Colorado AI Act Status 2026: SB26-189 (ADMT Act) Replaces SB 24-205 — January 1, 2027 Deadline

Colorado AI Act status 2026: After Senate Bill 24-205 was signed in May 2024, the Governor and other state officials called for revisions; SB25B-004 delayed its duties from February 1, 2026 to June 30, 2026, when they became operative. On May 14, 2026, Governor Polis signed SB26-189, which repeals and reenacts the law as “Automated decision-making technology in consequential decisions” effective January 1, 2027. The new law narrows scope and drops several obligations. From January 1, 2027, if your organization uses automated decision-making technology that materially influences consequential decisions about a Colorado resident's education, employment, housing, financial or lending services, insurance, healthcare, or essential government services, you are subject to this law.

This guide explains who must comply, what they must do, and what happens if they don't.

Who Must Comply

SB26-189 creates obligations for two categories of entities:

• Developers — entities that design, code, produce, or substantially modify an ADMT system.
• Deployers — entities that deploy or use ADMT to make, or materially influence, consequential decisions about Colorado consumers.

The law applies regardless of where your company is incorporated. If your AI system affects a Colorado consumer, you are within scope.

What Counts as Automated Decision-Making Technology (ADMT)?

Under SB26-189, an ADMT system is one that makes, or materially influences, a consequential decision about a Colorado resident. The amended Act covers consequential decisions in seven domains: education, employment, housing, financial or lending services, insurance, healthcare, and essential government services. The original SB 24-205 also covered “legal services” as a separate domain — that has been narrowed in the amended text. See our Colorado AI law page for the full scope list.

Key Compliance Deadlines (Updated for SB26-189)

What Changed: Obligations Removed by SB26-189

If you read the original SB 24-205 guidance, several centerpiece obligations are not required under SB 26-189 (under SB 24-205 they apply only until January 1, 2027):

• Algorithmic-discrimination duty of care (developer and deployer) — removed
• Annual impact assessments — removed
• Risk-management program aligned to NIST AI RMF or ISO/IEC 42001 — removed (no longer an affirmative defense, because it’s no longer required)
• 90-day AG notification when algorithmic discrimination occurs — removed
• Website disclosures describing high-risk systems and discrimination-risk management — removed

The amended Act narrows compliance to documentation, notice, and consumer-rights obligations described below.

What Deployers Must Do (Under SB26-189)

1. Provide Clear & Conspicuous Notice at the Point of Interaction

Before an ADMT system makes or materially influences a consequential decision, deployers must provide the affected consumer with a clear, conspicuous notice at the point of interaction. The notice must identify that ADMT is being used and the nature of the decision the system supports.

2. Plain-Language Description After an Adverse Outcome

When an ADMT system produces an adverse consequential decision, the deployer must provide a plain-language description of how the system was used and the principal reason(s) for the outcome within 30 days. The Colorado AG is required to issue rules clarifying what this disclosure must contain by January 1, 2027.

3. Honor Consumer Rights

Consumers have the right to (a) correct personal data used by an ADMT system in making the decision and (b) request meaningful human review of an adverse outcome. Deployers must establish processes to receive and act on these requests.

4. Retain Records for 3 Years

Deployers must retain records of ADMT use, consumer notices, and human-review responses for three years.

What Developers Must Do (Under SB26-189)

Developers of ADMT systems supplied to deployers in Colorado must (a) provide deployers with technical documentation before deployment sufficient for the deployer to understand intended use, training data categories, known limitations, and consequential-decision use cases; (b) notify deployers of material updates that could affect use; and (c) retain records for three years. The original SB 24-205 duty to use reasonable care to avoid algorithmic discrimination is not carried into SB 26-189; it applies only until January 1, 2027.

Penalties and Enforcement

The Colorado AG retains exclusive enforcement authority under the amended Act. There is still no private right of action. The Attorney General enforces violations under the Colorado Consumer Protection Act. SB26-189 provides a 60-day cure period when the Attorney General deems a cure possible — but the cure period sunsets on January 1, 2030, after which no statutory cure is available. Separately, under an April 27, 2026 stipulated court order in X. AI LLC v. Weiser, the Attorney General may not start enforcement of SB 24-205 or 2026 replacement legislation for violations through 14 days after the court rules on xAI’s planned preliminary-injunction motion. See our AI penalties and enforcement guide.

Practical Steps to Prepare

1. Inventory your ADMT systems. Identify every AI or automated tool that makes or materially influences consequential decisions about Colorado residents.
2. Determine your role. Are you a developer, a deployer, or both under the amended Act?
3. Build a consumer-notice workflow. Design a clear, conspicuous notice at the point of interaction wherever ADMT influences a consequential decision.
4. Build an adverse-outcome disclosure workflow. Be ready to deliver a plain-language description within 30 days. Watch for the Colorado AG’s rulemaking due by Jan 1, 2027.
5. Build consumer-rights workflows. Stand up processes to correct personal data and route adverse-outcome appeals to meaningful human review.
6. Set 3-year record retention. Retain technical documentation, consumer notices, and human-review records.

What to Watch

SB26-189 directs the Colorado AG to issue rulemaking by January 1, 2027 clarifying the post-adverse-outcome disclosure standard. Federal preemption is also a live risk: in December 2025, President Trump signed an executive order directing DOJ to challenge state AI laws; separately, on April 24, 2026 the court granted the United States’ unopposed motion to intervene as a plaintiff in X. AI LLC v. Weiser, xAI’s challenge to SB 24-205. Monitor the Colorado AI law tracker for legislative and litigation updates.

This article is for informational purposes only and does not constitute legal advice. Consult a qualified attorney for guidance specific to your situation.