Colorado rewrites its AI law even before it goes into effect

SB 26-189 replaces the pioneering text of 2024 with a narrower regime, focused on automated decisions and lightened in its risk management component.

Colorado was the first U.S. state to adopt a general law on artificial intelligence. SB 24-205, adopted in 2024 and postponed until June 30, 2026, was never applied: the legislator replaced it on May 9, 2026 with SB 26-189, signed in the wake of it by Governor Jared Polis, for an entry into force on January 1, 2027.

The change is first of all about the perimeter. Gone is the broad notion of "high-risk AI system" and the algorithmic discrimination regime that accompanied it; the text now targets "automated decision-making technologies" that process personal data and materially influence a consequential decision — employment, housing, credit, insurance, health, education, essential services.

The most onerous obligations are disappearing: no more risk management program based on the NIST framework or the ISO 42001 standard, no more annual impact analysis, no more self-reporting to the Attorney General. There are still more targeted duties — information for individuals, explanation after an unfavorable decision, right of correction, effective human review, documentation of suppliers and retention of traces for three years. The text also confirms the absence of individual legal action and requires the Attorney General to publish its implementing rules before January 1, 2027.