Colorado AI Act Enforcement Suspended: What the April 27 Court Order Means

On April 27, 2026, a U.S. District Court for the District of Colorado ordered the Colorado AG not to enforce SB 24-205 until implementing rulemaking is complete. Here is what that actually means.

TL;DR: On April 27, 2026, a U.S. District Court for the District of Colorado ordered the Colorado Attorney General not to enforce SB 24-205 until the AG's implementing rulemaking is finalized. The law itself has not been repealed, the statutory June 30, 2026 date remains. SB 189, the replacement bill, passed both chambers (Senate May 7, House May 9, 2026) and was signed by Governor Polis on May 14, 2026. It replaces SB 24-205 with a narrower 'automated decision-making technology' framework and sets an effective date of January 1, 2027. What this means for your team: enforcement is paused and the law has been replaced. Stop treating June 30 as a hard deadline, prepare for January 1, 2027 under SB 189 instead.

What the Court Order Actually Says

A U.S. District Court for the District of Colorado issued an order on April 27, 2026 enjoining the Colorado Attorney General from enforcing SB 24-205 (the Colorado Artificial Intelligence Act) until the AG has finalized its implementing rulemaking under the Act.

The lawsuit was brought by xAI (Elon Musk's AI company) and joined by the U.S. Department of Justice, both challenging the law's constitutionality and scope. The Colorado AG agreed to the enforcement stay rather than litigating it.

What the order does:

• The AG cannot initiate enforcement actions, investigations, or civil penalties for SB 24-205 violations while the stay is in effect
• The June 30, 2026 statutory date is not changed by the order, that requires legislative action
• The AG's rulemaking process continues, the stay lifts when rulemaking is finalized

What the order does not do:

• It does not repeal the law
• It does not eliminate private liability risk (there is no private right of action under SB 24-205, but related discrimination claims under other laws are unaffected)
• It does not affect federal obligations or EU AI Act requirements

The Replacement Bill

Separately from the lawsuit, SB 189 replaces the SB 24-205 framework. Key changes:

• New definition: Replaces "high-risk AI systems" and "algorithmic discrimination" with "automated decision-making technology", a narrower scope
• New effective date: January 1, 2027 (not June 30, 2026)
• Reduced obligations: Drops the risk assessment requirement; focuses on disclosure when automated decision-making influences a consequential decision

SB 189 passed both chambers of the Colorado legislature, Senate on May 7 and House on May 9, 2026, and was signed by Governor Polis on May 14, 2026. Organizations should prepare for the January 1, 2027 effective date under the new framework rather than the June 30, 2026 date under SB 24-205.

What to Do Now

Governor Polis signed SB 189 on May 14, 2026. The effective framework is now clear:

SB 189 effective January 1, 2027, "automated decision-making technology" framework:

• Inventory AI tools that make or substantially influence consequential decisions
• Review SB 189's disclosure requirements (narrower than the SB 24-205 impact assessment framework)
• Do not invest in SB 24-205-specific documentation (transparency statements, bias testing under the old risk-assessment framework), that framework no longer applies

Residual SB 24-205 risk: The enforcement stay remains in effect pending the xAI preliminary injunction ruling and rulemaking completion. If the court rules against xAI, enforcement could technically resume under the old framework, but the legislative replacement makes this unlikely. Maintain your AI inventory as a hedge.

What Hasn't Changed

The EU AI Act deadline is unaffected. The Colorado enforcement suspension has no bearing on EU AI Act obligations. GPAI model compliance (August 2, 2026) is unaffected. High-risk Annex III systems have a deadline of December 2, 2027 (extended from August 2, 2026 by the EU Digital Omnibus provisional agreement, May 7, 2026). See the EU AI Act deadline guide.

EEOC and federal discrimination law still applies. If your AI hiring tools produce discriminatory outcomes, they create liability under Title VII and EEOC guidance regardless of Colorado's SB 24-205 status.

FTC AI-washing enforcement continues. The FTC continues to pursue cases against companies making false claims about AI capabilities, unrelated to the Colorado law.

The Practical Takeaway

The June 30, 2026 deadline is no longer a hard enforcement trigger. The more realistic timeline is now:

• Now: Keep your AI inventory current; know which tools make consequential decisions
• Q2-Q3 2026: Review SB 189's disclosure requirements, Governor Polis signed SB 189 on May 14, 2026; effective January 1, 2027
• Q4 2026-Q1 2027: Complete compliance under SB 189's framework before January 1, 2027

Do not treat this suspension as a reason to stop AI governance work entirely. SB 189 is now law with a January 1, 2027 effective date, six months is not a long runway for teams that haven't started.

How the SB 189 Consumer Notification Requirement Works in Practice

SB 189 centers on disclosure: when an "automated decision-making technology" substantially contributes to a consequential decision about a Colorado consumer, the consumer must receive a notification and have a pathway to appeal or request human review.

What triggers disclosure under SB 189:

• The system is an automated decision-making technology (makes or substantially contributes to a decision)
• The decision is "consequential", defined as having a significant effect on an individual in the areas of education, employment, healthcare, housing, financial services, or legal services
• A Colorado consumer is affected

What the notification must include:

• That an automated decision-making system was used
• A plain-language description of the system's role in the decision
• Contact information for submitting a correction request or appeal
• The right to request human review of the automated decision

Operationally, this means teams need a disclosure template for each consequential automated decision workflow and a documented human review pathway. The human review does not need to be a formal appeal board, it needs to be a real process by which a consumer's challenge reaches a human who has the authority to change the outcome.

For small teams building this for the first time: map each AI-assisted decision workflow, draft a disclosure notice for each (two to three sentences is sufficient if they cover the required elements), and document who receives correction requests and how they are handled. This documentation is what regulators will ask for when SB 189 enforcement begins.

The xAI Lawsuit and What Happens to SB 24-205

The xAI preliminary injunction proceeding is ongoing alongside the SB 189 legislative replacement. The practical question is whether the court ruling matters given that SB 189 has already superseded SB 24-205.

The answer depends on whether the injunction ruling addresses the constitutionality of the underlying regulatory approach or only the specific enforcement mechanism. If the court rules broadly that Colorado-style algorithmic accountability laws are unconstitutional under the Commerce Clause or First Amendment, that ruling could affect SB 189 as well. If the ruling is narrow, focused on the AG's enforcement authority under SB 24-205 before rulemaking was complete, it may have limited effect on the new statutory framework.

For compliance planning purposes: continue preparing for SB 189. The legislative replacement is the more certain compliance environment. Monitor the xAI ruling for constitutional holdings that could create uncertainty about SB 189's enforceability, but do not treat the litigation as a reason to pause SB 189 preparation. The January 1, 2027 effective date stands unless a court issues a separate stay against SB 189.

What SB 189 Actually Requires

Since SB 189 is now signed law with a January 1, 2027 effective date, teams that have been tracking SB 24-205 need to understand the scope change. SB 189 is meaningfully narrower in two respects.

"Automated decision-making technology" replaces "high-risk AI system." The SB 24-205 framework was built around the concept of high-risk AI systems, a term borrowed from the EU AI Act and defined to include AI affecting employment, education, housing, financial services, and healthcare. SB 189 replaces this with "automated decision-making technology," which is defined around whether the system makes or substantially contributes to a consequential decision with meaningful impact on a consumer's life. The practical difference: SB 189's definition focuses on the decision and its impact rather than the domain in which the AI operates.

Risk assessment requirement is dropped. SB 24-205 required deployers to conduct impact assessments before deploying high-risk AI and to make them available to the Colorado AG on request. SB 189 removes this requirement. The compliance burden for documentation-heavy risk assessments under the old framework is gone under SB 189. What remains is the obligation to disclose when automated decision-making influenced a consequential decision and to provide a mechanism for consumers to appeal or seek human review.

What still applies under SB 189:

• Disclosure obligations when automated decision-making substantially contributes to a consequential decision affecting a Colorado consumer
• A mechanism for consumers to correct inaccurate information used in the automated decision
• An appeal or human review process for consequential automated decisions
• Anti-discrimination requirements, outcomes that discriminate based on protected characteristics remain prohibited

The practical compliance checklist under SB 189 is shorter than SB 24-205 but requires the same foundational work: inventory which AI tools make or contribute to consequential decisions, implement a disclosure mechanism, and build a human appeal pathway. Teams that did this work under SB 24-205 are ahead; they need to update the language to match SB 189's definitions, not start over.

What to Tell Customers and Stakeholders

If you have been communicating to customers or business partners about your Colorado AI Act compliance posture, the enforcement suspension and legislative replacement require a brief update.

The key points to communicate:

• SB 24-205 enforcement has been suspended by court order. Your compliance work under that framework was not wasted, it informed the documentation and process infrastructure that will support SB 189 compliance.
• SB 189 is now signed law, effective January 1, 2027. Your organization is preparing for compliance under the new framework.
• The practical requirements, disclosure of automated decision-making, human review pathways, anti-discrimination obligations, are substantively similar to SB 24-205's core obligations, so compliance posture is being maintained.

For teams that used Colorado AI Act compliance commitments in sales materials, RFP responses, or enterprise agreements, review those commitments to ensure the citation is accurate. References to SB 24-205 as the active obligation should be updated to reference SB 189.

References

• Colorado Newsline, "New bill would narrow scope of Colorado's landmark 2024 AI law," May 4, 2026
• Littler, "Colorado's Artificial Intelligence Law Could Be on the Chopping Block," 2026
• Colorado General Assembly, SB25B-004 Increase Transparency for Algorithmic Systems
• Related: Colorado AI Act compliance guide, implementation steps
• Related: EU AI Act August 2 action plan, deadline still in force

Related Reading

• AI governance guide for small teams
• AI vendor due diligence checklist 2026
• EU AI Act August 2 deadline, still on track