What is the Colorado AI Act?
- SB 24-205 was repealed on 14 May 2026 and never took effect.
- SB 26-189 (the ADMT Act) is the live law, effective 1 January 2027.
- The duties are disclosure and consumer rights, not risk-management mandates.
- Enforcement is paused pending federal litigation and Attorney General rulemaking.
- Current as of July 2026. The Colorado position is in active motion; this guide tracks the live state.
What happened to the Colorado AI Act
SB 24-205, signed in May 2024, was the first comprehensive US state AI law: a risk-based regime imposing a duty of care against algorithmic discrimination, impact assessments, and risk management programmes on developers and deployers of high-risk AI. It never took effect. Its start date slipped from February to June 2026, a federal court stayed enforcement amid a constitutional challenge, and on 14 May 2026 the legislature repealed it outright and enacted SB 26-189 in its place. Anyone whose compliance plan was built on SB 24-205 is planning against a law that no longer exists.
What SB 26-189 actually requires
The replacement is a disclosure and consumer-rights law, not a risk-management mandate. Deployers of covered automated decision-making technology must give clear notice before the technology is used in a consequential decision about a person; provide a plain-language explanation within 30 days of an adverse outcome; offer meaningful human review and reconsideration; allow people to access and correct inaccurate personal data used about them; and retain records for three years. Developers must give deployers documentation covering intended uses, known harmful uses, the categories of training data, and known limitations.
Who and what it covers
Covered ADMT means computational technology that processes personal data to produce predictions, recommendations, classifications or scores used to guide or assist consequential decisions about individuals, in areas such as employment, credit, housing, insurance, education, and essential services. The duties attach to businesses deploying such technology for decisions about Colorado residents, and to the developers supplying it, wherever either is located.
Enforcement and the current status
The Attorney General is the sole enforcer; there is no private right of action, and a 60-day cure period applies until 2030. Contract clauses that shift liability for a party's own discriminatory use of ADMT are void. As of July 2026 enforcement is paused: the federal litigation that stayed the predecessor continues, and the Attorney General has committed not to enforce until rulemaking concludes, with pre-rulemaking public comment opened in June 2026. The 1 January 2027 effective date stands unless the courts or the legislature move again.
What organisations should do now
Two things, neither of which is a heavy programme. First, identify which of your systems meet the covered-ADMT definition for Colorado residents, because the notice, explanation, and human-review duties attach system by system. Second, build the duties into how those systems already run: the notice, the 30-day explanation path, the human-review point, and the three-year record are outputs a governed operating record produces as a by-product, and standing them up ahead of January 2027 costs far less than retrofitting them after rulemaking lands.
Key terms
- SB 26-189
- The Automated Decision-Making Technology Act, effective 1 January 2027, that replaced the repealed SB 24-205.
- Covered ADMT
- Computational technology that processes personal data to produce predictions, recommendations, classifications or scores guiding consequential decisions.
- Consequential decision
- A decision affecting access to or terms of employment, credit, housing, insurance, education or essential services.
- Adverse-outcome explanation
- The plain-language explanation of the decision that deployers must provide within 30 days of an adverse outcome.
- Cure period
- The 60-day window to correct a violation before enforcement, available under SB 26-189 until 2030.