Colorado AI Law Explained From the Statute (SB 24-205 and SB 26-189)

Short answer: the Colorado AI law, Senate Bill (SB) 24-205, never took effect. In May 2026 lawmakers repealed it and passed a new law, Senate Bill 26-189. The new law covers software that helps decide who gets a job, a loan, a home, insurance, care, a school place or a public benefit. It starts January 1, 2027. Only the state attorney general (the AG) can enforce it, and the rules are still being written. Skip the old impact-assessment program. Build notices, 30-day letters and vendor document requests. This is not legal advice. Ask a lawyer whether it applies to you.

TL;DR

• Status on October 5, 2026: the old Act was replaced before it applied to anyone. New duties start January 1, 2027.
• Who: developers who build covered tools and deployers (businesses that use them) doing business in Colorado.
• What: developers share documents. Deployers give notice, explain bad outcomes within 30 days, and offer fixes and human review.
• Enforcement: the state AG only. The statute creates no new private right of action, meaning no new right for individuals to sue under it.
• Still moving: draft rules are open for comment through October 26, 2026, and may change. A federal lawsuit is paused. Re-check before you finalize notices.

Why the old Colorado AI law name still confuses people

Most guides still describe SB 24-205, signed in 2024 with duties set for February 1, 2026. A special session bill moved that to June 30, 2026. Then SB 26-189 arrived. The AG's own page says it "repeals and reenacts" the 2024 provisions.

Both laws sit in one place in the Colorado Revised Statutes (C.R.S.), the state's official set of laws: Title 6, article 1, part 17, from section 6-1-1701. Repeal and re-enact means the old text came out and new text took its slot. The numbers look the same, but the content changed. For how bills land there, see what a session law is.

The dates, in order

• May 17, 2024: SB 24-205 signed. Duties were set for February 1, 2026.
• August 28, 2025: SB 25B-004 signed. New start date: June 30, 2026.
• April 27, 2026: in X.AI LLC v. Weiser (federal case 1:26-cv-01515, filed April 9), a judge ordered that the state "shall not initiate enforcement" of "SB24-205 (or any legislation replacing or amending SB24-205 enacted during this legislative session)."
• What that means: the pause lasts until 14 days after the court rules on an injunction request (a court order to stop enforcement). The order calls that request "forthcoming." X.AI has 28 days after the AG's rules are final to file it.
• The catch: on its face, the wording reaches SB 26-189. Check the court record (the docket) before you plan around it.
• May 14, 2026: SB 26-189 signed (Laws of 2026, chapter 131).
• August 11, 2026: the AG filed proposed rules. Comments are open through October 26, 2026.
• January 1, 2027: new duties start. The act "applies to consequential decisions made on or after January 1, 2027."

What the law is

Say a business in Colorado uses software that scores or ranks people, and the output shapes a decision in one of seven listed areas. The business must tell the person. It must explain a bad outcome and let the person fix wrong data. It must offer a human review. The company that built the software must give its customers the right documents. The 2024 version also required impact assessments, which are written risk reviews. The 2026 version dropped them.

Example: a Denver employer ranks resumes with a tool. It tells applicants first. If one is rejected, the employer explains within 30 days. The applicant can ask for a data fix and a human review.

Who it applies to

The statute calls the technology "automated decision-making technology," or ADMT. In plain terms, it is software that scores or ranks people. Under section 6-1-1701(2)(a), it is technology that "processes personal data and uses computation to generate output," like predictions, rankings and scores. That output must be "used to make, guide, or assist a decision."

The law bites only when the tool is "used to materially influence a consequential decision." That is section 6-1-1701(5). Section 6-1-1701(13) says an output does this when it "affects the outcome" and is "a non-de minimis factor," meaning more than a trivial one. A consequential decision is about a person's access to a "covered domain." Section 6-1-1701(6) lists seven. They are education, employment, buying or leasing a home in Colorado, financial services, insurance, health care, and essential government services.

A developer builds, sells or licenses a covered tool, or builds a part made to go inside one. A deployer uses one. Both must do business in Colorado. A "consumer" includes an employee and a job applicant who lives there. No exemption turns on company size.

The 2024 law used other words. It covered a "high-risk artificial intelligence system," meaning one that "makes, or is a substantial factor in making, a consequential decision." That phrase is gone now.

What each side must do

Human review has a set meaning in section 6-1-1701(15). The reviewer must have power to "approve, modify, or override" the decision. The reviewer must be trained and must not "default to the system output."

What counts as discrimination now

The 2024 text defined "algorithmic discrimination" and required "reasonable care" to avoid it. The 2026 act never uses that phrase. It leans on laws already in place. Section 6-1-1707 says a developer or deployer "may be held liable" under the state Anti-Discrimination Act. Blame is split by "relative fault," meaning each side answers for its own share. A contract clause that pushes your own liability onto the other side is "contrary to public policy and void," meaning a court will not enforce it. And using the tool "does not excuse, justify, or provide a defense" to other legal duties.

What it does not cover

• Basic tools such as calculators, spell-check, firewalls, databases, and spreadsheets that need human analysis. Source: section 6-1-1701(2)(b).
• Tools used "solely to summarize, organize, translate, draft, route, or present information" for people to review.
• Advertising, search, content moderation, scheduling and customer service triage. Source: section 6-1-1701(3)(b).
• Chat tools not marketed or set up for consequential decisions, if a written use policy (rules on how customers may use the tool) bars that use.
• Health plans and providers under the federal health privacy law (HIPAA), except for hiring decisions and some notices.
• Devices overseen by the Food and Drug Administration.
• Insurers already under state insurance rules. Source for these three: section 6-1-1708.
• Trade secrets. A business that withholds information must tell the consumer.

Who enforces it

The AG enforces the law under the state Consumer Protection Act. Under section 6-1-1706, a violation is a "deceptive trade practice," which is conduct the state treats as unfair or misleading to consumers. If a cure is "deemed possible," the AG sends a notice first, and the business has 60 days to fix the problem. A knowing or repeated violation gets no cure period. The cure period ends January 1, 2030.

On private lawsuits the text is direct: "Nothing in this part 17 creates a new private right of action." That is section 6-1-1706(4). Rights people already have, such as under the Anti-Discrimination Act, stay. Part 17 lists no penalty amounts. Look to the Consumer Protection Act.

What a business should check

1. List every tool that scores or ranks people in hiring, lending, housing, insurance, health care, school or benefits decisions.
2. For each, ask if its output really affects the outcome.
3. Ask each vendor for the documents section 6-1-1702 lists. Put a due date in the contract.
4. Draft the notice and the 30-day letter. Name a person who can override a decision.
5. Check contracts that shift blame. Section 6-1-1707 voids some of them.
6. Read the final AG rules once adopted, and watch the docket. Terms like "materially influence" are still being pinned down.

What goes wrong

The top mistake is building impact assessments from a pre-May 2026 article. The law no longer asks for them. The next is the reverse: thinking nothing applies. Notices and 30-day letters are real work. Last, do not take a vendor's word that it is "compliant." Ask for the documents.

This guide is part of US Law Data: The Complete Guide, a map of where US law comes from and how to use it.

FAQ

Is the Colorado AI Act in effect? No. SB 24-205 was repealed and replaced before its duties applied. The new law, SB 26-189, starts January 1, 2027.

What is the Colorado AI Act effective date? January 1, 2027, for decisions made on or after that day. Older articles list February 1, 2026 or June 30, 2026. Those dates belong to the repealed law.

Does my business have to be in Colorado? The duties fall on a "person doing business in Colorado." The statute also counts a job applicant who lives there as a consumer. Ask your lawyer if your business qualifies.

Do I need an impact assessment? Not under the current text. The 2024 law required one. The 2026 law does not.

Can someone sue me directly under it? The statute says it creates no new private right of action. Claims people already have, such as bias claims, remain.

Is a general chatbot covered? Only if it helps decide something in one of the seven areas. House Bill 26-1263, a separate chatbot law the AG's page says is signed, also amends part 17.

Where do I read the official text? The General Assembly's page for SB 26-189 has the signed act. The AG's page tracks the rules, and SB 24-205 shows the original. To cite Colorado statutes correctly, see how to find and cite Colorado law. For how statutes and the rules built on them differ, see what a regulation is.

If you build or buy tools that need the statute text and its amendment history behind guides like this, start with the US primary law API.

Priyansh Khodiyar

Co-Founder & CTO

Priyansh leads engineering and AI at Vaquill AI: the pipelines that pull statutes, regulations and court rules from every US jurisdiction's official publisher, and the REST API, MCP server and open dataset that serve them.