Colorado AI law SB 26-189: what changed and what companies must do from 2027

Cumplimiento y regulación
28 Oct 2026, 9:35 p.m. By Juan Carlos Hernandez 💬 0

SB 26-189, signed on May 14, 2026, repealed and replaced the Colorado AI Act (SB 24-205) before it was due to take effect on June 30, 2026. The new law covers automated decision-making technology that materially influences consequential decisions about people, such as employment, housing, credit or health care. Its duties apply from January 1, 2027 and focus on notices, explanations and human review, not on the impact assessments of the earlier law.

What changed from SB 24-205?

Concept: it no longer speaks of "high-risk AI systems" but of automated decision-making technology that materially influences consequential decisions.
Removed: the risk management program, impact assessments, the duty of care against algorithmic discrimination and the legal-services domain.
Date: from a June 30, 2026 date that never arrived to duties starting January 1, 2027.
ISO 42001 and NIST AI RMF: according to law-firm analyses, the new law drops the defense for following those frameworks that SB 24-205 had; confirm with your counsel.

What must developers do?

Give deployers documentation on intended and harmful uses, training data categories, limitations and risks.
Include instructions for use and for human review.
Notify deployers of material updates.
Keep records for 3 years.

What must deployers do?

Notify the consumer before using the technology in a consequential decision.
After an adverse outcome: explain the decision and the role the technology played.
Offer access to and correction of their data, and human review.
Keep records for 3 years.

Who enforces it and what are the penalties?

Only the Colorado Attorney General enforces it, under the state consumer protection act; there is no private right of action. A 60-day cure period applies (not to knowing or repeated violations) and sunsets in 2030, with fines of up to $20,000 per violation. The Attorney General must adopt rules on post-adverse-outcome disclosures. The law is also under federal pressure: the Department of Justice intervened in April 2026 in a lawsuit against it, and the FTC proposed a policy statement in July 2026 suggesting federal preemption.

2027 checklist

1. Inventory: which AI or automated decision systems your hiring, lending, housing, health care or insurance processes use.
2. Role: for each one, do you build it or buy it? Ask the vendor for its documentation.
3. Notices: draft the pre-use notice and the adverse-outcome explanation.
4. Human review: define who reviews a decision when the consumer asks, and how fast.
5. Records: keep what the law requires for 3 years.
6. Governance: even if the law no longer requires it, an ISO/IEC 42001 management system organizes all of the above.

To place your case, use the AI risk classifier, which compares the Colorado law with the EU AI Act and Colombia's Law 1581.

Colorado AI law frequently asked questions

Did the Colorado AI Act take effect on June 30, 2026?

No. SB 24-205 was repealed and replaced by SB 26-189, signed on May 14, 2026, before that date. The new duties apply from January 1, 2027.

Who does SB 26-189 apply to?

Developers and deployers of automated decision-making technology that materially influences consequential decisions about Colorado consumers, such as employment, housing, credit or health care.

Does it still require impact assessments?

No. The new law removed the risk management program and impact assessments; it focuses on documentation, notices, explanations and human review.

What is the penalty?

The Colorado Attorney General enforces it, with fines of up to $20,000 per violation and a 60-day cure period in some cases.

Does it apply to companies outside the US?

It can, if their technology is used in decisions about Colorado consumers, for example as a vendor of hiring or lending software to US clients.

Sources

  1. Colorado General Assembly. SB26-189: Automated Decision-Making Technology. 2026 https://leg.colorado.gov/bills/sb26-189
  2. Holland & Knight. Colorado Governor Signs SB 189. 2026 https://www.hklaw.com/en/insights/publications/2026/05/colorado-governor-signs-sb-189
  3. Arnold & Porter. Colorado Narrows Its AI Law, but the FTC Says That's Not Enough. 2026 https://www.arnoldporter.com/en/perspectives/advisories/2026/07/colorado-narrows-its-ai-law-but-the-ftc-says-thats-not-enough
  4. Greenberg Traurig. Colorado Delays Comprehensive AI Law. 2025 https://www.gtlaw.com/en/insights/2025/9/colorado-delays-comprehensive-ai-law-with-further-changes-anticipated

Do you use AI in decisions about people in the US?

We help with the inventory, notices and human review, with evidence.

Talk to a specialist

You may also like

Cumplimiento y regulación

AI and personal data in Colombia: what Law 1581 and SIC Circular 002 require
Cumplimiento y regulación

ISO 42001 vs NIST AI RMF vs EU AI Act: which one does your company need?

 Cybersecurity and Public Procurement in Colombia: Requirements You Must Meet
Cumplimiento y regulación

Cybersecurity and Public Procurement in Colombia: Requirements You Must Meet

Comments (0)

Be the first to comment.