What happened
Colorado Governor Jared Polis signed Senate Bill 26-189 into law on May 14, 2026, repealing and replacing the original Colorado AI Act (SB24-205). The revised law, effective January 1, 2027, shifts focus from 'high-risk AI systems' to 'automated decision-making technology' (ADMT) used to materially influence consequential decisions affecting Colorado residents' access to education, employment, housing, financial services, insurance, healthcare, and government services. The revised act removes the duty of care to mitigate algorithmic discrimination, annual impact assessments, and risk management program requirements. Developers must provide deployers with disclosures about covered ADMT's intended use, known limitations, and risk mitigation. Deployers must provide pre-use notice to consumers, adverse-outcome explanations within 30 days, and maintain three-year records.
Why it matters
The revision responds to industry criticism and federal intervention (DOJ intervened in April litigation alleging Equal Protection violations). The narrower framing and reduced compliance burden may set a template for other states considering AI governance legislation. Organizations using AI in consequential decisions affecting Colorado residents—particularly in HR, lending, insurance underwriting, and benefits determination—must evaluate whether their systems qualify as covered ADMT and prepare compliance mechanisms by January 2027.
Action needed
Map AI systems against the 'consequential decision' definition, implement pre-use and adverse-outcome notice workflows for deployers, and establish three-year documentation retention. Legal and compliance teams should track whether other states follow Colorado's shift from 'AI system' to 'automated decision-making technology' framing.