- with Inhouse Counsel
- with readers working within the Business & Consumer Services and Insurance industries
It’s been nearly two years since we discussed Colorado’s then-newly enacted AI Act. After months of back-and-forth, Colorado has now passed a major reset to how it intends to regulate artificial intelligence in the state. On May 14, 2026, Gov. Jared Polis signed Senate Bill 26-189 (SB 189), which repeals and replaces the state’s 2024 AI Act, only a month before that law would take effect. SB 189 becomes effective Jan. 1, 2027, and shifts the state regime toward disclosure, transparency and targeted consumer protections. Companies deploying AI in connection with their Colorado workforces and consumers should begin preparing for compliance now.
A Narrower, Disclosure-Focused Framework
SB 189 abandons several of its predecessor’s most burdensome features. Gone are the duty of care, mandatory algorithmic impact assessments and the rebuttable presumption of compliance tied to risk management frameworks. In their place, the new law imposes disclosure obligations, three-year recordkeeping requirements and a 60-day pre-enforcement cure period.
What Triggers the Law
SB 189 applies to developers and deployers (such as employers) of automated decision-making technology that processes Colorado resident personal data to generate predictions, recommendations, classifications or scores that “materially influence” consequential decisions. Covered decisions include employment, education, housing, lending, insurance, health care and essential government services. For employers, it reaches current Colorado employees and job applicants.
Employer Disclosure Obligations
Before making consequential employment decisions that are influenced by AI, deployers must provide advance notice that includes a mechanism to obtain additional information. When an adverse outcome occurs—such as a decision not to hire—the deployer must, within 30 days, provide a plain-language explanation of the decision and the technology’s role, instructions for requesting further information and notice of the right to meaningful human review. All notices must be accessible to individuals with disabilities and limited English proficiency.
While using most public and enterprise AI systems (including LLMs) will be covered, not every decision made with the benefit of AI will be. Routine functions such as scheduling, administrative routing and workflow management are excluded, as are tools that merely present information for human review and fraud-prevention activities like identity verification. Further, automated decision-making technology is not limited to AI, and can include technologies that predate current LLM tools.
Liability and Enforcement
SB 189 allocates discrimination liability between developers and deployers based on relative fault, with developer liability generally limited to uses that were intended or marketed. Indemnification clauses that shift liability for Colorado anti-discrimination violations are void as against public policy. Enforcement rests exclusively with the attorney general; the law creates no private right of action.
Recommended Next Steps
Before Jan. 1, 2027, employers should:
- Inventory and audit tools to identify covered AI technology that influence consequential decisions.
- Review and update vendor contracts to ensure developers supply required disclosures.
- Develop pre-use notices and post-adverse-outcome disclosures.
- Establish a meaningful human review workflow with the ability to override AI outcomes.
- Implement record-retention procedures meeting the three-year requirement.
- Monitor the Attorney General’s forthcoming rulemaking, which may materially affect these obligations.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
