Colorado Replaces Its AI Act With a Narrower Framework

Colorado has replaced its broad, risk-based AI law with Senate Bill 26-189, a narrower regime for automated decision-making technology that materially influences consequential decisions in areas such as employment, housing, lending, insurance, healthcare, education, and public benefits.

The law shifts obligations away from annual impact assessments and broad risk-management programs toward consumer notice, post-adverse-outcome disclosures, record retention, data correction, and meaningful human review, with most requirements scheduled to begin January 1, 2027. The change reduces some upfront compliance burdens but leaves companies responsible for documenting covered systems, allocating developer and deployer responsibilities, and preparing for Attorney General rulemaking and enforcement.