Colorado scrapped its landmark AI law and wrote a narrower one. Here is what businesses will owe consumers in 2027

Two years ago, Colorado became the first state to pass a broad law aimed at discrimination by artificial intelligence. That law, SB 24-205, never took effect. Lawmakers delayed it once, in a special session in August 2025, and this spring they repealed it and replaced it with something considerably narrower.

The replacement, SB 26-189, regulates what it calls automated decision-making technology. Governor Jared Polis signed it in May after it passed the Senate 34 to 1 and the House 57 to 6, according to law-firm summaries of the vote. It is scheduled to take effect January 1, 2027. For Colorado businesses that use software to help make decisions about people, the new law is less demanding than the old one, but it is not nothing.

How Colorado got here

The 2024 law required companies that develop or deploy “high-risk” AI systems to use reasonable care to protect consumers from algorithmic discrimination, run risk-management programs and complete impact assessments. Its original effective date was February 1, 2026. Business groups and local governments argued compliance would be costly and unclear, and in August 2025 Polis signed SB25B-004, pushing the start date to June 30, 2026, so lawmakers could revisit the substance in the 2026 session.

They did. SB 26-189 omits many of the most contested elements of the original, including mandatory risk-management programs, impact assessments, detailed consumer disclosures and the duty of reasonable care, according to Davis Wright Tremaine’s analysis. In their place is a framework built on disclosure, documentation and consumer rights after an adverse decision.

What counts as a covered decision

The law applies to technology used to make, or materially influence, consequential decisions about consumers. In the earlier law, that category covered areas such as employment, lending, housing, insurance, education and health care, and the new law keeps the focus on decisions of that weight. Exactly what “materially influence” means is one of the questions the attorney general is expected to address in rules. Businesses should read the enrolled bill and the final rules for the precise definitions rather than relying on summaries.

What deployers must do

A “deployer” is a business that uses a covered tool, which is where most small and midsize Colorado companies would sit. According to the bill and analyses by Finnegan, Eckert Seamans and others, deployers will need to:

• Give notice before use. Consumers must receive clear and conspicuous notice at the point of interaction before covered technology is used. A prominent public notice reasonably accessible at points of consumer interaction can satisfy this.
• Explain adverse outcomes. Within 30 days of an adverse decision, the deployer must give the consumer a plain-language description of the technology’s role and explain how to seek reconsideration.
• Allow access and correction. Consumers can request the personal data used and ask for factually incorrect data to be corrected.
• Offer human review. Consumers can request meaningful human review and reconsideration after an adverse outcome, to the extent that is commercially reasonable.
• Keep records. Compliance records must be kept for at least three years from the decision.

Notably, the law does not give consumers a right to opt out of automated decision-making altogether.

What developers must do

Companies that build covered tools must provide deployers with documentation of intended uses, categories of training data, known limitations and instructions for human oversight. They do not have to disclose source code, model weights or trade secrets. Developers must also notify deployers within a reasonable time of material updates and intentional, substantial modifications.

For a small business buying software, this is useful leverage: you are entitled to the information you need to give your own customers accurate notices and explanations, and it is reasonable to ask vendors now how they will provide it.

Enforcement and the lawsuit

Only the Colorado attorney general can enforce the law, under the Colorado Consumer Protection Act, where violations count as deceptive trade practices. There is no private right of action. Where a violation can be cured, the attorney general must give a 60-day opportunity to fix it before acting; that right does not apply to knowing or repeated violations, and it expires January 1, 2030. The law also requires the attorney general to adopt rules on the post-adverse-outcome disclosures by January 1, 2027.

Enforcement is also tangled in federal court. Elon Musk’s AI company, xAI, sued the state, and the U.S. Justice Department intervened. Under an April 27 order in xAI v. Weiser, enforcement is stayed until 14 days after the court rules on a preliminary injunction motion that xAI is to file within 28 days after the state finalizes its rules. Some firms read the stay as covering the replacement law as well, and the attorney general has said he will not enforce either law until rulemaking is complete. The litigation could still delay the January date.

A practical timeline for the next 80 days

• Now: List the tools that help you decide who gets a loan, a lease, a job offer, an appointment or a price, including features built into software you already pay for.
• This fall: Watch the attorney general’s rulemaking and comment if your business is affected; the rules will define key terms.
• Before January: Draft the point-of-interaction notice and the 30-day adverse-outcome explanation, and decide who on your staff handles human review requests.
• Ongoing: Keep records for three years, and ask vendors for the documentation the law requires them to provide.

Colorado’s retreat mirrors a broader pattern. The European Union this year delayed its own high-risk AI rules while keeping transparency duties in place. Regulators are converging, for now, on a simpler expectation: tell people when software is making decisions about them, and give them a way to be heard.