Colorado AI Act SB24-205 signed, then delayed and replaced before taking effect

Colorado's governor approved Senate Bill 24-205, Consumer Protections for Artificial Intelligence, on 17 May 2024. The law told developers and deployers of high-risk AI systems to use reasonable care to protect consumers from algorithmic discrimination, but its duties were postponed and then rewritten before they could apply.

What it is

As enacted, the act's obligations were to start on 1 February 2026. Developers had to hand deployers the documentation needed for impact assessments and report known discrimination risks to the attorney general within 90 days of discovery. Deployers had to run a risk management program, complete impact assessments and let consumers appeal adverse consequential decisions, with human review where technically feasible.

The attorney general held exclusive enforcement power, and following a recognized AI risk management framework gave companies an affirmative defense.

What it requires

The original duties no longer apply as written. SB25B-004, passed in the August 2025 extraordinary session and approved on 28 August 2025, pushed the effective date of SB24-205's requirements to 30 June 2026.

Then SB26-189, signed on 14 May 2026 according to the General Assembly's bill history, repealed and reenacted those provisions around automated decision-making technology (ADMT) used in consequential decisions, meaning decisions on education, employment, housing, lending, insurance, health care or essential government services.

Under the replacement, developers must give deployers technical documentation from 1 January 2027, deployers must give consumers notice at the point of interaction, and consumers may request human review after an adverse outcome. Both parties keep compliance records for at least 3 years, and the attorney general must give 60 days of notice and a chance to cure before bringing an action started before 1 January 2030.

What security leaders should do

• Retire compliance plans built on the 2024 text and rebuild them around SB26-189 and its 1 January 2027 start.
• Inventory every automated tool that shapes hiring, lending, housing, insurance or similar decisions about Colorado residents, since that is the new scope trigger.
• Set log and document retention for those tools to at least three years.
• Design and test a human review path now, because consumers can demand one after an adverse decision.