Colorado SB 26-189: Automated Decision-Making Technology Act
Issued by
Colorado General Assembly
- September 30, 2026 · Correction — Updated to the enacted law: signed 14 May 2026, effective 1 January 2027, with its final obligations and enforcement. Checked against the Governor's office, Holland & Knight and Baker Botts. (Cody Maxwell)
- September 30, 2026 · Correction — Added the April 2026 court order in xAI v. Weiser that pauses enforcement until after rulemaking and a ruling on xAI's motion (fact-check finding). (Cody Maxwell)
- October 1, 2026 · Correction — Rewrote the practical steps, newsletter hook, search description, and audience fields to match the entry's corrected content. (Cody Maxwell)
Colorado's SB 26-189, signed on 14 May 2026, repeals and replaces the state's 2024 AI Act. From 1 January 2027 it regulates automated decision-making technology used in consequential decisions about consumers. Deployers must give notice before use, explain adverse outcomes, and offer human review. Developers must give deployers the information they need.
Applies To
Overview
Governor Jared Polis signed SB 26-189 on 14 May 2026. It repeals and reenacts Colorado's 2024 AI Act (SB 24-205), which never took effect. The new law applies to decisions made on or after 1 January 2027. It covers automated decision-making technology (ADMT) that materially influences consequential decisions about Colorado consumers. Those are decisions about education, employment, housing, financial and lending services, insurance, healthcare, and essential government services. It drops the old law's broad duty of reasonable care against algorithmic discrimination, its mandatory risk management programs, and its annual impact assessments. Developers must tell deployers about intended and known harmful uses, the categories of training data, known limitations, and material updates. Deployers must give clear notice before using covered ADMT in a consequential decision. After an adverse outcome, they must explain within 30 days the decision and the role the technology played. Consumers can ask for meaningful human review by trained staff who can change the outcome. Deployers must keep compliance records for three years. The Colorado Attorney General has exclusive enforcement authority, and violations count as deceptive trade practices. The Attorney General must usually give 60 days' notice to cure first. There is no private right of action. Enforcement is on hold under an April 2026 court order in xAI v. Weiser. The Attorney General will not enforce the law until 14 days after the court rules on xAI's planned preliminary injunction motion. xAI will file that motion within 28 days after rulemaking under the law is final.
Key Requirements
- •Give consumers clear and conspicuous notice before using covered ADMT in a consequential decision.
- •After an adverse decision, explain within 30 days the decision and the role the technology played.
- •Offer meaningful human review on request, by trained staff with authority to change the outcome.
- •Developers must give deployers intended uses, known harmful uses, training data categories, and known limitations.
- •Keep compliance records for three years.
- •Enforcement is by the Attorney General under the Colorado Consumer Protection Act, usually after a 60-day cure notice. A court order currently pauses enforcement.
What Your Organization Must Do
- →Map which automated tools materially influence decisions on jobs, credit, housing, insurance, health, education or government services in Colorado.
- →Draft clear notices that tell consumers before a covered tool is used in such a decision.
- →Build a process to explain adverse decisions within 30 days, including the tool's role.
- →Train staff to perform meaningful human review on request, with authority to change outcomes.
- →Ask vendors in writing for intended uses, known harmful uses, training data categories and known limitations.
- →Track the xAI v. Weiser litigation and rulemaking, since enforcement is paused for now.