimination Act and provides that liability for algorithmic discrimination will be apportioned between developers and deployers based on fault. It also limits the enforceability of certain contractual indemnification provisions that would let either party off the hook for their own anti-discrimination violations.
Effective Date
The AG is tasked with engaging in rulemaking to clarify certain deployer obligations and key operative definitions of the statute by a January 1, 2027 deadline (the same date as when the law becomes effective). The January 2027 deadline gives companies time to prepare, but the notice, disclosure, and post-decision appeals infrastructure the law requires will take time to build right. In addition, the AG’s rulemaking process will likely impact the exact compliance requirements for deployers. Companies deploying covered ADMT may be expected to anticipate the need to tailor their compliance efforts to last-minute rule adoption.
1 SB 24-205 had been challenged in a lawsuit brought by X.AI, in which the US Department of Justice had intervened. Later, Colorado’s Attorney General filed a joint motion with X.AI to delay enforcement. See X.AI LLC v. Weiser, No: 1-26-cv-01515 (D. Colo. filed Apr. 9, 2026). SB 24-205 had also been called out in President Trump’s executive order “Ensuring a National Policy Framework for Artificial Intelligence” (Dec. 11, 2025) as an example of an excessive state law that should be federally preempted.
2 SB 26-189, 75th Gen. Assembly, 2d Reg. Sess. (Colo. 2026) (https://leg.colorado.gov/bills/sb26-189). All definitions referred to below are as defined in the legislation.
3 ADMT means “a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual.”
4 Covered ADMT means “automated decision-making technology that is used to materially influence a consequential decision.”
5 “Consequential decision” means “(I) a decision, determination, or action made about a consumer that relates to the provision of or a consumer’s access to eligibility for, selection for, or compensation for a covered domain; or (II) a decision, determination, or action about a consumer that relates to a differentiated price, cost sharing, compensation, or other material terms in a manner that is reasonably likely to materially limit, delay, effectively deny, or otherwise fundamentally alter the consumer’s access, eligibility, or opportunity for a covered domain.”
6 “Materially influence” means “(I) an ADMT output is a non-de minimis factor that is used in making a consequential decision and (II) an ADMT output affects the outcome of a consequential decision, including by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how a consequential decision is made. [It] does not include incidental, trivial, or clerical uses.”
7 “Adverse outcome” means “(a) a decision that denies, terminates, revokes, or materially reduces or restricts a consumer’s access to, eligibility for, selection for, compensation for, or the provision of an opportunity or service, or (b) a decision that results in materially less favorable differentiated price, cost, compensation, or other material terms that are reasonably likely to materially limit, delay, or effectively deny, or otherwise fundamentally alter, a consumer’s access to, eligibility for, selection for, compensation for, or the provision of an opportunity or service compared to terms offered to similarly situated consumers. If a decision outcome imposes materially less favorable differentiated pricing or terms, the decision outcome materially influences price, cost sharing, compensation or material terms.”
[View source.]
Source(s):
Ctrl + Alt + Legislate: Colorado reboots its AI act | JD Supra. (2026). JD Supra. https://www.jdsupra.com/legalnews/ctrl-alt-legislate-colorado-reboots-its-7211142/