AI governance in Denver

Colorado wrote the first comprehensive US state AI law and then unwound it. SB 24-205 was delayed, challenged in federal court, stayed, and finally repealed and reenacted in substantially narrowed form as SB 26-189. The first-in-nation act was repealed and replaced before it ever took effect. The narrower disclosure regime is what takes effect on January 1, 2027, and nothing in it is operative until then.

SB 25B-004, signed August 28, 2025, had moved an earlier effective date from February 1 to June 30, 2026. The date on SB 26-189 is the one that now governs. A Denver organization paying for a 2024-shaped program is paying for a statute that never became operative.

HIPAA-covered entities are exempt outside the employment context. So are FDA-regulated medical devices and pharmaceutical R&D. Creditors complying with ECOA, Regulation B, and the FCRA are exempt. FERPA-covered education deployers are exempt. Sector safe harbors apply to insurance, health care, financial services, and education. For many regulated organizations these exemptions do most of the work.

A Denver health system should test the employment carve-out rather than treat every tool as outside the statute, and it should test that carve-out against the effective date rather than against today. A lender in compliance with ECOA, Regulation B, and the FCRA should confirm that compliance rather than treat the charter as the answer. An exemption from this statute is not a finding that contracts and sector frameworks fall silent.

Developers must give deployers technical documentation covering intended uses, categories of training data, known limitations, and instructions for appropriate use and human review, and they must give notice of material updates. Retention of that documentation is three years. Deployers must give notice at the point of interaction, explain an adverse outcome in plain language within 30 days, honor a request to correct inaccurate personal data, and offer meaningful human review and reconsideration. Deployer records are retained for three years. Those deployer duties arrive with the effective date. They are not duties anyone in Denver owes under this statute today.

The first product is an inventory of what is running, a note on what already sits inside a certification boundary, a reading of the contracts that mention AI, and a gap list against ISO/IEC 42001 and the NIST AI Risk Management Framework. That is the governance readiness assessment. The people taking the inventory sit with the teams who operate the systems, where the systems are used. The AI Academy readiness assessment is free. It is a diagnostic and a scorecard, and it is not that inventory.

TrustEdge is a HITRUST Authorized External Assessor, which is the credential for assessing another organization. The credential is not a HITRUST certification of TrustEdge, and it is not a HITRUST certification of the organization assessed.