Is the Colorado AI Act dead? What happened and what replaced it
- SB 24-205 was repealed on 14 May 2026 without ever applying to anyone.
- SB 26-189 replaces it with disclosure duties, not risk management mandates.
- The NIST / ISO affirmative defence is gone; watch anything online that still cites it.
- SB 26-189's enforcement is paused pending federal litigation and AG rulemaking.
- Current as of July 2026. The US state AI landscape is in active motion; these guides track the live position.
The short history of a law that never lived
SB 24-205 was signed in May 2024 as the first comprehensive US state AI law, a risk-based regime with a duty of care against algorithmic discrimination, impact assessments, and risk management programmes. It never applied to anyone. Its effective date slipped from February 2026 to June 2026, a federal court stayed its enforcement amid a constitutional challenge, and on 14 May 2026 the legislature repealed it outright rather than defend it. The two-year arc from landmark to repeal, without a single day in force, is unique in US tech regulation so far.
What replaced it
SB 26-189 keeps the subject and abandons the architecture. It regulates automated decision-making technology used in consequential decisions about individuals, and it does so through disclosure and consumer rights: pre-use notice, a plain-language explanation within 30 days of an adverse outcome, meaningful human review, correction of inaccurate personal data, three-year records, and developer documentation to deployers. The duty of care, the impact assessments, the risk programmes, and the affirmative defence for following NIST or ISO frameworks are all gone.
Why so much online content is now wrong
Most guides, vendor pages, and compliance checklists about "Colorado AI Act compliance" were written between 2024 and early 2026 against SB 24-205, and very few have been corrected. If a source tells you Colorado requires impact assessments, a risk management programme, or offers a NIST-based defence, it is describing the repealed law. Check the date on anything you read about Colorado, including this page, which is why it carries one.
What to actually do
If your systems make or guide consequential decisions about Colorado residents, plan against SB 26-189's six duties for 1 January 2027, and watch two moving parts: the Attorney General's rulemaking, which will define the operational detail, and the federal litigation, which stayed the old law and shadows the new one. Preparation is cheap now and expensive after the rules land.
Key terms
- SB 24-205 (repealed)
- Colorado's original AI Act, signed May 2024 and repealed 14 May 2026 without taking effect.
- SB 26-189
- The Automated Decision-Making Technology Act that replaced SB 24-205, effective 1 January 2027.
- Repeal
- Legislative removal of a statute; here, of SB 24-205 before its effective date.
- Consequential decision
- A decision with a material legal or similarly significant effect on an individual.
- Rulemaking
- The Attorney General's process to specify SB 26-189's operational detail ahead of enforcement.