The Colorado AI Act Was Rewritten: What SB 26-189 Means for Businesses Using AI

If you read about the Colorado AI Act in 2024 or 2025, much of what you read no longer describes the law. In May 2026 the legislature repealed and reenacted it. The obligations changed, the effective date moved again, and the small-business exemption is gone.

Here is the current picture as of October 2026, and a practical plan for the months before it takes effect.

The timeline

• May 17, 2024: SB 24-205 is signed, with duties starting February 1, 2026.
• August 28, 2025: a special-session bill, SB 25B-004, moves that date to June 30, 2026.
• May 14, 2026: SB 26-189, Automated Decision-Making Technology, is signed. It will "repeal and reenact, with amendments" the AI Act. Section 5 provides that "this act takes effect January 1, 2027" and "applies to consequential decisions made on or after January 1, 2027."

The Colorado Attorney General's office says the same: "This new law and its provisions go into effect January 1, 2027."

About the months in between: the 2026 Colorado Revised Statutes still print the 2024 text, marked effective until January 1, 2027, and its enforcement has been challenged in federal court. If you make consequential decisions with AI today, ask your attorney how this interim period applies to you.

What the new law covers

SB 26-189 regulates automated decision-making technology that materially influences a consequential decision about a consumer in these areas:

• education
• employment
• residential real estate
• financial services and lending
• insurance
• health care
• essential government services

"Consumer" includes employees and Colorado job applicants. A résumé-screening tool or an automated tenant screen is squarely in scope.

If you build the tool (developer)

From January 1, 2027, a developer must give each business that uses its system documentation covering:

• intended uses and "known harmful or inappropriate uses"
• the categories of training data
• known limitations
• instructions for use, monitoring and human review

Developers must also give notice of material updates and keep records for three years.

If you use the tool (deployer)

A business that uses covered technology must:

• Give notice first: "clear and conspicuous notice" before the technology is used in a consequential decision.
• Explain adverse outcomes: after an adverse outcome, within thirty days, a plain-language description of the decision and of the technology's role, and how to request more information.
• Honor consumer rights: access to and correction of the person's data, and human review and reconsideration of the decision.
• Keep records for three years.

What changed from the 2024 version

The reenacted text does not carry over the 2024 law's duty of reasonable care against algorithmic discrimination, its risk-management program or its impact assessments. The focus is now on transparency and recourse: tell people, explain adverse decisions, and let them correct their data and reach a human.

The 2024 law also exempted deployers with fewer than fifty full-time-equivalent employees, under certain conditions. That exemption is not in the new law. A 15-person company is covered if an AI hiring tool materially influences who it hires from Colorado applicants.

Enforcement

The Attorney General enforces the law exclusively, through the Colorado Consumer Protection Act. Where a violation can be cured, the AG must first give notice and 60 days to cure. That does not apply to knowing or repeated violations, and the cure provision itself is repealed in 2030. The statute says that "nothing in this part 17 creates a new private right of action." Existing rights, such as anti-discrimination law, remain.

Rulemaking is happening now

The AG's office filed draft rules on August 11, 2026. Written comments are accepted through October 26, 2026, and the public hearing is that day at 10:00 a.m. at 1300 Broadway in Denver. Rules must be adopted by January 1, 2027. If your business depends on automated decisions, the details will be in those rules. Follow them at coag.gov/ai.

A plan for the next twelve weeks

1. Inventory. List every place software scores, ranks, filters or recommends people: hiring platforms, tenant screening, lending and insurance quotes, patient scheduling and triage.
2. Ask your vendors for the developer documentation the law requires. If they can't describe intended uses and limitations, that is a finding in itself.
3. Draft your notices and the 30-day adverse-outcome explanation, with a named person responsible for sending them.
4. Design human review: who reviews, how quickly, and what record is kept.
5. Set up records you can keep for three years.
6. Prefer systems you can explain. A tool that can't tell you why it ranked someone low makes the 30-day explanation very hard to write.

Where we fit

We build AI systems for Colorado businesses with the pieces this law asks for designed in: decision logs, plain-language explanations, human-review queues and records you control. For regulated work we often run models privately; see on-premise vs cloud AI for regulated businesses. If a breach is your more immediate worry, see Colorado's 30-day breach notification clock.

Frequently asked questions

Is the Colorado AI Act in effect right now? The reenacted law, SB 26-189, takes effect January 1, 2027 and applies to decisions made on or after that date. The 2024 text is still printed as effective until then, and its enforcement has been contested, so ask your attorney about the interim.

Does it apply to a small business? The new law has no headcount exemption. If you use automated decision-making technology for consequential decisions about Colorado consumers, including your own employees and applicants, it applies.

Can people sue us under it? The law creates no new private right of action. The Attorney General enforces it, and existing laws such as anti-discrimination statutes still apply on their own terms.

This article summarizes SB 26-189 (2026 Colo. Sess. Laws, ch. 131) and statements on the Colorado Attorney General's website as of October 9, 2026. It is not legal advice.

Want help mapping where AI touches decisions in your business? Talk to us.