Colorado’s landmark AI law — the one thousands of businesses spent months preparing for — was effectively replaced in May 2026, and the June 30 compliance deadline that had the enterprise world scrambling is now off the table. Governor Jared Polis signed SB 26-189 on May 14, 2026, gutting the original Colorado AI Act’s sweeping risk-management framework and pushing any real enforcement to January 1, 2027, at the earliest.
The original SB 24-205 would have required companies deploying “high-risk” AI in areas like employment, lending, and healthcare to run annual impact assessments, build full risk-management programs, and prove their systems didn’t discriminate. The replacement law strips all of that out. What’s left is a notice-and-transparency model: tell users when AI is making decisions about them, and give them a way to appeal.
Even that scaled-back version has an asterisk. Colorado’s Attorney General has said publicly he does not intend to enforce any successor legislation — including the new SB 26-189 — until his office completes rulemaking. That rulemaking process must finish by January 1, 2027. In practice, companies have more than six months of breathing room.
What the New Colorado AI Law Actually Requires
The original law’s three big mandates — risk management programs, annual impact assessments, and a duty to avoid algorithmic discrimination — are gone. What SB 26-189 requires instead:
- Consumer notice before any AI-assisted decision in covered domains
- Adverse-decision disclosure with clear explanation and appeal rights
- Developer documentation — companies building high-risk AI tools must provide transparency about how their systems work
The definition of covered AI has also shifted. SB 26-189 uses a broader definition of “automated decision-making technology” (ADMT) — which may actually capture tools that weren’t covered under the original law’s “AI system” framing. Compliance teams should re-audit their tech stacks against the new definition, not assume a clean bill of health.
Why Colorado Blinked
The original Colorado AI Act was the most aggressive state AI law in the US when Governor Polis signed it in May 2024. By 2026, the political calculus had shifted. The federal Great American AI Act, released as a discussion draft on June 4, includes a three-year preemption clause that would block state AI laws “specifically regulating the development” of an AI model. Colorado didn’t want to invest enforcement infrastructure in a framework that could be federally wiped out in months.
Tech industry lobbying also played a role. Groups representing major AI companies pushed hard against the original law’s assessment requirements, arguing they created compliance costs that disproportionately hit smaller AI developers. The IT Industry Council praised the revised draft.
Meanwhile, the Trump AI executive order from earlier this year had already signaled that the federal government would push back on state-level AI regulation. Colorado reading the room and pulling back isn’t surprising — it’s a pattern.
What Businesses Should Do Now
Don’t treat this as a free pass. The January 2027 timeline is firm, rulemaking will happen, and the AG’s enforcement restraint is discretionary — not a legal guarantee. Three actions matter now:
First, map every AI or automated decision-making tool you use in employment, lending, housing, healthcare, insurance, education, and government-service contexts. This step is foundational regardless of which version of the law governs, and the ADMT definition in SB 26-189 is broader than the original.
Second, build the consumer notice and adverse-decision disclosure infrastructure. These requirements survived the revision. If your system makes a consequential decision about someone, you need to be able to tell them and give them a path to challenge it.
Third, watch the federal picture. If the Great American AI Act passes with its preemption clause, state compliance programs — including Colorado’s — may need another overhaul. Build flexible, not monolithic.
The Bigger Picture: AI Regulation Is a Moving Target
Colorado’s reversal is a preview of what’s coming nationally. The EU AI Act is already in force. The US federal framework is a discussion draft. State laws keep mutating. Any company deploying AI in 2026 that thinks the compliance picture is settled is not paying attention.
The Great American AI Act could simplify this by setting a single national standard — or it could create a different kind of complexity if it passes with weaker requirements than states like Colorado wanted. Either way, the next 12 months will define what AI compliance actually looks like in the US for the decade ahead.
FAQ: Colorado AI Act 2026
Is the Colorado AI Act still in effect?
The original SB 24-205 has been replaced by SB 26-189, signed May 14, 2026. The June 30, 2026 deadline no longer applies. The new law takes effect January 1, 2027, pending rulemaking by the Colorado Attorney General.
What does the new Colorado AI law require?
SB 26-189 requires consumer notice before AI-assisted decisions, adverse-decision disclosure with appeal rights, and developer documentation requirements. The original law’s risk management programs and annual impact assessments have been removed.
Does the Great American AI Act affect Colorado’s law?
Potentially. The federal discussion draft includes a three-year preemption clause that could override state AI laws. If it passes in its current form, it could supersede SB 26-189 before Colorado’s law takes full effect.
Which industries are covered by the new Colorado AI law?
The law covers AI used in employment decisions, lending, housing, healthcare, insurance, education, and government services. The new ADMT definition may be broader than the original, so businesses should re-audit their AI tool usage against the updated language.
When will the Colorado AG start enforcing the new AI law?
The Attorney General has stated he will not enforce any version of the law until the rulemaking process is complete — a deadline set for January 1, 2027. Enforcement could begin after that date once implementing rules are finalized.
Last Updated: June 2026
