Colorado Act Legislation: The AI Strikes Back

On May 14, 2026, Colorado Governor Jared Polis signed SB 26-189, the new Colorado artificial intelligence statute which goes into effect January 1, 2027. SB 26-189 replaces SB 24-205, the controversial AI statute that had not yet become effective.

SB 26-189 was the result of several years of negotiations between groups seeking more regulation of AI, particularly with respect to consumer protection, and those concerned that SB 24-205 would impose significant costs and burdens on companies with employees, customers or other stakeholders in Colorado. 

Many technology industry participants would rather kiss a Wookiee than comply with SB 24-205 and expressed concern that SB 24-205 would cause technology companies to avoid Colorado due to its burdensome requirements.

SB 26-189 requires developers of automated decision-making technology (“ADMT”) that materially influence consequential decisions to provide deployers of the technology with information about the intended uses of the technology, the types of data used to train the technology, known risks and limitations and any updates to the technology. Consequential decisions are determinations or actions that relate to a consumer’s access to or eligibility for education opportunities, employment, the lease or purchase of residential real estate, financing services, insurance, health-care services, and essential government services and public benefits. Notably, the statute excludes from the definition of ADMT a range of common technologies, including anti-malware, calculators, databases, firewalls, spell-checking, and spreadsheets that require human analysis and do not use machine learning. It also excludes tools used solely to summarize, organize, translate, draft, or present information for human review, and consumer-facing chatbots that are not contracted or intended for use in consequential decisions and are subject to an acceptable use policy prohibiting such use.

Deployers of ADMT that materially influence consequential decisions are obligated to notify consumers about the use of such technology prior to using the technology, including instructions for how to obtain additional information. If the technology is used to make a consequential decision that results in an adverse outcome for the consumer, then the deployer must provide, within thirty days, a plain language description of the decision to the consumer and detail the role that ADMT played in the decision, instructions to request additional information about the ADMT, and an explanation of the consumer’s right to have any factually incorrect data corrected and request a meaningful human reconsideration of the decision. Deployers must also retain compliance records for at least three years after the date of a consequential decision.

The statute also adopts a broad definition of “consumer” that includes employees, job applicants who are Colorado residents, and any individual whose access to, eligibility for, or opportunity in Colorado is evaluated in a consequential decision by a person doing business in Colorado.

There is no private right of action under the statute and there is a 60 day right to cure after receiving notice of a violation (unless the party receiving the notice is a scoundrel repeat offender). However, developers and deployers may be held liable for unlawful discrimination under state anti-discrimination laws arising from consequential decisions materially influenced by a covered ADMT, with fault allocated based on relative responsibility. Notably, contractual indemnification provisions that purport to hold a party harmless from its own discriminatory acts or omissions related to ADMT use are void as contrary to public policy. A developer is not liable, however, where the deployer used the ADMT in a manner not intended, documented, marketed, advertised, configured, or contracted for by the developer.

Certain obligations under the statute are preempted by federal statutes governing highly regulated industries such as education, banking and healthcare. For example, HIPAA-covered entities are generally exempt from the disclosure and consumer rights provisions (except for employment-related decisions), but must still provide patients with a general notice of ADMT use and, if ADMT is used to determine eligibility for financial assistance, must provide specific post-adverse-outcome disclosures.

This is not the end of the battle over AI in Colorado. First, the attorney general is obligated to promulgate regulations on or before January 1, 2027 to provide guidance about the term “Materially Influence” and otherwise flesh out the scope of compliance obligations and any applicable limitations. It is likely the stakeholder will have a very different view about how these regulations should interpret the statute.

Further, it is likely that the federal government and other industry participants will push back on the new legislation. In December 2025, President Trump issued an executive order seeking to limit state laws (specifically naming the Colorado statute). X.AI LLC sued Colorado alleging that SB 24-205 is unconstitutional. The federal government intervened to join that suit. X.AI LLC has 28 days from the repeal of SB 24-205 to amend its complaint to name the new statute to the extent X.AI believes it is also unconstitutional. Not to tell you the odds, but it is highly probable that both X.AI and the federal government will continue to push back on this legislation.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.