Colorado’s New AI Act Targets Automated Decision-Making for Consequential Decisions

Quick Hits

On May 14, 2026, Colorado Governor Polis signed Senate Bill 26-189, which repeals and replaces the 2024 Colorado AI Act.
The new law removes the 2024 act’s duty of care, risk management program, and impact assessment requirements in favor of a pre-use notice, a post-adverse-outcome disclosure, and a limited set of consumer rights tied to “covered ADMT.”
“Consumer” expressly includes employees and Colorado resident job applicants, reaching workforce decisions the Colorado Privacy Act largely excludes (apart from its biometric data provisions).
Contract terms that indemnify a developer or deployer against liability for its own antidiscrimination violations involving covered ADMT are void as against public policy.
The law takes effect January 1, 2027.

The Colorado General Assembly’s passage of Senate Bill (SB) 26-189 closes two years of legislative wrangling over a law that had not yet taken effect. Governor Jared Polis signed the 2024 Colorado Artificial Intelligence (AI) Act in May 2024 only after publicly asking the legislature to revisit it during stakeholder review. After repeated session-long deadlocks and an interim Working Group convened by the governor in fall 2025, the legislature adopted the Working Group’s framework largely intact. Governor Polis signed the bill on May 14, 2026, and the law takes effect January 1, 2027.

For employers, SB 26-189 is both narrower in scope and broader in reach than the law it replaces. It eliminates the 2024 act’s most demanding compliance obligations, but it pulls employees and job applicants into a notice-and-rights regime that the Colorado Privacy Act expressly excludes.

Narrowing Scope and Covered Technology

SB 26-189 imposes compliance obligations on both “developers” (creators) and “deployers” (users, including employers) of AI, but it abandons the 2024 act’s broad reach over “high-risk artificial intelligence systems.” In its place is a…

Source