Colorado enacted SB 26-189 in May 2026, replacing the earlier high-risk AI framework before its major obligations began. Its substantive automated decision-making rules generally start on 1 January 2027.
Do not quote the 2024 statute as the current rule
SB 24-205 was signed in 2024, but SB 26-189 repealed and reenacted its relevant framework. Articles claiming a February 2026 start for the original duties are outdated. The replacement focuses on automated decision-making technology materially influencing consequential decisions.
The decisions that matter
Covered settings include specified employment, housing, health care, education, lending, insurance and essential-service decisions. Whether software materially influences a covered decision matters more than whether marketing calls it generative AI. A simple chatbot does not automatically fall within every consequential-decision duty.
Developer versus deployer
Developers of covered technology must provide defined documentation. Deployers face consumer-notice and adverse-decision communication obligations, subject to statutory detail. The law also provides routes for correction of erroneous personal information and meaningful human review of certain adverse outcomes.
Check timing and rulemaking
The state attorney general describes the main statutory requirements as effective from January 1, 2027 and was conducting 2026 rulemaking. Proposed rules are not automatically final obligations. Preserve the exact signed bill and separate rule docket when creating controls.
A production checklist
List every decision impacted, inventory developer documentation, map training-data categories and known limitations, record the human review procedure, and identify who responds to consumers. Test correction workflows with synthetic cases before use.
Boundary and alternative
A NIST-style risk review can help plan internal controls, but voluntary frameworks do not replace statutory obligations. Consult Colorado counsel for exemptions, definitions, appeals, record retention and the current adopted rules before the first covered deployment.
Dated first-party verification and limits
Colorado’s Attorney General describes SB 26-189, signed in May 2026, as repealing and reenacting the earlier SB 24-205 AI provisions in a revised automated decision-making framework. The new law’s principal requirements are scheduled to start on 1 January 2027. A compliance program should use the enacted 2026 law, not copy the 2024 wording or treat the future January 2027 duties as already effective on 25 October 2026.
Sources & Further Reading
- Colorado SB 26-189 enacted automated decision-making statute — Colorado General Assembly.
- Colorado Attorney General ADMT rulemaking — Colorado Attorney General.
Jurisdiction/scope: Colorado, United States. This is educational information and does not constitute legal or other professional advice. No hands-on product test is claimed.