Colorado Rewrites Its AI Act: What Changes Before It Takes Effect
On May 14, 2026, the Colorado Legislature passed SB 26-189, a piece of legislation that significantly alters the regulatory obligations for developers of automated decision systems. According to EPIC, this new law repeals much of the framework established by the original Colorado AI Act (SB 24-205), which was enacted in May 2024. The legislative shift marks a transition from a model based on preventative oversight to one centered on consumer disclosure and post-decision rights.
The Shift from Proactive Prevention to Reactive Disclosure
The original SB 24-205 framework was built on the principle of proactive risk management. It required developers to maintain specific internal structures to prevent harm before it occurred. However, SB 26-189 removes several of these core obligations. Specifically, the new law eliminates the duty of care for developers to avoid algorithmic discrimination, the requirement for mandatory risk management programs, the necessity of conducting impact assessments, and the obligation to report to the Attorney General. EPIC notes that these changes represent a substantial reduction in the compliance burden previously imposed on AI developers.
While the new law removes the mechanisms for preventative auditing, it does not leave consumers without recourse. Instead, the regulatory focus has moved toward transparency regarding decisions that have already been made. The revised law retains obligations for companies to disclose to Coloradans when they are subject to consequential automated decisions. It also preserves the right for individuals to correct inaccurate information and the right to human review or reconsideration in specific circumstances. This suggests a regulatory philosophy that prioritizes individual agency and information after an event, rather than state-mandated prevention of the event itself.
The removal of mandatory impact assessments and duty of care requirements may shift the burden of identifying algorithmic harm to the consumer.
Why It Matters
One reading of this shift is that it simplifies the path for technology companies to enter the Colorado market by removing expensive, ongoing audit requirements. Another interpretation is that it creates a regulatory gap where harms such as algorithmic discrimination may only be identified after they have caused significant impact, rather than being caught during the development phase through mandatory assessments.
Comparing the Legislative Frameworks
The evolution of the Colorado AI Act can be summarized by the transition in its effective dates and its primary regulatory mechanisms. The following table compares the original legislative intent of SB 24-205 with the updated requirements of SB 26-189.
| Requirement or Milestone | SB 24-205 (Original) | SB 26-189 (New) |
|---|---|---|
| Primary Legislative Driver | Risk Management | Consumer Rights |
| Enactment/Passage Date | May 2024 | May 2026 |
| Effective Date | June 2026 (Delayed) | January 1, 2027 |
| Duty of Care (Discrimination) | Required | Repealed |
| Impact Assessments | Required | Repealed |
| Reporting to Attorney General | Required | Repealed |
The timeline for compliance has also been significantly extended. While the original act was initially set to become effective on February 1, 2026, it was eventually delayed to June 2026. Under the new SB 26-189, the effective date is now pushed further to January 1, 2027. This delay provides a longer window for the Attorney General to conduct necessary rulemaking before the laws are formally enforced.
Federal Pressure and State Regulatory Tension
The movement in Colorado does not occur in isolation from federal policy discussions. On December 11, 2025, President Trump issued an Executive Order that explicitly named the Colorado AI Act as an example of excessive state regulation. This federal action included a direction to the Commerce Department to identify onerous state AI regulations within a 90-day period. Clark Hill notes that this directive highlights an ongoing tension between state-level consumer protections and federal preferences for streamlined, less burdensome regulatory environments.
This tension creates a complex environment for both state legislators and technology firms. If the Commerce Department identifies specific Colorado requirements as overly onerous, it could lead to further political pressure on state governments to align their frameworks with federal standards. For companies operating in multiple states, the divergence between the federal approach and the specific, albeit modified, Colorado approach creates a fragmented compliance terrain. The shift in Colorado's law can be viewed as a response to this broader national debate regarding the limits of state-led AI oversight.
Implications for Stakeholders: Developers, Investors, and Policymakers
The transition from SB 24-205 to SB 26-189 creates distinct outcomes for different groups within the AI ecosystem. Analysis of these changes suggests that the costs of compliance are being traded for different types of legal and operational risks.
For developers, the immediate impact is a reduction in operational overhead. By removing the requirements for risk management programs and mandatory impact assessments, companies can reallocate resources from regulatory auditing toward core product development. However, this reduction in proactive auditing may increase the risk of litigation. Without the "safe harbor" provided by rigorous, documented impact assessments, companies may find themselves defending their decisions in court if a consumer exercises their right to human review or challenges the accuracy of their data.
For investors, the modified law may decrease the perceived regulatory risk associated with entering the Colorado market. The removal of the "duty of care" regarding algorithmic discrimination provides a more predictable environment for those deploying high-stakes AI systems. Conversely, the reliance on consumer disclosure and the right to human review introduces a new layer of "post-hoc" risk. Investors must now account for the possibility of high-volume consumer inquiries or legal challenges resulting from the disclosure of consequential automated decisions.
For policymakers and regulators, the terrain is shifting from a "preventative" model to an "enforcement" model. Instead of monitoring compliance through mandatory reports and assessments, the Attorney General's office will likely focus on responding to consumer complaints and investigating instances where disclosure obligations were not met. This places a higher premium on the upcoming rulemaking process, as the specific details of how disclosures are made and how human reviews are conducted will determine the practical efficacy of the law.
The Regulatory Roadmap Ahead
As the state moves toward the January 1, 2027, implementation date, several key indicators will determine the success and impact of the new framework. Because the Attorney General is tasked with conducting rulemaking before the law takes effect, the details of these regulations will be the primary driver of compliance costs and consumer protection levels.
- The Rulemaking Period (Current to Jan 2027): The specific definitions of "consequential automated decisions" and the procedural requirements for "human review and reconsideration" will be the most critical factors for businesses.
- Attorney General Enforcement Priorities: The degree to which the Attorney General focuses on consumer-driven complaints versus proactive industry investigations will signal whether the law acts as a meaningful check on automated systems.
- Commerce Department Findings: Any formal identification of Colorado's regulations as "onerous" by the Commerce Department could lead to further legislative amendments or federal challenges to state authority.
The fundamental question for the Colorado AI terrain is whether a disclosure-based model can provide sufficient protection against the harms of algorithmic decision-making without the structural safeguards of mandatory impact assessments and duty of care requirements. The outcome will likely depend on the granularity of the upcoming rulemaking and the capacity of the Attorney General to manage a consumer-led enforcement model.
Sources: epic.org, clarkhill.com.