Colorado Updates Its Artificial Intelligence Law in 2026

Alongside California’s new AI regulations, we covered Colorado’s decision to pull back on the United States’ first comprehensive AI law, Senate Bill 24-205 (SB24-205), back in November 2025. Colorado’s SB24-205 was set to take effect on February 1, 2026. Lawmakers attempted to revise the law in August 2025 after concerns had surfaced, but could not reach a consensus.

On May 14, 2026, Colorado Governor Jared Polis signed Senate Bill 26-189 (SB 26-189), pivoting the state’s approach to regulating automated decision-making technology in the business sector.

What’s in SB 26-189?

SB 26-189 replaces SB24-205, providing a clearer approach to regulating AI use that focuses on disclosure, transparency, individual access rights, and clear, attainable language for consumers regarding the use of AI, specifically automated decision-making technology (ADMT).

The new act establishes:

• New consumer rights when affected by decisions made using ADMT
• A prominent notice requirement to consumers when interacting with ADMT
• Clarification for developers and deployers on who is responsible for upholding the act and how

Responsibilities under Colorado’s new regulations

Like many other recent state laws, regulations apply to developers and deployers of automated systems that influence or make decisions affecting Colorado residents. According to SB 26‑189, “Deployer” means “a person doing business in Colorado that deploys a covered ADMT,” and "Developer" means “a person doing business in Colorado that:

1. Develops, offers, sells, leases, licenses, or otherwise makes commercially available a covered ADMT;
2. Develops a component that is designed, marketed, intended, documented, advertised, configured, or contracted to be used as part of a covered ADMT; or
3. Intentionally and substantially modifies an ADMT so that it becomes a covered ADMT.”

Both developers and deployers are required to retain records necessary to demonstrate compliance with the act for at least 3 years.

Developer-specific responsibilities

According to the Fiscal Note Summary, Developers using ADMT to “influence a consequential decision for a covered domain” are required to provide the following technical documentation:

• “ADMT’s intended uses and known harmful uses;
• categories of data used to train the ADMT;
• known limitations, risks, and circumstances in which the ADMT should not be used;
• instructions for the deployer’s appropriate use, monitoring, and meaningful human review;
• information reasonably necessary for the deployer to comply with the deployer’s consumer
• notice and disclosure requirements described in the bill; and,
• notice of any changes and modifications to the intended use, limitations, and risk of the ADMT.”

Deployer-specific responsibilities

Deployers must provide consumers with a clear and understandable explanation of how a covered ADMT was used to make any consequential decisions that result in an adverse outcome for the consumer. According to the Fiscal Note Summary, “If ADMT results in an adverse outcome, as defined by the bill, deployers must provide the following information to the consumer within 30 calendar days:

• a description of the consequential decision and the role the ADMT played in the decision;
• instructions for consumers to request additional information about the ADMT; and,
• an explanation of the consumer’s right to request personal data and to have meaningful human review of the consequential decision.”
  

Consumer rights

In addition to regulations for businesses using AI and ADMT, Colorado consumers are granted new rights to:

• Correct inaccurate data
• Access relevant information about the automated system
• Request human review of adverse decisions, where commercially reasonable

SB 26-189 does not provide a private right of action for consumers.

What’s next?

SB 26189 takes effect January 1, 2027, and regulations will be enforced solely by the Colorado Attorney General. Before initiating enforcement, the Attorney General must provide written notice of the violation to the developer or deployer and allow a 60-day cure period. The right to cure for deployers and developers ends on January 1, 2030.

The attorney general will provide additional guidance regarding disclosure requirements for deployers by January 1, 2027. As part of Colorado’s initiative to manage ADMT and AI use, the Attorney General will also publish annual enforcement reports.

More detailed information about Colorado’s SB 26189 can be found on the Colorado General Assembly’s official legislative website.

This content is for informational purposes only and shall not constitute legal opinion or advice. Consult your legal counsel to ensure compliance.