Colorado Overhauls AI Law, Shifts Focus to Automated Decision-Making
Colorado enacted SB 189, revamping its AI regulation and replacing the 2024 AI Act.
Why it matters: Colorado’s revised framework signals how states may adapt to fast-evolving AI risks, particularly in legal tech. The new law impacts compliance, liability, and enforcement for firms leveraging AI in consequential decisions.
- SB 189, signed May 14, 2026, repeals and replaces Colorado’s 2024 AI Act.
- Regulation now covers 'Automated Decision-Making Technology' influencing consequential decisions.
- Mandates on risk management and annual impact assessments are eliminated.
- Exclusive enforcement is granted to the Attorney General, with a new liability and cure period framework.
On May 14, 2026, Colorado Governor Jared Polis signed Senate Bill 189 (SB 189), repealing the 2024 Colorado Artificial Intelligence Act and reshaping how AI is regulated statewide. The new approach comes after criticism of Colorado’s initial, more restrictive law and amid increased federal scrutiny and economic pressure—reflected in a $1.5 billion budget shortfall this legislative session.
- SB 189 pivots focus to 'Automated Decision-Making Technology' (ADMT), specifically those that can 'materially influence' major decisions in sectors like law, finance, healthcare, and education.
- Unlike the previous law, SB 189 removes the need for AI deployers to maintain risk management programs or perform annual impact assessments.
- The new law introduces sector-specific accommodations for entities under HIPAA, insurance, education (FERPA), and FDA oversight, aiming to integrate AI safeguards with existing federal regulations.
- Liability provisions now void contract clauses seeking to indemnify a party for its own discriminatory acts involving ADMT.
- The Colorado Attorney General is granted exclusive enforcement power. Violations qualify as deceptive trade practices, with a required notice and 60-day cure period—unless the violation is knowing or repeated. This right to cure sunsets on January 1, 2030.
- The Attorney General must clarify post-adverse-outcome disclosure requirements and consumer rights via rules by January 1, 2027.
State Senator Cathy Kipp underscored the legislative hurdles, noting, “This was a rough session. A lot of bills died.” The hard-fought compromise in SB 189 is seen as a model for balancing innovation and accountability as legal sector AI adoption accelerates.
By the numbers:
- $1.5 billion — Colorado's 2026 budget shortfall influencing legislative priorities
- 60 days — Cure period before enforcement of violations under SB 189
- January 1, 2027 — Effective date for Colorado’s overhauled AI law
Yes, but: Enforcement and penalty details, and criteria for 'materially influence,' remain to be clarified in forthcoming rules.
What's next: The Colorado Attorney General is set to issue implementing rules on disclosure and consumer rights by January 1, 2027.