AI Law and Policy Navigator

The Colorado AI Law You Prepared For Is Gone, and the Rulemaking Comment Window Closes October 26

By Andrew R. Lee, Jason M. Loring, Christina Baptista, Graham H. Ryan

October 23, 2026

If your Colorado compliance program is built around impact assessments, it is built for a statute that will never take effect. Senate Bill 24-205, the first comprehensive state AI statute in the country, was scheduled to take effect June 30, 2026. Colorado instead repealed and replaced it with Senate Bill 26-189, signed May 14, 2026, whose principal requirements apply to consequential decisions made on or after January 1, 2027. The new law is narrower, but some of the obligations it retained or added sit closer to the individual decision and may be harder to operationalize. The rules that will define it are still being written, and the Attorney General's formal comment period closes October 26. In the meantime, the federal court entered an order, based on the parties’ stipulated joint motion, barring the Attorney General from initiating enforcement for the period specified in the order. That means January 1 remains the statutory compliance date, but the federal court may determine when Attorney General enforcement can actually begin.

What Colorado Dropped

When we first examined the working group’s repeal and replace draft, we called Colorado the clearest case study in global AI regulatory retrenchment. The enacted text confirms it. It does not carry forward the duty of reasonable care to prevent algorithmic discrimination, the deployer risk management program, the annual impact assessment, or the 90-day self-report to the Attorney General. One feature that shaped many compliance budgets is gone as well: the affirmative defense against Attorney General enforcement for companies that both followed a recognized framework such as the NIST AI RMF or ISO/IEC 42001 and found and fixed violations through red teaming, user feedback, or internal review. If you built a framework and testing program to earn that defense, keep it, because it is still sound governance, but the statute no longer rewards it.

The new law turns on automated decision-making technology (ADMT) that “materially influences” a consequential decision, meaning its output is a non-de minimis factor used in making the decision and affects its outcome, including by ranking, scoring, recommending, or classifying. Employment remains a covered domain. The definition of “consumer” expressly includes employees, Colorado-resident job applicants, and certain other individuals whose access to or opportunity in Colorado is evaluated by a person doing business in the state. The scope is also narrower. The statute carves out a long list of infrastructure, from firewalls to spell checkers to spreadsheets that rely on human analysis rather than machine learning, along with tools used solely to summarize, organize, translate, draft, route, or present information for human review or administrative processing. Routine administrative processing and other low stakes functions that do not determine access, eligibility, selection, compensation, or other rights within a covered domain generally fall outside the consequential decision framework.

What Colorado Requires Now

Starting January 1, 2027, a developer must tell each deployer what the covered ADMT is for and how it should not be used, what kinds of data trained it (to the extent known), where it falls short, and how to use, monitor, and review it, and must flag material updates within a reasonable time. Deployers face four duties:

Notice. Before using a covered ADMT to materially influence a consequential decision, give clear and conspicuous notice. A prominent public posting near the point of interaction satisfies this.
Adverse outcome disclosure. Within 30 days, give the consumer a plain language description of the decision and the ADMT's role in it, a simple way to request more information (including the tool's name, its developer, and the source of personal data used), and an explanation of their rights.
Correction and human review. After an adverse outcome, and on the consumer’s request, explain how to access and correct inaccurate personal data and offer meaningful human review and reconsideration, to the extent commercially reasonable. The reviewer must be trained, have authority to override the decision, and not defer to the system's output. Opinions, predictions, and scores are not subject to correction. The October 6 interim rules would add substantial detail to what makes the human review “meaningful,” including reviewer training, actual authority to approve, modify, or override the decision, and independence from improper management steering.
Records. Keep records demonstrating compliance for at least three years after each consequential decision.

Anyone who has run a background check program will recognize the structure. As we explained in Your Adverse Action Workflow Starts Too Late, AI screening tools can end candidacies without the sort of notice, disclosure, and correction workflow that already feels familiar in the background check context. Colorado now requires a related decision-level workflow by statute. A compliant ECOA or FCRA adverse action notice may satisfy the Colorado disclosure requirement, but only if it also supplies the additional Colorado content.

The larger change is not simply that Colorado removed several obligations. It changed where the statute looks for accountability. SB 24-205 asked organizations to demonstrate governance before and around deployment through risk management programs, impact assessments, and a duty of reasonable care. SB 26-189 moves much of that accountability closer to the individual decision: notice that automated technology is being used, an explanation after an adverse outcome, access to the underlying personal data, correction rights, and a human capable of reconsidering the result. Colorado has moved from asking principally whether the organization governed the system to asking whether the person affected by a decision can understand the system’s role, challenge the information it used, and obtain human reconsideration of the result.

Enforcement and Liability

The Attorney General has exclusive enforcement authority, a violation is a deceptive trade practice, and there is no new private right of action. Before suing, the Attorney General must issue a notice of violation with 60 days to cure where cure is possible, but that step is not required for knowing or repeated violations. The cure provisions are repealed January 1, 2030.

The absence of a new private right does not confine the exposure to the Attorney General’s office. The statute expressly confirms that developers and deployers can be held liable under the Colorado Anti-Discrimination Act for decisions a covered ADMT materially influenced, with fault allocated by relative fault, and it voids contract terms that indemnify a party for its own discriminatory use of ADMT. Compliance with the statute is also no defense under other law. The result is a law that is lighter on prescribed governance paperwork but more explicit about where liability remains when the ADMT contributes to a discriminatory decision.

The Federal Overlay

xAI sued the Attorney General on April 9, 2026 (xAI v. Weiser, No. 1:26-cv-01515, D. Colo.), and the Justice Department moved to intervene as a plaintiff on April 24 alleging that SB 24-205 violated the Equal Protection Clause. That intervention is the kind of state law challenge contemplated by Executive Order 14365 and the Justice Department's resulting AI Litigation Task Force (which we previewed when the draft order first circulated). The suit targeted SB 24-205, but the court’s order is written to also reach its replacement. On the parties' joint motion, an April 27 minute order provides that the Attorney General will not initiate enforcement, including investigations, for violations of SB 24-205 or replacement legislation that occur on or before 14 days after the court rules on xAI's forthcoming preliminary injunction motion. xAI must file that motion within 28 days after the implementing rules are finally adopted, and all other case deadlines are stayed. The statute directs the Attorney General to adopt rules on its disclosure and consumer rights provisions by January 1, 2027.

January 1 remains the statutory compliance date. The court docket may determine when Attorney General enforcement begins. As of publication, the Attorney General has not finally adopted the implementing rules, so xAI's 28-day deadline to file its preliminary injunction motion has not begun. The delay does nothing to pause your exposure elsewhere. As our earlier look at state AI employment laws and preemption threats explained, anti-discrimination claims under Colorado and federal law do not depend on this statute.

What to Do Now

Re-scope your inventory against the narrower ADMT and consequential decision definitions, including AI embedded in vendor HR platforms, where covered use is easiest to miss.
Comment by October 26. The Attorney General's rulemaking page accepts written comments through 11:59 p.m. MDT that day, and the hearing starts at 10:00 a.m. The statute defines “materially influence” around whether an ADMT output is a non-de minimis factor that affects the outcome. The October 6 interim rules go further, addressing what counts as de minimis and creating a rebuttable presumption that certain outputs materially influence consequential decisions. That may make the definition one of the most consequential issues still open in the rulemaking.
Build the adverse outcome and review workflows now. Configure the 30-day disclosure, establish the intake route for correction and human review requests, identify qualified reviewers, and give them actual authority to approve, modify, or override the decision. The October 6 interim rules would require acknowledgment of a review request within 10 days and completion within 45 days.
Rework vendor contracts to secure the developer documentation and the data you need for adverse outcome disclosures, and to remove any indemnity language the statute now voids.

Three Key Takeaways:

The statute changed more than your governance program should. Colorado eliminated the mandatory impact assessment, Attorney General self-report, and framework-based defense. The inventory, testing, documentation, and review processes built around them may still be useful, but their statutory purpose has changed.

The rules are still being written. The October 26 comment window is the current deadline to shape what "materially influence" means in practice.

Exposure does not wait for enforcement. Anti-discrimination claims proceed, and voided indemnities fail, whether or not Colorado ever enforces this statute.

For questions about Colorado's automated decision-making law or building an AI governance program that travels across states, please contact the Jones Walker Privacy, Data Strategy and Artificial Intelligence team. Stay tuned and subscribe for continued insights from the AI Law and Policy Navigator.

Related Professionals