Last updated:
Colorado SB 26-189 is the 2026 replacement for the original Colorado AI Act (SB 24-205), taking effect 1 January 2027 with obligations focused on automated decision-making technology making consequential decisions about Coloradans.
Colorado SB 26-189 was signed in May 2026, repealing and replacing the original Colorado AI Act (SB 24-205). The replacement narrows the regulatory frame from broadly defined "high-risk AI systems" to "automated decision-making technology" (ADMT) making consequential decisions in employment, lending, housing, education, and healthcare. Deployer obligations include impact assessments before high-impact use, consumer notice when an ADMT is used in a consequential decision, an opt-out path for consumers, and algorithmic discrimination protections. The law takes effect 1 January 2027. The shift from the broader SB 24-205 framing to the ADMT-focused framing aligns Colorado more closely with the regulatory shape of California SB 53 and other state ADMT regimes, while retaining the rebuttable-presumption structure for organizations aligned to recognized AI risk management frameworks like NIST AI RMF or ISO 42001.
Real world example:
A national lender with Colorado customers identifies its automated underwriting model as ADMT making a consequential decision under SB 26-189. Ahead of the January 2027 effective date, the team completes a deployer impact assessment, configures consumer notice in the application flow, builds an opt-out path to a human reviewer, and documents algorithmic-discrimination testing against the new state's requirements.
