When does the Colorado AI Act take effect?

SB 26-189, which replaced the original Colorado AI Act, applies to consequential decisions made on or after January 1, 2027. The original SB 24-205 never took effect. Enforcement is a separate question, because the Attorney General has agreed in court not to start enforcement until after a ruling in xAI's lawsuit.

Does the Colorado AI Act still require impact assessments or bias audits?

No. SB 26-189 has no impact assessment, risk management program or annual review duty. Deployers owe a notice before use, an explanation within 30 days of an adverse outcome, data correction and human review on request, and three years of records.

Does the Colorado AI Act apply to small businesses?

The law has no employee-count threshold. A deployer is any person doing business in Colorado that uses automated decision-making technology to materially influence a consequential decision, such as hiring, lending, housing, insurance, health care or education. Employees and Colorado-resident job applicants count as consumers.

What is the penalty under the Colorado AI Act?

A violation is a deceptive trade practice under the Colorado Consumer Protection Act, enforced only by the Attorney General. That act allows civil penalties of up to $20,000 per violation, counted per consumer or transaction. Until 2030 the Attorney General must first offer a 60-day cure, unless the violation was knowing or repeated.

Is Colorado AI Act enforcement suspended?

In effect, yes for now. On April 27, 2026 a federal magistrate judge approved the Attorney General's agreement not to start enforcement or investigations under SB 24-205 or its replacement until 14 days after the court rules on xAI's preliminary-injunction motion, which comes after the state's rules are final.

Colorado AI Act Compliance: What SB 26-189 Requires in 2027

A person's hands typing on a laptop in a dim room Image: Unsplash.

If you landed here with last year's to-do list for the Colorado AI Act, put it down. Impact assessments, risk management programs and annual reviews belonged to SB 24-205, and that law never took effect. SB 26-189, signed on May 14, 2026, repeals and reenacts the whole part of the statute (bill page). The new duties are smaller and more concrete: tell people before an automated tool weighs in, explain yourself after a "no", fix wrong data, and let a person reconsider.

We read the 24-page signed act end to end. The checklist and the two templates below follow its wording, section by section.

Where things stand on October 15, 2026

The law: SB 26-189 applies to consequential decisions made on or after January 1, 2027 (signed act, section 5). The Attorney General must adopt rules on the adverse-outcome disclosure and the consumer rights by the same date.

The rules: the Department of Law filed proposed rules on August 11, 2026 and posted an interim draft on October 6. Written comments are open through October 26, 2026, the day of the public hearing in Denver (coag.gov/ai). The final text could change what the 30-day letter must contain, so treat Template 2 as a draft until the rules are adopted. Our Colorado ADMT comment letter template covers the comment process.

The lawsuit: xAI sued Attorney General Phil Weiser in April (X. AI LLC v. Weiser, No. 1:26-cv-01515, D. Colo.), and the United States joined as a plaintiff. On April 27, 2026, Magistrate Judge Cyrus Y. Chung granted a stipulated motion. The Attorney General "shall not initiate enforcement, including but not limited to the initiation of an investigation" for violations of SB 24-205 "or any legislation replacing or amending SB24-205" that occur up to 14 days after the court rules on xAI's preliminary-injunction motion. xAI files that motion within 28 days after the rules are final (minute order).

Page 1 of the April 27, 2026 minute order in X. AI LLC v. Weiser, showing the Attorney General's agreement not to initiate enforcement of SB24-205 or replacement legislation Screenshot: Minute order, X. AI LLC v. Weiser, ECF No. 24, U.S. District Court for the District of Colorado, via CourtListener.

So the date in the statute and the date the Attorney General can act are now different. We'd still build for January: the order pauses one enforcer, not the law, the pause ends on a schedule set by the rules and the court, and SB 26-189 says nothing in it limits existing anti-discrimination claims.

Who has to do this

You're a deployer if you do business in Colorado and use a "covered ADMT", meaning automated decision-making technology whose output is a non-de minimis factor that affects the outcome of a consequential decision. There's no employee-count threshold in the definition.

Consequential decisions are about access, eligibility, selection, pay or pricing in seven areas: education, employment, buying or leasing housing in Colorado, financial or lending services, insurance, health care, and essential government services and benefits.
Consumers include employees, job applicants who are Colorado residents, and anyone whose access to an opportunity in Colorado is evaluated by a business operating there.
Not covered: a tool someone uses only to summarize, organize, translate, draft or route information for human review; routine scheduling, customer service triage and workflow management; advertising, search and content moderation; fraud, cybersecurity and anti-money-laundering tools.
Sector carve-outs: insurers that already comply with Colorado's insurance algorithm statute (10-3-1104.9) are deemed compliant in the practice of insurance. HIPAA covered entities are out except for employment decisions. FDA-regulated medical devices are out. A creditor whose ECOA or FCRA adverse action notice also meets the Colorado content doesn't need a second notice.

If you buy the tool, you're the deployer. If you sell or license it for these decisions, you're a developer and owe your customers documentation (see the vendor list below).

The deployer checklist

Duty	When	Section
Clear and conspicuous notice that a covered ADMT is or will be used, with instructions for getting more information	Before the tool influences the decision	6-1-1704(1)
A prominent public notice at the point of interaction (a link or posting next to the application) satisfies the notice	Ongoing	6-1-1704(2)
Plain-language description of the decision and the tool's role; how to request the tool's name, version, developer and the types and sources of personal data; the consumer's rights and how to use them	Within 30 days after an adverse outcome	6-1-1704(3)
On request after an adverse outcome: instructions to get and correct factually incorrect or materially inaccurate personal data	On request	6-1-1705(1)(a)(I)
On request: meaningful human review and reconsideration, "to the extent commercially reasonable"	On request	6-1-1705(1)(a)(II)
Notices accessible to people with disabilities and limited English proficiency	Every notice	6-1-1704(8)
Records showing compliance, such as tool version identifiers and changelogs	Keep at least 3 years after each decision	6-1-1703

What isn't on the list matters as much. We found no impact assessment, no bias audit, no risk management program, no annual review and no duty to report discrimination to the Attorney General anywhere in sections 6-1-1701 to 6-1-1709.

Page 11 of Colorado SB 26-189 showing section 6-1-1704(1) to (3): the notice before use, the public posting option and the 30-day post-adverse outcome disclosure Screenshot: SB 26-189 signed act, page 11 (section 6-1-1704), Colorado General Assembly.

Template 1: point-of-interaction notice

Post this as a link or short block next to the form or step where the decision happens (job application, loan application, rental screening). Replace the brackets.

How we use automated tools in [hiring / lending / tenant screening] decisions

[Company name] uses [tool name or plain description, e.g. "software that scores applications against the job requirements"] to help make decisions about [your application / your eligibility for X]. The tool's output is one factor in the decision; [a member of our team reviews it before a final decision / describe the actual process].

If you receive an unfavorable decision, we'll send you, within 30 days, a plain-language explanation of the decision and the tool's role, and instructions to request more information about the tool and the personal data used.

You can then ask us to correct personal data you believe is inaccurate and ask for a person to review and reconsider the decision. Contact: [email / form link]. This notice is available in [languages] and in accessible formats on request.

Template 2: adverse-outcome explanation (within 30 days)

Send this within 30 days after the decision. Check it against the Attorney General's final rules before January.

Subject: About our decision on your [application / request] of [date]

We decided to [decline / offer different terms on] your [application / request]. Here is how an automated tool was involved.

What we decided and why: [one or two sentences in plain language].

The tool's role: [e.g. "A screening tool ranked applications against the posted requirements. Your application ranked below the cut-off we used to choose interviews, and a recruiter confirmed the shortlist."]

More about the tool and your data: you can ask us for the tool's name, its version, who makes it, and the types, categories and sources of personal data we used. [If anything is withheld as a trade secret or by law, say so here.] Request it at [contact] and we'll reply within [X] days.

Your rights: you can ask for the personal data we used and ask us to correct anything factually incorrect or materially inaccurate. You can also ask that a person review and reconsider this decision. Reply to this message or use [link].

Handling correction and human review requests

A man and a woman talking across a desk in a wood-paneled office Image: Pexels, used under the Pexels License.

The law defines "meaningful human review" tightly enough that a rubber stamp won't pass. The reviewer must have authority to approve, modify or override the decision, be trained for the review, consider relevant primary evidence, "not default to the system output", and have enough information to understand the output's intended use, its material limitations, its input categories and the principal factors behind it. You don't have to hand over source code or model weights.

Corrections cover facts, not judgments: the law says you don't have to correct "opinions, predictions, scores, or protected evaluations." If an applicant's employment dates were wrong, fix them and rerun; if they disagree with the score, that's a human review request.

For a small team, one named reviewer per decision type, a log with the request date, what was reviewed and the outcome, and a target response time is a reasonable setup. That log is also part of the three-year record.

What to ask your vendor

Developers owe deployers, from January 1, 2027, the following. Put it in the renewal or the order form:

A general statement of intended uses and known harmful or inappropriate uses
The categories of data, including personal data, used to train the tool, to the extent known
Known limitations, risks and situations where the tool shouldn't be used
Instructions for appropriate use, monitoring and meaningful human review
Anything else you need for the 30-day letter (tool name, version, data sources), and notice if they withhold something
Notice of material updates and changes to intended use or limitations, within a reasonable time (public release notes count only if they tell you directly)

One contract point: a clause that has either side indemnify the other for its own acts under Colorado anti-discrimination law is void as against public policy. Don't count on that kind of indemnity from a vendor.

Penalties and enforcement

A violation is a deceptive trade practice under the Colorado Consumer Protection Act, enforced only by the Attorney General. The Consumer Protection Act sets civil penalties of up to $20,000 per violation, and each consumer or transaction counts separately (C.R.S. 6-1-112(1)(a)). Before suing, the Attorney General must send a notice of violation and allow 60 days to cure when a cure is possible; that step isn't required for knowing or repeated violations, and it expires on January 1, 2030. SB 26-189 creates no new private right of action, and it doesn't limit claims under the Colorado Anti-Discrimination Act or other existing law.

What this checklist doesn't cover

The final rules. The Attorney General's rules may add sector-specific content to the 30-day letter and clarify "materially influence".
Discrimination liability. A developer or deployer can still be sued under state anti-discrimination law for a decision a covered tool materially influenced, with fault split by relative responsibility. Testing your tool for disparate impact is still wise; this law just doesn't order it.
Other states. Colorado's chatbot law (HB 26-1263) is a separate statute; see the Colorado Chatbot Safety Act guide.

What we could not confirm: whether xAI has filed its preliminary-injunction motion. CourtListener's copy of the docket, read October 15, 2026, lists no such motion and ends with an October 2 filing. We read the penalty section in the 2024 edition of the Colorado Revised Statutes published by the legislature.

Correction (October 15, 2026): Earlier versions of this page were a guide to SB 24-205. They gave a 7-step plan and templates for impact assessments, a risk management policy, a transparency statement and a 90-day report to the Attorney General, and said parts of that plan applied in 2027. SB 26-189 repealed and reenacted SB 24-205 before it took effect, and none of those duties exist in it. The page now covers SB 26-189. The earlier title called enforcement "suspended" by a judge; the April 27, 2026 order approved the Attorney General's own agreement to pause enforcement, and that pause also covers SB 26-189.

References

Colorado General Assembly, SB26-189 bill page and signed act (PDF)
Colorado Attorney General, Automated Decision-Making Technology & Chatbot Safety Rulemaking
U.S. District Court for the District of Colorado, Minute order of April 27, 2026, X. AI LLC v. Weiser, No. 1:26-cv-01515 and docket
Colorado Revised Statutes 2024, Title 6 (C.R.S. 6-1-112)

Colorado AI Act: from SB 26-189 to the 2027 rules