Colorado's AI Act did not survive long enough to take effect. Governor Jared Polis signed Senate Bill 26-189 on May 14, 2026, repealing and reenacting the state's original AI law, Senate Bill 24-205, before a single compliance deadline under it ever arrived. Per Holland & Knight's May 2026 client alert on the signing, the replacement law pushes Colorado's AI compliance deadline to January 1, 2027 and drops the duty-of-care and annual impact-assessment regime that made the original statute one of the most demanding AI laws in the country.
SB 189 is not a rollback to no regulation. It swaps the old "high-risk AI system" framework for a narrower one built around automated decision-making technology, and it adds a liability structure the original law never had. Businesses that spent two years bracing for SB 205's risk-management paperwork now face a shorter, different list, tied to a rulemaking process that has not finished yet.
Source: Holland & Knight, "Colorado Governor Signs SB 189, Significantly Amending the State's AI Law," captured August 2026.
Why Colorado repealed a law that had not taken effect yet
SB 205 was already on its second delay before Polis signed anything new. The law was originally set to bind businesses on February 1, 2026, then pushed to June 30, 2026, and SB 189 does not just move that date again, it repeals SB 205 outright and reenacts a revised version in its place. The new effective date is January 1, 2027.
Figure: Colorado's AI law compliance deadline moved twice before the state repealed and reenacted the underlying statute. Source: Holland & Knight, May 2026 client alert.
The pressure behind the rewrite was political as much as practical. President Trump's December 2025 executive order on "Ensuring a National Policy Framework for Artificial Intelligence" named SB 205 as an example of "excessive State regulation" and directed federal agencies to challenge state AI laws seen as inconsistent with federal deregulatory policy. A large AI developer then filed a federal lawsuit in April 2026 challenging SB 205's constitutionality, and the U.S. Department of Justice intervened in support of that challenge. SB 189 landed a month later.
What SB 189 actually requires
The new law covers "automated decision-making technology," or ADMT, used to materially influence a consequential decision: access to education, employment, housing, financial services, insurance, healthcare, or essential government services. That is a lower bar than SB 205's old test. SB 205 covered systems that infer from inputs and generate an output; ADMT requires no inference at all, so a system that simply checks whether an answer falls inside an acceptable range can qualify.
Developers, meaning any business that creates, sells, licenses, or substantially modifies a covered ADMT, have to give deployers documentation describing intended and known harmful uses, the categories of training data used, known limitations and risks, and instructions for human review, plus notify deployers of material updates and keep records for at least three years. Deployers, the businesses actually using the technology, have to give consumers clear notice before an ADMT materially influences a consequential decision, a requirement a prominent, linked public notice can satisfy, and a plain-language notice after any adverse outcome that explains the decision, the ADMT's role in it, and how to request more information or a human review.
What got cut, and what got added instead
Three of SB 205's heaviest obligations are gone entirely under SB 189: the duty to use reasonable care to prevent algorithmic discrimination, mandatory risk-management programs for deployers, and annual impact assessments. In their place, the new law adds sector-specific carve-outs that SB 205 never had. HIPAA-covered entities are broadly exempt from core obligations outside employment uses, insurers already following Colorado's existing algorithmic-discrimination rules are deemed compliant, creditors meeting Equal Credit Opportunity Act and Fair Credit Reporting Act notice requirements do not owe a duplicate disclosure, and FDA-regulated medical devices are excluded outright.
SB 189 also introduces a liability and indemnification framework SB 205 never addressed. Fault for a discriminatory ADMT-related decision is allocated by relative responsibility rather than automatic joint liability, developers are shielded from a deployer's off-label use of their technology, and contract clauses that try to make one party indemnify another for its own discriminatory acts are void outright, which is reason enough to have AI vendor contracts reviewed before the January 2027 deadline. Colorado is not alone in narrowing an AI law after a rocky rollout: Texas took a different route to a similarly business-friendly result, folding AI deception into its existing consumer-protection statute rather than building a bespoke risk framework, as covered in our look at Texas' Responsible AI Governance Act.
Enforcement, cure periods, and the rulemaking still pending
Enforcement authority sits exclusively with the Colorado Attorney General, with no private right of action, and violations are treated as deceptive trade practices under the state's Consumer Protection Act. Before bringing an enforcement action, the Attorney General has to issue a notice of violation and give the business 60 days to cure it, unless the violation was knowing or repeated. That cure right is not permanent: it sunsets January 1, 2030.
The rulemaking is the part still moving. The Attorney General has to adopt rules clarifying post-adverse-outcome disclosure requirements and consumer rights by January 1, 2027, the same day the law takes effect, and holds broader discretionary authority to define "materially influence" through presumptions and examples. As of this post's publish date, that rulemaking has not been finalized, so some of the practical detail businesses need to comply is still being written. Colorado now joins a small group of states with a live, binding AI disclosure obligation rather than a delayed one; our comparison of Tennessee, Hawaii, and Washington's AI chatbot disclosure laws covers the narrower, product-specific end of that same 2026 wave.
What this means for your disclaimer
If your business uses AI to help decide who gets hired, insured, approved for credit, admitted, housed, or treated in Colorado, SB 189 is the law you now have until January 1, 2027 to satisfy, not SB 205's original, harsher version. That is a real reprieve for the risk-assessment paperwork, but it is not a reason to do nothing: the consumer-notice requirements, the three-year recordkeeping duty, and the new void-indemnification-clause rule all need attention before the deadline, and the rulemaking still to come may add specifics that are not public yet.
A disclaimer that already states when and how your site uses AI in a decision that affects a visitor is most of the notice obligation handled in advance. Our Disclaimer Generator includes AI-use disclosure language you can add now, and if you are not sure whether that belongs in a disclaimer or in your site's terms, our guide to what a disclaimer covers versus a terms and conditions page walks through the distinction.
The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.
