In short
- SB 26-189 repeals and reenacts SB 24-205, the Colorado AI Act, as a law about automated decision-making technology, applying from 1 January 2027.
- Three duties from the 2024 version are gone: the risk management programme, the annual impact assessment, and the general duty of reasonable care against algorithmic discrimination.
- What replaced them is documentation and disclosure. Deployers owe a plain language explanation within 30 days of an adverse decision, and both sides keep records for 3 years.
- Enforcement sits with the Colorado Attorney General alone, with a 60 day cure period that ends on 1 January 2030. There is no private right of action.
- A team already building for the EU high-risk regime, which applies from 2 December 2027, has most of the Colorado artefacts already and is missing the consumer facing ones.
Colorado wrote the first broad American AI statute, then replaced it before it ever applied.
SB 26-189 repeals the Colorado AI Act passed as SB 24-205 and reenacts the subject as a law about automated decision-making technology, effective 1 January 2027. The change is not cosmetic: the obligations that made the 2024 text famous are the ones that were removed.
01What did SB 26-189 actually remove?
The three duties that required an internal programme.
| Duty under SB 24-205 | Status under SB 26-189 | What survives in practice |
|---|---|---|
| Risk management programme | Removed | Nothing mandated by name |
| Annual impact assessment | Removed | Developer documentation set |
| Duty of reasonable care on discrimination | Removed | Existing discrimination law |
| Consumer notice | Kept and widened | Notice before interaction |
| Explanation of an adverse decision | Kept and timed | 30 day plain language disclosure |
Read the right hand column carefully. The removal of the duty of reasonable care does not make algorithmic discrimination lawful in Colorado. It removes a statutory duty that sat on top of general discrimination law, which continues to apply on its own terms.
For a compliance team, the practical loss is a document. An organisation that was preparing an annual assessment now has no Colorado obligation to produce one, which is a different position from the fundamental rights assessment the EU requires of named deployers.
02What do developers have to hand over?
A documentation set, to the deployer, before the deployer can meet its own duties.
Under Colorado SB 26-189, from 1 January 2027 a developer of covered automated decision-making technology must give deployers documentation of the intended uses, the known risks and limitations, the categories of personal data used in training, and instructions for appropriate use including human oversight. The developer must also notify deployers of material updates and keep records for 3 years.
The structure is familiar. It is a procurement duty dressed as a transparency duty, and it lands in the same place as the questions a buyer should already be asking a model vendor. A deployer that cannot obtain this documentation cannot write the consumer notice that the same statute requires of it.
03What does a deployer owe the person affected?
Notice before the decision, and an explanation after an adverse one.
Under the Colorado ADMT Act, before a consumer interacts with covered technology that materially influences a consequential decision, the deployer gives clear and conspicuous notice. When the decision is adverse, the deployer has 30 days to provide a plain language disclosure of the decision, the role the technology played in it, and how the consumer exercises their rights, which include correction of inaccurate personal data and human review to the extent commercially reasonable.
That second artefact is the one that is hard to produce late, and SB 26-189 directs the Colorado Attorney General to adopt rules on the post-adverse outcome disclosure on or before 1 January 2027. A disclosure written 29 days after a refusal, by someone reconstructing what the system contributed, is a different document from one generated by a system that recorded its own contribution at decision time.
04How does this compare with the EU AI Act?
Narrower in scope, faster in date, thinner in evidence.
| Question | Colorado, from 1 Jan 2027 | EU, Annex III from 2 Dec 2027 |
|---|---|---|
| Trigger | Materially influences a consequential decision | Listed use in Annex III |
| Internal assessment required | No | Yes, Articles 9 and 27 |
| Explanation to the individual | Yes, within 30 days | Yes, Article 86, no fixed period |
| Record retention | 3 years | 6 months minimum for logs, Article 19 |
| Who enforces | Attorney General only | Market surveillance authorities |
| Private claims | None created | Not created by the Regulation |
The two regimes are not alternatives and neither absorbs the other. Colorado asks who was told what and when. The EU asks what the organisation knew about the system before it deployed it, which is why the line between deployer and provider matters far more in Brussels than in Denver.
05What should a team covered by both do first?
Inventory by decision, not by system.
The Colorado trigger is the decision, so the useful list is one row per consequential decision the organisation makes, naming the technology that materially influences it, the developer documentation held for it, and the owner of the 30 day disclosure. A team that already maintains an Annex III inventory can extend it with two columns rather than starting again.
Then set the earlier date as the working deadline. 1 January 2027 arrives eleven months before the European high-risk date of 2 December 2027, and the artefact it demands, an explanation a consumer can read, is the one least likely to exist already.
06Frequently asked questions
When does the Colorado automated decision-making law take effect?
1 January 2027. SB 26-189 repeals the Colorado AI Act enacted as SB 24-205 and reenacts the subject matter as a law on automated decision-making technology, with the developer and deployer duties applying from that date.
Does Colorado still require an AI impact assessment?
No. The standalone annual impact assessment, the risk management programme and the general duty of reasonable care against algorithmic discrimination were removed by SB 26-189. Documentation, notice and explanation duties took their place.
What is a consequential decision under the Colorado law?
A decision with a material effect on access to employment, housing, credit, insurance, health care, education or essential government services. Technology that merely assists routine work, such as scheduling or triage, is outside the definition unless it materially influences that decision.
Can a consumer sue under the Colorado ADMT Act?
No. Enforcement is exclusive to the Colorado Attorney General, who treats a violation as a deceptive trade practice under the Colorado Consumer Protection Act. Before 1 January 2030 the Attorney General must give 60 days notice and an opportunity to cure.
07References and method
- Colorado Senate Bill 26-189, Automated Decision-Making Technology, as published by the Colorado General Assembly, for the effective date of 1 January 2027, the repeal and reenactment of SB 24-205, the developer and deployer duties, the 3 year record retention and the 60 day cure period expiring 1 January 2030.
- Crowell and Moring, Colorado Hits Reset on AI Regulation, consulted on 17 September 2026, for the list of obligations removed from the 2024 statute and the sector safe harbours. Used as a reading of the bill, with each duty checked back against the bill text.
- Regulation (EU) 2024/1689, Articles 13, 26 and 86, for the European counterparts to the Colorado documentation, deployer and explanation duties.
- Regulation (EU) 2026/1744, for the deferral of the Annex III high-risk obligations to 2 December 2027, which sets the European date used in the comparison.