What happened
Colorado Governor Jared Polis signed SB 26-189 (the Automated Decision-Making Technology Act) on May 14, 2026, repealing and replacing the original SB 24-205 (Colorado's first-in-nation comprehensive AI Act, which had been stayed by federal court on April 27, 2026 after a lawsuit by xAI/Elon Musk). The replacement law narrows scope from 'high-risk AI systems' to 'Automated Decision-Making Technology' (ADMT) — technology that processes personal data and uses computation to generate outputs used in consequential decisions (employment, housing, healthcare, insurance, lending, education). It creates consumer rights including transparency disclosures and appeal rights, and requires the Colorado AG to promulgate implementing regulations. Effective date: January 1, 2027.
Why it matters
Colorado's replacement law is the current leading edge of US state AI accountability legislation. While narrower than the original, it still imposes substantive obligations on any organisation using automated systems in high-impact decisions affecting Colorado consumers. The January 1, 2027 effective date creates a compliance countdown. The AG rulemaking process will further define obligations. Other states are watching Colorado closely as a template.
Action needed
Organisations using automated decision-making tools in employment, lending, insurance, healthcare, housing, or education affecting Colorado consumers must: (1) assess whether their tools qualify as ADMT under SB 26-189; (2) conduct impact assessments and develop required disclosures; (3) monitor Colorado AG rulemaking; (4) review vendor contracts for risk allocation. Effective January 1, 2027 — begin compliance programme now.