Colorado AI Act Status 2026: SB26-189 (ADMT Act) Replaces SB 24-205 — January 1, 2027 Deadline

Colorado AI Act status 2026: After Senate Bill 24-205 was signed in May 2024, lawmakers and the Governor agreed the original Act was too broad to implement on the original June 30, 2026 deadline. On May 14, 2026, Governor Polis signed SB26-189, which repealed and reenacted SB 24-205 as the Colorado Automated Decision-Making Technology Act (ADMT Act). The amended law narrows scope, removes several obligations, and pushes the effective date to January 1, 2027. If your organization uses automated decision-making technology that materially influences consequential decisions about a Colorado resident's education, employment, housing, financial or lending services, insurance, healthcare, or essential government services, you are subject to this law.

This guide explains who must comply, what they must do, and what happens if they don't.

Who Must Comply

SB 205 creates obligations for two categories of entities:

• Developers — entities that design, code, produce, or substantially modify a high-risk AI system.
• Deployers — entities that deploy or use a high-risk AI system in a product or service to make, or materially influence, consequential decisions about Colorado consumers.

The law applies regardless of where your company is incorporated. If your AI system affects a Colorado consumer, you are within scope.

What Counts as Automated Decision-Making Technology (ADMT)?

Under SB26-189, an ADMT system is one that makes, or materially influences, a consequential decision about a Colorado resident. The amended Act covers consequential decisions in seven domains: education, employment, housing, financial or lending services, insurance, healthcare, and essential government services. The original SB 24-205 also covered “legal services” as a separate domain — that has been narrowed in the amended text. See our Colorado AI law page for the full scope list.

The Small Employer Exemption

Organizations with fewer than 50 full-time equivalent (FTE) employees may qualify for a limited exemption—but only if all four conditions are met: (1) the deployer does not use its own data to train or fine-tune the AI system; (2) the system is used only for the intended uses disclosed by the developer; (3) the system continues learning from data sources other than the deployer’s own data; and (4) the deployer makes the developer’s impact assessment available to consumers. Failing any one condition removes the exemption. Even exempt small deployers must still comply with duties of reasonable care, pre-decision notices, adverse-action explanations, consumer appeal rights, and AG notification. See our small business AI compliance guide for more detail.

Key Compliance Deadlines (Updated for SB26-189)

What Changed: Obligations Removed by SB26-189

If you read the original SB 24-205 guidance, several centerpiece obligations are no longer required under the amended ADMT Act:

• Algorithmic-discrimination duty of care (developer and deployer) — removed
• Annual impact assessments — removed
• Risk-management program aligned to NIST AI RMF or ISO/IEC 42001 — removed (no longer an affirmative defense, because it’s no longer required)
• 90-day AG notification when algorithmic discrimination occurs — removed
• Website disclosures describing high-risk systems and discrimination-risk management — removed

The amended Act narrows compliance to documentation, notice, and consumer-rights obligations described below.

What Deployers Must Do (Under SB26-189)

1. Provide Clear & Conspicuous Notice at the Point of Interaction

Before an ADMT system makes or materially influences a consequential decision, deployers must provide the affected consumer with a clear, conspicuous notice at the point of interaction. The notice must identify that ADMT is being used and the nature of the decision the system supports.

2. Plain-Language Description After an Adverse Outcome

When an ADMT system produces an adverse consequential decision, the deployer must provide a plain-language description of how the system was used and the principal reason(s) for the outcome within 30 days. The Colorado AG is required to issue rules clarifying what this disclosure must contain by January 1, 2027.

3. Honor Consumer Rights

Consumers have the right to (a) correct personal data used by an ADMT system in making the decision and (b) request meaningful human review of an adverse outcome. Deployers must establish processes to receive and act on these requests.

4. Retain Records for 3 Years

Deployers must retain records of ADMT use, consumer notices, and human-review responses for three years.

What Developers Must Do (Under SB26-189)

Developers of ADMT systems supplied to deployers in Colorado must (a) provide deployers with technical documentation before deployment sufficient for the deployer to understand intended use, training data categories, known limitations, and consequential-decision use cases; (b) notify deployers of material updates that could affect use; and (c) retain records for three years. The original SB 24-205 duty to use reasonable care to avoid algorithmic discrimination has been removed.

Penalties and Enforcement

The Colorado AG retains exclusive enforcement authority under the amended Act. There is still no private right of action. Violations are treated as deceptive trade practices under the Colorado Consumer Protection Act, carrying penalties of up to $20,000 per violation. SB26-189 preserves a 60-day cure period for curable violations — but the cure period sunsets on January 1, 2030, after which no statutory cure is available. See our AI penalties and enforcement guide.

The Insurance Carve-Out

Insurance carriers already in full compliance with Colorado's insurance-specific AI regulation under C.R.S. §10-3-1104.9—which was expanded in October 2025 to cover auto and health lines in addition to life insurance—may qualify for a conditional SB 205 exemption for the insurance portions of their AI operations. See our AI in insurance regulations guide.

Practical Steps to Prepare

1. Inventory your ADMT systems. Identify every AI or automated tool that makes or materially influences consequential decisions about Colorado residents.
2. Determine your role. Are you a developer, a deployer, or both under the amended Act?
3. Build a consumer-notice workflow. Design a clear, conspicuous notice at the point of interaction wherever ADMT influences a consequential decision.
4. Build an adverse-outcome disclosure workflow. Be ready to deliver a plain-language description within 30 days. Watch for the Colorado AG’s rulemaking due by Jan 1, 2027.
5. Build consumer-rights workflows. Stand up processes to correct personal data and route adverse-outcome appeals to meaningful human review.
6. Set 3-year record retention. Retain technical documentation, consumer notices, and human-review records.

What to Watch

SB26-189 directs the Colorado AG to issue rulemaking by January 1, 2027 clarifying the post-adverse-outcome disclosure standard. Federal preemption is also a live risk: in December 2025, President Trump signed an executive order directing DOJ to challenge state AI laws, and in April 2026 the DOJ intervened in xAI v. Colorado. Monitor the Colorado AI law tracker for legislative and litigation updates.

This article is for informational purposes only and does not constitute legal advice. Consult a qualified attorney for guidance specific to your situation.