Colorado AI Laws 2026: Complete Compliance Guide

Colorado enacted the first comprehensive state AI law, SB 24-205 — the Colorado AI Act, in 2024, but SB 26-189, signed in May 2026, replaces it on January 1, 2027 with a narrower law on automated decision-making technology. Now, the 2026 legislative session is building on that foundation with 16 new bills targeting conversational AI, psychotherapy, and healthcare. This guide covers everything businesses need to know about Colorado's full AI regulatory landscape.

Colorado AI Act: SB 24-205 Replaced by SB 26-189

Signed into law in 2024, Senate Bill 24-205 set out a detailed regulatory framework for high-risk AI systems — those that make or substantially contribute to consequential decisions in areas such as employment, education, financial services, healthcare, housing, insurance, and legal services. Its duties became operative June 30, 2026. SB 26-189, signed May 14, 2026, repeals and replaces it effective January 1, 2027, dropping SB 24-205’s duty of care, impact assessments, and risk-management presumption.

Core Requirements Under SB 26-189 (from January 1, 2027)

• Pre-use notice: Deployers must give consumers clear notice before covered automated decision-making technology is used in a consequential decision
• Adverse-outcome explanations: Within 30 days of an adverse outcome, deployers must give a plain-language explanation of the decision and the technology’s role
• Consumer rights: Consumers can correct inaccurate personal data and request meaningful human review
• Developer duties: Developers must give deployers documentation on intended uses, known risks and limitations, and training-data categories
• Records: Relevant records must be kept for at least three years

SB 26-189 applies to consequential decisions made on or after January 1, 2027. The Colorado Attorney General has exclusive enforcement authority under the Colorado Consumer Protection Act; there is no private right of action. Separately, under an April 27, 2026 stipulated court order in X. AI LLC v. Weiser, the Attorney General may not start enforcement of SB 24-205 or 2026 replacement legislation for violations through 14 days after the court rules on xAI’s planned preliminary-injunction motion. For step-by-step compliance planning, see our Colorado AI Act 2026 compliance guide. For background on the original SB 24-205, see Colorado AI Act Explained.

Originally set to take effect February 1, 2026, the Colorado AI Act's enforcement was delayed to June 30, 2026 when Governor Polis signed SB 25B-004 on August 28, 2025, following a special legislative session. SB 25B-004 only delayed the effective date — it did not change any of SB 24-205's substantive obligations. SB 24-205’s duties became operative June 30, 2026; SB 26-189, signed May 14, 2026, repeals and replaces SB 24-205 effective January 1, 2027.

HB 1263: Conversational AI Operator Requirements

House Bill 1263 targets operators of conversational artificial intelligence services, establishing new transparency and safety obligations. As conversational AI tools — including chatbots, virtual assistants, and AI companion apps — become ubiquitous, Colorado is moving to ensure consumers understand when they are interacting with AI and that their data is handled responsibly.

Who Is Covered

Any entity that operates a conversational AI service available to Colorado residents. This broadly encompasses customer service chatbots, AI-powered virtual assistants, AI companion or social apps, educational AI tutors, and enterprise-facing conversational tools that interact with end users.

Key Requirements

• AI disclosure: Operators must clearly disclose to users that they are interacting with an artificial intelligence system, not a human
• Data transparency: Users must be informed about what data is collected during conversational interactions and how it is used
• Minor protections: Enhanced safeguards for users identified as minors, including restrictions on data retention and targeted content
• Safety protocols: Operators must implement protocols for detecting and escalating conversations involving crisis situations, including self-harm or suicidal ideation
• Record-keeping: Operators must maintain records of compliance efforts and make them available upon regulatory request

Business Impact

Companies deploying any form of conversational AI in Colorado should begin auditing their disclosure practices now. HB 1263 would complement Colorado's broader automated-decision framework by adding sector-specific obligations for conversational interfaces. Businesses already preparing for SB 26-189 will have a head start, but the conversational AI requirements introduce additional disclosure and safety protocol mandates.

HB 1195: Psychotherapy AI Restrictions

House Bill 1195 addresses the growing use of AI in mental health services by placing strict limitations on artificial intelligence in psychotherapy contexts. Colorado is among the first states to draw a clear regulatory line around AI-driven therapeutic interactions.

Who Is Covered

Licensed psychotherapists, mental health platforms, telehealth providers offering therapy services, and any entity deploying AI tools that deliver, simulate, or supplement psychotherapy to Colorado residents.

Key Provisions

• Prohibition on autonomous AI therapy: AI systems may not independently conduct psychotherapy sessions or provide therapeutic interventions without direct human clinician oversight
• Informed consent: Patients must be clearly informed when AI tools are used as part of their therapeutic process, including the nature and limitations of the AI system
• Clinician responsibility: Licensed therapists remain fully responsible for patient care even when AI-assisted tools are part of the treatment workflow
• Data protections: Heightened requirements for handling sensitive mental health data processed by AI systems, exceeding standard HIPAA requirements
• Advertising restrictions: Companies may not market AI tools as substitutes for licensed psychotherapy

Business Impact

Mental health startups and telehealth platforms that incorporate AI into therapy workflows must redesign their service models to ensure human clinician oversight. Companies marketing AI therapy apps or chatbot therapists to Colorado residents face significant compliance obligations. This bill signals a broader trend — expect other states to follow Colorado's lead in regulating AI in mental health.

HB 1139: AI in Healthcare Usage

House Bill 1139 establishes requirements for the use of artificial intelligence in healthcare settings across Colorado. The bill builds on the state's existing healthcare regulatory framework to address AI-specific risks in clinical decision-making, diagnostics, and patient care management.

Who Is Covered

Healthcare providers, hospital systems, health insurers, clinical AI vendors, and any entity deploying AI tools that influence patient care decisions or healthcare coverage determinations for Colorado residents.

Key Requirements

• Human oversight mandate: AI systems may not serve as the sole basis for clinical decisions, treatment plans, or coverage determinations — a qualified healthcare professional must review and approve AI-assisted outputs
• Validation standards: Healthcare AI tools must meet validation and testing requirements before deployment, including documented evidence of clinical accuracy
• Patient notification: Patients must be informed when AI tools play a role in their diagnosis, treatment recommendations, or insurance decisions
• Bias auditing: Healthcare AI systems must undergo periodic auditing for disparate impact across demographic groups
• Incident reporting: Healthcare entities must report AI-related adverse events or significant errors to the appropriate regulatory authority

Business Impact

Hospitals, insurers, and health-tech companies operating in Colorado must integrate compliance workflows into their AI deployment pipelines. The validation and bias auditing requirements will require upfront investment, particularly for organizations using third-party AI tools. HB 1139 aligns with SB 205's high-risk framework — healthcare is already a named consequential decision domain under the Colorado AI Act. See our AI in healthcare compliance guide for related laws in other states.

Key Bills at a Glance

Compliance Priorities by Company Type

Compliance Checklist for Colorado

1. Prepare for SB 26-189 — inventory automated decision-making technology used in consequential decisions and build notice, explanation, and human-review workflows before January 1, 2027. See our step-by-step compliance guide
2. Implement algorithmic discrimination safeguards — audit AI systems for bias across protected characteristics and document mitigation steps
3. Update consumer notifications — ensure automated consequential decisions trigger pre-use notices and adverse-outcome explanations
4. Audit conversational AI disclosures — if you operate chatbots or virtual assistants in Colorado, prepare for HB 1263's transparency and safety requirements
5. Review mental health AI workflows — ensure no psychotherapy AI operates without direct clinician oversight per HB 1195
6. Validate healthcare AI systems — confirm human oversight, clinical validation, and bias auditing for all healthcare AI per HB 1139
7. Establish documentation and record-keeping — maintain compliance records (SB 26-189 requires at least three years) and audit logs for regulatory review
8. Monitor new bill progress — HB 1263, HB 1195, and HB 1139 are currently introduced; track committee hearings and amendments

For a complete index of Colorado AI legislation, visit our Colorado AI laws tracker.

This article is for informational purposes only and does not constitute legal advice. Consult a qualified attorney for guidance specific to your situation.

— AI Laws by State Team