Not sure where to start? Answer 3 questions and get a tailored compliance action plan.
What applies to me? →Colorado Senate Bill 189: Automated Decision-Making Technology Act
Issued by
Colorado General Assembly
Colorado SB 189 repeals the Colorado AI Act (SB 205) and replaces it with the Automated Decision-Making Technology Act, effective January 1, 2027. The bill shifts the regulatory focus from high-risk AI systems to a broader category of automated decision-making technology used in consequential decisions affecting Colorado consumers. It removes several obligations from the prior law, including mandatory risk management programs, annual impact assessments, and the reasonable care standard for algorithmic discrimination.
Applies To
Overview
SB 189 was introduced in the Colorado General Assembly as a replacement for the Colorado Artificial Intelligence Act (SB 205), which had been scheduled to take effect in 2026. The new bill reframes the scope of Colorado's AI regulation around automated decision-making technology rather than the high-risk AI system classification inherited from the EU AI Act model. Key provisions of the prior law that are eliminated include requirements for developers and deployers to exercise reasonable care to prevent algorithmic discrimination, mandatory enterprise-level risk management programs, and annual impact assessments. The bill establishes a revised set of obligations focused on transparency and consumer rights in the context of automated decisions. Enforcement mechanisms and penalty structures under the new framework remain subject to legislative finalization as the bill moves through the General Assembly. Enterprises that built compliance programs around SB 205 obligations will need to reassess their frameworks to align with the restructured requirements before the January 1, 2027 effective date.
Key Requirements
- •Repeals Colorado AI Act (SB 205) in full, eliminating its existing obligations for developers and deployers of high-risk AI systems.
- •Redefines the regulated category as automated decision-making technology, broadening or reorienting the scope beyond the prior high-risk AI classification.
- •Removes the requirement for developers and deployers to exercise reasonable care to prevent algorithmic discrimination.
- •Eliminates mandatory risk management program requirements previously applicable to enterprise AI deployers.
- •Removes the obligation to conduct annual impact assessments on high-risk AI systems.
- •Targets consequential automated decisions affecting Colorado consumers, with final obligations, thresholds, and penalties subject to enactment of the bill.
What Your Organization Must Do
- →Suspend or place on hold compliance workstreams built specifically around Colorado AI Act (SB 205) obligations pending final enactment of SB 189.
- →Audit existing AI and automated decision-making systems to identify which tools affect Colorado consumers, as the new scope may differ materially from the prior high-risk classification.
- →Review and revise internal risk management program documentation to reflect that SB 205 requirements are being repealed and the replacement framework is not yet finalized.
- →Monitor the Colorado General Assembly legislative calendar for SB 189 amendments, committee votes, and final passage to establish accurate compliance deadlines.
- →Update vendor and procurement contracts to remove or conditionally suspend SB 205-specific conformity clauses, and prepare to insert SB 189 obligations once the final text is enacted.
- →Brief senior leadership and legal counsel that the January 1, 2027 effective date creates a limited runway and that compliance program redesign should begin before final text is confirmed.