Colorado Gov. Polis signs SB 26-189, replacing the Colorado AI Act

Colorado SB 26-189 repeals and reenacts the state's 2024 AI Act, replacing its high-risk artificial intelligence system framework with a narrower regime covering automated decision-making technology (ADMT) used in consequential decisions.

Colorado Gov. Jared Polis signed Senate Bill 26-189 on May 14, 2026, and the revised law takes effect January 1, 2027.

What it is

SB 26-189 replaces the 2024 Colorado AI Act's concepts of high-risk AI systems and algorithmic discrimination with a framework built around a covered ADMT that materially influences a consequential decision affecting education, employment, housing, financial or lending services, insurance, health care or essential government services.

The bill followed months of political and legal pressure on the original law, after a December 2025 executive order targeted SB 205 as excessive state regulation and directed federal agencies to challenge state AI laws seen as inconsistent with federal deregulatory policy.

What it requires

Developers of covered ADMT must give deployers technical documentation on intended uses, training data categories, known limitations, and instructions for human review, starting January 1, 2027, and must notify deployers of material updates.

Deployers must give clear notice before use, provide a plain-language explanation within 30 days after an adverse consequential decision, and let consumers request data access, correction, and meaningful human review, while both parties must retain compliance records for at least three years.

The law removes the prior act's duty of care, risk management programs, and annual impact assessments, while the Colorado attorney general must enforce it under the Colorado Consumer Protection Act and adopt implementing rules, including on post-adverse-outcome disclosures, by January 1, 2027.

There is no private right of action, a 60-day right to cure applies before enforcement until it sunsets January 1, 2030, and violations can carry civil penalties of up to $20,000 per violation under existing consumer protection law.

What security leaders should do

Security and privacy teams should inventory any automated decision-making technology touching employment, lending, insurance, health care, housing or government-benefit decisions in Colorado and map which tools qualify as covered ADMT under the new materially-influence standard. Vendor contracts should be reviewed now, since SB 26-189 voids indemnification clauses that shift liability for a party's own discriminatory ADMT-related acts onto the other party. Teams should also plan for the three-year record retention requirement and for standing up a documented human-review process ahead of the January 1, 2027 effective date, while tracking the attorney general's forthcoming rulemaking on the materially-influence standard and post-adverse-outcome disclosures.