Colorado replaced its AI Act. The new duties start 1 January 2027.
SB 26-189, signed on 14 May 2026, repealed and re-enacted the 2024 Colorado AI Act. The duty of care and annual impact assessments are gone. In their place are transparency duties for automated decision-making technology used in consequential decisions.
- UpcomingADMT point-of-interaction notice
Clear and conspicuous notice before covered ADMT materially influences a consequential decision; a prominent public notice at the point of interaction is sufficient.
- UpcomingPost-adverse-outcome disclosure (30 days)
Within 30 days of an adverse outcome: plain-language description of the decision and the ADMT's role, how to request more information, and the consumer's rights.
- UpcomingCorrection and meaningful human review
On request after an adverse outcome: instructions to obtain and correct personal data, and meaningful human review and reconsideration to the extent commercially reasonable.
- UpcomingThree-year record keeping
Keep records reasonably necessary to demonstrate compliance for at least three years after each consequential decision.
- Signed
- 14 May 2026
- Core obligations apply
- 1 January 2027
- Enforced by
- Colorado Attorney General
- Right to cure
- 60 days, until 1 January 2030
If you prepared for SB 24-205, your plan needs revisiting.
The 2024 Colorado AI Act, SB 24-205, was built around a duty of care, backed by a risk-management program and annual impact assessments. It never took effect in that form.
SB 26-189 (2026 Session Laws, chapter 131) repealed and re-enacted it. The new statute, the Colorado Automated Decision-Making Technology Act, drops the duty of care, the annual impact assessments and the risk-management program. What it requires instead is transparency toward the people affected by automated decisions.
The work you did to find and describe your decision systems carries over. The deliverables are different: notices, explanations and a process for human review, in place of a risk program and assessments.
Who is covered, and for which decisions.
The Act applies to developers and deployers of automated decision-making technology (ADMT) that materially influences consequential decisions about Colorado consumers.
Consequential decisions are those in education, employment, housing, lending, insurance, health care and essential government services.
So the first task is to identify which of your systems influence decisions of that kind about people in Colorado. In GhostAudit, systems in your inventory that are marked as used in employment or in consequential decisions are matched to SB 26-189 automatically, with the reason shown. Tools that are merely used by an HR or lending team, without a recorded decision-making use, appear as potential matches for someone to confirm.
Example workspace. Names and figures are illustrative.
| System | Owner | Risk tier | Status | |
|---|---|---|---|---|
Candidate screening HireVue | People operations | Restricted | High | Sanctioned |
ChatGPT Enterprise OpenAI | IT | Confidential | Limited | Sanctioned |
Support assistant Intercom | Customer support | Confidential | Limited | Sanctioned |
Claude Anthropic | Engineering | Internal | Limited | Under review |
Cursor Anysphere | Unassigned | Confidential | Limited | Unsanctioned |
Grammarly Grammarly | Marketing | Internal | Minimal | Sanctioned |
Four things a deployer must be able to do.
From 1 January 2027, a deployer of covered ADMT must:
- 01Give notice. Tell consumers clearly when they are interacting with covered ADMT.
- 02Explain adverse decisions. Within 30 days of an adverse consequential decision, provide a plain-language explanation of the tool's role.
- 03Honor requests. Let consumers access and correct their data, and give them meaningful human review.
- 04Keep records for three years.
Developers have their own duty: to give deployers technical documentation covering intended uses, categories of training data, known limitations and guidance on human review, and to notify them of material updates. If you buy a decision tool, that documentation is what you should be asking your vendor for now.
- Consumer notice before or at the point of interaction
- Explanation within 30 days of an adverse decision
- Access, correction and human review on request
- Three years of records
- Algorithmic impact assessmentRisk and impact · one systemPer-system assessment of impacts on individuals and groups: fairness, privacy, transparency, oversight, safety; applicability screening (FRIA, DPIA, ADMT laws) and mitigation plan.Basis: EU AI Act Art. 27; GDPR Art. 35; ISO/IEC 42001 6.1.4, A.5; NIST AI RMF MAP 5; Colorado SB 26-189; CCPA ADMT
- Third-party AI vendor assessmentThird-party risk · one systemDue-diligence assessment of an AI vendor across all its services in use: criticality, evidence requests, contract clauses and monitoring.Basis: ISO/IEC 42001 A.10; NIST AI RMF GOVERN 6, MANAGE 3; EU AI Act Art. 26
- Consumer automated-decision disclosureTransparency and disclosure · one systemConsumer pre-use notice, rights statement and adverse-outcome letter for an AI system supporting consequential decisions, with a compliance checklist.Basis: Colorado SB 26-189 (eff. 1 Jan 2027); California CCPA ADMT regulations; GDPR Art. 22
From a list of systems to notices on file.
GhostAudit supports the Colorado work in three steps.
Find the systems. Discovery and the inventory establish which tools influence consequential decisions, who owns them and which vendor supplies them.
Draft the disclosures. The consumer automated-decision disclosure template produces, for one system, a pre-use notice, a statement of consumer rights and an adverse-outcome letter, with a compliance checklist. It draws the system's purpose, data and oversight from the inventory record. Counsel should review the wording before it is used.
Keep the record. Documents go through review and approval and are versioned. The audit log records who decided what and when, which supports the Act's record-keeping requirement. GhostAudit does not operate your consumer-request process; it documents the systems and the notices that process relies on.
Example workspace. Names and figures are illustrative.
The system ranks applicants for customer-support roles against the posted job requirements. A recruiter reviews every ranked list before any candidate is contacted; no application is rejected without human review.
Attorney General only, with a cure period, and a lawsuit to watch.
The Act is enforced exclusively by the Colorado Attorney General as a deceptive trade practice. There is no private right of action. Until 1 January 2030, a 60-day cure period applies.
There is litigation to follow. In xAI v. Weiser in the District of Colorado, the US Department of Justice intervened on 24 April 2026 under Executive Order 14365, which directs a federal task force to challenge state AI laws. An executive order cannot itself preempt state law, and the Act remains enforceable unless a court or Congress says otherwise. GhostAudit's regulation tracker follows the case as a watch item.
California's automated decision-making regulations under the CCPA follow a similar pattern, with pre-use notice, opt-out and access rights for significant decisions from 1 January 2027. Organizations with consumers in both states can prepare for both together.
Read the official texts
- Colorado ADMT Act: official textleg.colorado.gov
- SB 26-189 signed act (PDF)leg.colorado.gov
- Colorado Attorney General: AI rulemakingcoag.gov
- Davis Wright Tremaine: Colorado AI Act repeal and new transparency lawdwt.com
- Epstein Becker Green: SB 26-189 implications for employersebglaw.com
- EO 14365 (State AI law preemption): official textfederalregister.gov
- GovInfo: EO 14365 textgovinfo.gov
- Mayer Brown: Executive order analysismayerbrown.com
Dates and statuses on this page were last checked against these sources on 10 November 2026. This is orientation, not legal advice.
Questions
- Is the Colorado AI Act (SB 24-205) still coming into force?
No. SB 26-189, signed on 14 May 2026, repealed and re-enacted it. The obligations that apply from 1 January 2027 are those of the new statute.
- Do we still need annual impact assessments for Colorado?
SB 26-189 dropped the annual impact assessment requirement. Impact assessments remain useful, and other regimes such as the EU AI Act and California's CCPA regulations call for assessments in some cases, but they are no longer a Colorado requirement.
- Can consumers sue under the Act?
No. There is no private right of action. Enforcement is by the Colorado Attorney General.
- Does the federal executive order cancel the law?
No. Executive Order 14365 directs federal agencies to challenge state AI laws, but an executive order cannot itself preempt state law. The Act remains enforceable unless a court or Congress says otherwise.
See what is in use before you decide anything.
Start a 14-day trial with every Govern feature, connect one discovery source and enroll a handful of devices. No card is needed to start, and nobody is asked to change how they work.