Colorado AI Regulations
Colorado wrote the first comprehensive US state AI law and then unwound it. SB 24-205 was delayed, challenged in federal court, stayed, and finally repealed and reenacted in substantially narrowed form as SB 26-189, enacted May 14, 2026 and effective January 1, 2027. The duty of reasonable care, algorithmic impact assessments, and the NIST AI RMF rebuttable presumption are removed on that effective date, not before. Plan as if the presumption will not be available after that date. What remains is a disclosure and human-review framework taking effect January 1, 2027. There is no operative Colorado AI compliance obligation today.
Last reviewed against primary sources: . AI legislation is moving quickly — statutes have been delayed, repealed and replaced mid-cycle. Verify against the linked primary sources before relying on any date here.
Where we work in Colorado
TrustEdge serves organizations across Colorado, including these markets.
In-Depth Analysis
Colorado is the clearest example in the country of why a compliance calendar built on announcements rather than primary sources will mislead you.
The 2024 Act was genuinely landmark, and a great deal of consulting was sold against it. It never took effect. It was delayed once by SB 25B-004, challenged by xAI in federal court with the Department of Justice intervening on xAI's side, stayed by the court in April 2026, and then repealed and reenacted in narrowed form three weeks later.
What the replacement keeps is meaningfully smaller. The obligations that made the 2024 law demanding — the duty of reasonable care, impact assessments, risk-management programs, and the NIST AI RMF rebuttable presumption — are removed when SB 26-189 takes effect on January 1, 2027. It was enacted May 14, 2026. Plan as if the presumption will not be available after that date. What replaces them is a disclosure regime: tell people when ADMT materially influenced a consequential decision about them, explain adverse outcomes within 30 days, let them correct inaccurate data, and give them a human to appeal to.
For regulated organizations the exemptions matter more than the obligations. If you are a HIPAA-covered entity and the use is not employment-related, you are outside it. Same for FDA-regulated devices, ECOA/FCRA-compliant lending, and FERPA-covered education.
One caution against relief: the work does not disappear, it relocates. Impact assessments are still required under the EU AI Act for in-scope systems, still expected under ISO/IEC 42001, and still the practical way to answer an Illinois disparate-impact question. Colorado stopped requiring them. Your other obligations did not.
Practical Implications for SMBs & Healthcare
If someone is selling you Colorado AI Act compliance today, ask which statute they mean. There is no operative Colorado AI obligation as of August 2026, and the replacement law is both narrower than its predecessor and stayed pending federal litigation.
The realistic planning assumption is January 1, 2027 at the earliest, contingent on Attorney General rulemaking concluding and the court lifting the stay. Build toward disclosure, adverse-outcome explanation, and human reconsideration — not toward the 2024 Act's risk-management architecture.
Check your exemption status first. For many healthcare and financial services organizations, the answer is that most deployments fall outside the statute entirely.
Key Provisions
What the repeal removes on January 1, 2027 — and why it matters if you prepared for it
SB 26-189, enacted May 14, 2026 and effective January 1, 2027, removes the four obligations that defined the 2024 Act: the developer and deployer duty of reasonable care against algorithmic discrimination, mandatory algorithmic impact assessments, the risk-management-program mandate, and the rebuttable presumption of compliance for organizations following the NIST AI RMF. Organizations that built a Colorado compliance program against the 2024 statute built it against requirements that drop out on that date. That work is not wasted — it maps cleanly onto other regimes — but it will not be Colorado-mandated after January 1, 2027. Plan as if the presumption will not be available after that date.
Covered ADMT and consequential decisions
The replacement law reaches "covered automated decision-making technology" that materially influences a consequential decision in education, employment, housing, financial or lending services, insurance, health care services, or essential government services and public benefits. The framing moved from regulating a category of system ("high-risk AI") to regulating a category of use.
Developer documentation duties
Developers must give deployers technical documentation covering intended uses, categories of training data, known limitations, and instructions for appropriate use and human review, and must give notice of material updates. Three-year record retention.
Deployer notice, explanation, and human review
Deployers must give point-of-interaction notice to consumers, provide a plain-language explanation of an adverse outcome within 30 days, honor a consumer right to request correction of inaccurate personal data, and offer meaningful human review and reconsideration. Three-year record retention.
Exemptions and sector safe harbors
HIPAA-covered entities are exempt outside the employment context, as are FDA-regulated medical devices and pharmaceutical R&D, creditors complying with ECOA, Regulation B and FCRA, and FERPA-covered education deployers. Sector safe harbors apply to insurance, health care, financial services, and education. For many regulated organizations these exemptions do most of the work.
ADMT rulemaking now has a published schedule
The Colorado Department of Law — the Attorney General's office, not the Department of Labor — filed draft Automated Decision-Making Technology and Conversational Artificial Intelligence Services rules on August 11, 2026. Written comments submitted by September 4, 2026 were to be considered in a revised draft circulated no later than September 23, 2026, and the formal comment window runs from August 11 through October 26, 2026, extending to the final day of the rulemaking hearing if that hearing continues past that date. The statutory effective date is unchanged at January 1, 2027. This is the document to read if you want to know what compliance will actually require, because the statute leaves the operative detail to these rules.
Litigation posture — enforcement is stayed
On April 9, 2026 xAI sued the Attorney General in the US District Court for the District of Colorado (No. 1:26-cv-01515), raising First Amendment, dormant Commerce Clause, and vagueness challenges. The Department of Justice intervened on April 24, 2026, reported as the first federal attempt to invalidate a state AI law. On April 27, 2026 the court stayed enforcement on a joint motion, barring enforcement until 14 days after it rules on a forthcoming preliminary injunction motion. By its terms the stay also reaches the replacement statute.
Bills & Statutes
Automated Decision-Making Technology — repeals and reenacts the Colorado AI Act
Signed May 14, 2026; effective January 1, 2027
Read the primary source(opens in a new tab)Colorado Artificial Intelligence Act
Signed May 17, 2024; never took effect; repealed and reenacted by SB 26-189
Read the primary source(opens in a new tab)Delay of the Colorado Artificial Intelligence Act
Signed August 28, 2025; moved the effective date from February 1 to June 30, 2026
Read the primary source(opens in a new tab)Applicability & Enforcement
Who It Applies To
From January 1, 2027, developers and deployers of covered ADMT that materially influences a consequential decision affecting Colorado consumers — subject to broad exemptions for HIPAA-covered entities outside employment, FDA-regulated devices, ECOA/FCRA-compliant creditors, and FERPA-covered education deployers. No obligations apply today.
Enforcement
Colorado Attorney General, exclusive. Violations are treated as deceptive trade practices under the Colorado Consumer Protection Act. The Attorney General must give 60 days' notice and an opportunity to cure before enforcing — a right that sunsets January 1, 2030 — and has stated he will not enforce until rulemaking concludes. Annual enforcement reports begin January 2028. No private right of action; the statute expressly creates none.
Penalties
Deceptive trade practice penalties under the Colorado Consumer Protection Act, following the mandatory 60-day cure period. Note that enforcement is currently stayed by federal court order.
Recommended Compliance Actions
Steps organizations should consider to prepare for and comply with Colorado's AI regulations.
- 1
Determine your exemption status before doing anything else. HIPAA-covered entities outside employment, FDA-regulated devices, ECOA/Regulation B/FCRA-compliant creditors, and FERPA-covered education deployers are exempt, and sector safe harbors cover insurance, health care, financial services, and education.
- 2
Retire any Colorado compliance program built against the 2024 Act's duty of care and impact-assessment requirements. Redirect that work toward regimes that still require it rather than discarding it.
- 3
Inventory which systems materially influence a consequential decision in the seven covered domains. This is the scoping question the replacement statute actually asks.
- 4
Build the capability to explain an adverse automated outcome in plain language within 30 days, and to route a consumer to meaningful human reconsideration. These are the two operationally demanding duties in the new law.
- 5
Set three-year retention for developer documentation and deployer records.
- 6
Track the Attorney General's rulemaking and the xAI litigation. The effective date is contingent on both; do not commit budget to a date that two separate processes can still move.
Related TrustEdge Services
As of September 14, 2026. We are not lawyers and this is not legal advice. It is the responsibility of consumers of this data that they verify the applicability and current ratified statutes and legal precedence with a qualified attorney licensed in the state or country they are researching.
Need Help with AI Compliance?
Our team helps organizations build compliance-first AI systems that meet current and emerging regulatory requirements.