Colorado Governor Jared Polis signed S.B. 26-189 on May 14, 2026, repealing and replacing the state's 2024 AI Act before it took effect. The new law takes effect January 1, 2027. It drops the earlier requirements for risk management programs, impact assessments, and a duty of care to avoid algorithmic discrimination. Instead, it focuses on automated decision-making technology that materially influences consequential decisions about consumers in areas such as employment, housing, insurance, education, financial services, and health care.
Businesses that use AI in those decisions, which the law calls deployers, must notify consumers before the technology is used. If the outcome is adverse, they must provide an explanation within 30 days, including how to request more information, and offer human review where commercially reasonable. Developers must give deployers documentation on intended uses, limitations, and known risks. Both must keep compliance records for at least three years. General chat tools, spell-checkers, and cybersecurity tools are excluded unless used to make a consequential decision.
If you do business in Colorado and use software that screens job applicants, scores tenants, or helps decide credit or insurance, ask the vendor whether it counts as covered technology and what documentation it will provide. Map where those tools touch your decisions, and plan the consumer notice and human review process before January.
The Colorado Attorney General has exclusive enforcement authority, with no private right of action, and must generally give a 60-day cure period before acting.
Sources
Does this affect your business?
Our advisors can help you figure out the right move, at no cost.