Last reviewed: September 24, 2026. Explainer, not legal advice.
The short version: the original Colorado AI Act (SB 24-205) never took effect. It was blocked in federal court in April 2026 and then repealed. Its replacement, SB 26-189, was signed on May 14, 2026 and takes effect on January 1, 2027. The new law drops the EU-style “high-risk AI” model in favor of notice, explanation and human-review rights for automated decisions.
What happened
- 2024: Colorado enacted SB 24-205, the first broad US state law on “high-risk” AI and algorithmic discrimination. Its start date was later pushed to June 30, 2026.
- April 24, 2026: the US Department of Justice intervened in a lawsuit brought by xAI in the US District Court for the District of Colorado, citing the December 2025 executive order directing challenges to state AI laws (EO 14365).
- April 27, 2026: the court entered a stipulated order barring enforcement of SB 24-205 while preliminary-injunction motions were pending. The claims included First Amendment compelled speech and Equal Protection.
- May 14, 2026: Governor Polis signed SB 26-189, which repeals SB 24-205 and replaces it.
Who the new law covers
SB 26-189 applies to developers and deployers of automated decision-making technology (ADMT), meaning technology that processes personal data and produces outputs such as predictions or scores, when it is used in consequential decisions about people in employment, education, housing, financial services, insurance, health care and government services. Scheduling, administrative routing and fraud prevention are excluded, as are internal R&D tools, tools that only organize information for a human to review, and conversational tools not used for consequential decisions.
What it requires
- Developers must give deployers documentation covering intended uses, known risks and limitations, and the categories of training data, notify them of material updates, and keep records for three years.
- Deployers must give people notice before ADMT is used in a consequential decision, and a way to get more information.
- After an adverse decision, deployers must provide within 30 days a plain-language explanation of the decision and the role the ADMT played.
- Consumer rights: to request meaningful human review and reconsideration, and to correct inaccurate personal data.
- Accessibility: notices must work for people with disabilities and limited English proficiency.
How it is enforced
The Colorado Attorney General has exclusive enforcement authority and must adopt implementing rules by January 1, 2027. There is a 60-day right to cure, which is not available for knowing or repeated violations, and the cure period sunsets on January 1, 2030.
Why it matters
Colorado was the template other states were copying. Its retreat, after federal pressure, from the risk-assessment and impact-assessment model toward a transparency-and-appeal model is a signal about where US state AI law is heading in 2026. For companies, the practical work is similar either way: know where automated tools touch hiring, lending, housing, insurance or health decisions, and be able to explain an adverse outcome and offer a human review within 30 days.
What to watch next
- The Attorney General’s draft rules, due before January 1, 2027.
- Whether the xAI/DOJ case continues against the new law or is dropped as moot.
- Whether other states with SB 24-205-style bills follow Colorado’s pivot.