Colorado SB 26-189 explained: what replaced the Colorado AI Act

A short history

In 2024 Colorado passed SB 24-205, a landmark state AI statute known as the Colorado AI Act. It was built around a duty of care, supported by a risk-management program and annual impact assessments.

That version never applied. On 14 May 2026 the governor signed SB 26-189 (2026 Session Laws, chapter 131), which repealed and re-enacted the statute as the Colorado Automated Decision-Making Technology Act. The core obligations of the new Act apply from 1 January 2027.

If your organization built a plan around SB 24-205, the scoping work still holds. The list of deliverables has changed.

What was dropped, and what replaced it

In their place, SB 26-189 sets transparency duties: notice to consumers, a plain-language explanation of adverse decisions within 30 days, access, correction and human review on request, and three years of record-keeping. Enforcement is by the Attorney General only.

The new Act regulates automated decision-making technology (ADMT) used in consequential decisions, and it does so through what people are told and what they can ask for.

Who is covered

The Act applies to developers and deployers of ADMT that materially influences consequential decisions about Colorado consumers.

Consequential decisions are decisions in:

• education
• employment
• housing
• lending
• insurance
• health care
• essential government services

Two phrases do most of the scoping work. Materially influences means the technology does not have to make the final decision; a score or ranking that a person relies on can be enough. Colorado consumers means the test is where the affected person is, not where your company is.

A deployer is the organization that uses the tool to make or support decisions. A developer is the one that builds it. A company can be both.

What deployers must do

From 1 January 2027, a deployer of covered ADMT has four duties.

1. 01Notice. Give consumers clear notice when they interact with covered ADMT.
2. 02Explanation. Within 30 days of an adverse consequential decision, provide a plain-language explanation of the tool's role in it.
3. 03Requests. Honor consumer requests to access and correct their data, and to obtain meaningful human review.
4. 04Records. Keep records for three years.

Each of these is an operational process, not a document. Someone has to send the notice at the right moment, someone has to produce the explanation within 30 days, and someone with authority has to carry out the human review.

What developers must do

Developers must give deployers technical documentation: the intended uses of the technology, the categories of training data, its known limitations and guidance on human review. They must also notify deployers of material updates.

If you buy decision tools, this is useful to you now. Ask each vendor when their SB 26-189 documentation will be available. You will need it to write accurate notices and explanations, and a vendor that cannot describe its tool's limitations is telling you something.

Enforcement and the cure period

The Act is enforced exclusively by the Colorado Attorney General, as a deceptive trade practice. There is no private right of action, so consumers cannot sue under it directly.

Until 1 January 2030 there is a 60-day cure period: an organization notified of a violation has 60 days to fix it. That softens the first years of enforcement. It does not remove the obligations, and it expires.

The federal question

State AI laws are under pressure from Washington. Executive Order 14365, signed on 11 December 2025, directs a Department of Justice AI Litigation Task Force to challenge state AI laws and calls for federal preemption legislation.

Colorado is the first test. In xAI v. Weiser, in the US District Court for the District of Colorado, the Department of Justice intervened on 24 April 2026 under that order.

Two points keep this in proportion. First, an executive order cannot itself preempt state law; state AI laws remain enforceable unless a court or Congress says otherwise. Second, no ruling has changed the 1 January 2027 date. The sensible course is to prepare for the Act as written and watch the case.

How to prepare before 1 January 2027

Identify covered systems. List every tool that scores, ranks, recommends or decides in the seven areas above, and note whether it affects people in Colorado. Include features inside larger products, such as a screening module inside an applicant-tracking system. Include tools adopted informally: a recruiter using a general AI assistant to shortlist candidates is using ADMT in an employment decision.

Determine your role for each. Deployer, developer or both.

Collect vendor documentation. Intended uses, training-data categories, limitations and human-review guidance.

Draft the notices. A pre-use notice, a statement of the consumer's rights, and a template for the adverse-decision explanation. Write them in plain language and have counsel review them.

Design the request process. Decide where requests arrive, who handles access and correction, and who performs human review. The reviewer needs the authority and the information to change the outcome.

Set up record-keeping. Three years of records of notices, explanations, requests and reviews.

Check the overlap with California. California's CCPA regulations on automated decision-making require a pre-use notice, an opt-out and access rights for significant decisions, also from 1 January 2027. If you have consumers in both states, build one process that satisfies both.

How GhostAudit helps

GhostAudit finds the AI tools in use and keeps them in an inventory with their purpose and owner. Systems recorded as used in employment or consequential decisions are matched to SB 26-189 in the regulation tracker, with the reason shown, and tools merely used by an HR or lending team are flagged for someone to confirm.

The consumer automated-decision disclosure template generates a pre-use notice, a rights statement and an adverse-outcome letter for a system, with a compliance checklist, from the facts in its inventory record. It is a draft for counsel to review. GhostAudit does not run your consumer-request process; it documents the systems and notices that process depends on. More on the Colorado page.