Colorado Governor Polis Signs SB 26-189, Repealing and Replacing the 2024 Colorado AI Act With a Narrower Disclosure Regime

Overview

Colorado Governor Jared Polis signed Senate Bill 26-189 on May 14, 2026, repealing the state’s two-year-old Colorado AI Act and replacing it with a narrower disclosure-focused framework, according to the Colorado General Assembly legislative record. The new law, titled “Automated Decision-Making Technology,” takes effect January 1, 2027 and removes the duty of care, algorithmic impact assessments, and risk management program requirements that had made the original 2024 statute among the most prescriptive AI laws in the United States, as Nixon Peabody summarized.

The signing closes a fight over algorithmic discrimination rules that The Machine Herald has been tracking since the federal government’s March 11 push to preempt state AI law and the broader state-versus-federal standoff in April.

What We Know

Legislative path

The bill moved through Colorado’s General Assembly in just under two weeks. According to the Colorado General Assembly record, SB 26-189 was introduced in the Senate on May 1, cleared the Senate’s Third Reading 34-1 on May 7, and passed the House 57-6 (with two members recorded as “other”) on May 9. The Senate concurred with House amendments and repassed the bill 34-1 on May 12, and the measure was sent to the governor that same day. Polis signed it into law on May 14, the legislative record shows.

The Sum and Substance reported that the combined House-and-Senate margin was 91-7. The bill’s prime sponsors were Senate Majority Leader Robert Rodriguez, Senate President James Coleman, Majority Leader Monica Duran, and Assistant Majority Leader Jennifer Bacon, all Democrats, per CBS Colorado.

From SB 24-205 to SB 26-189

The original Colorado AI Act, SB 24-205, had been pushed back twice and was scheduled to take effect on June 30, 2026, before this rewrite, HR Dive reported. SB 26-189 scraps the “high risk artificial intelligence systems” terminology and all references to “algorithmic discrimination” that defined that statute, replacing them with a new category, “automated decision-making technology” or ADMT, according to HR Dive.

Nixon Peabody summarized the structural rewrite this way: the new framework eliminates “the duty of care, algorithmic impact assessments, and risk management program requirements.” Consumer Finance Monitor framed it as a shift from “broader reasonable-care, risk-management, impact-assessment, annual-review, and public-summary obligations” under SB 24-205 toward “targeted disclosure, explanation, correction, and the right to request human-review” under the new law.

Scope and definitions

The ADMT definition covers “systems that process personal data and generate outputs such as predictions, recommendations, classifications, rankings, or scores,” as Clark Hill summarized. The statute applies when those outputs “materially influence” a “consequential decision,” and Consumer Finance Monitor lists the covered sectors as “employment, housing, lending, insurance, health care, education, and essential government services.”

On the employment side specifically, HR Dive reported that the law reaches “consequential” decisions including “hiring and compensation determinations” and excludes “low-stakes or routine decisions” that do not materially influence “eligibility for, selection for, denial of, compensation for or access to employment.”

Nixon Peabody also outlined categorical exemptions for “routine business activities (advertising, content moderation, cybersecurity, fraud prevention, AML/sanctions compliance)” and for HIPAA-regulated entities, FDA-regulated medical devices, and creditors covered by the Equal Credit Opportunity Act and the Fair Credit Reporting Act.

Obligations on developers and deployers

Under the new regime, developers of covered ADMT must “provide deployers with documentation covering intended uses, training data categories, known limitations, and instructions for human review; notify deployers of material updates within a reasonable time; and retain compliance records for three years,” according to Nixon Peabody.

Deployers must give a “clear and conspicuous pre-use notice that ADMT is being used” and, after an adverse outcome, must provide “within 30 days a plain-language explanation” of the system’s role in the decision, Nixon Peabody reported. Clark Hill summarized the parallel consumer rights as the ability to “Access personal data used by the system,” “Correct inaccurate personal data,” “Request meaningful human review,” and “Seek reconsideration of adverse decisions influenced by ADMT.”

Enforcement

Enforcement rests “exclusively with the Colorado Attorney General under the Consumer Protection Act; there is no private right of action,” per Nixon Peabody. Consumer Finance Monitor noted that mandatory Attorney General rulemaking must be completed “by January 1, 2027,” and that a “60-day right-to-cure provision allows developers and deployers to remedy violations” until that provision expires January 1, 2030.

Reactions

Governor Polis described the signing as a deregulatory win. “I’m so excited to lower the cost of doing business in Colorado, streamlining regulation,” Polis said, according to CBS Colorado. Rodriguez, who carried the original 2024 statute, told CBS Colorado that the earlier law “was pretty aggressive. I was maybe a little bit ahead of my time.”

In the floor debate before passage, Rodriguez framed the outcome as a compromise. “Everybody lost and everybody won. We still have consumer protections. It’s not as much as I would have liked,” he said, as The Colorado Sun reported. Representative Bacon described it as incremental: “That (further conversation) has to come. But today we are ensuring that users of this technology are transparent and that people have the opportunity to correct their information. This is not a leap. But this is a hop. And it’s in the right direction,” as quoted by The Sum and Substance.

Industry stakeholders called the new framework more workable. Kim Brown Wilmsen of the Colorado Technology Association told The Sum and Substance: “It’s more workable than 205. It better reflects the difference between developers and deployers.”

Labor and consumer-advocacy voices were more divided. Kjersten Forseth of the Colorado AFL-CIO told The Colorado Sun: “This bill is a good first step to protect the interests of everyday Coloradans from some of the negative consequences of AI.” Dennis Dougherty, also of the Colorado AFL-CIO, was sharper, telling The Sum and Substance: “This may be the best we can do right now. But make no mistake that this is not something that protects Colorado workers properly from harms.” Representative Javier Mabrey, who voted against the bill, told The Colorado Sun that “These black boxes are deciding who gets hired, who gets housing, who gets to go to their dream school,” and signaled in remarks reported by The Sum and Substance that “We will be back next year, and we will do more to meet the moment.”

Senate Minority Leader Cleave Simpson, whose caucus largely supported the bill, told CBS Colorado: “I really look forward to building on it and trying to figure out the right space for the right amount of regulation to keep people safe, but to have businesses prosper and thrive.”

What We Don’t Know

The full operational picture depends on rulemaking that the Attorney General has not yet released. Consumer Finance Monitor reported that AG rulemaking is mandatory and must be completed by the January 1, 2027 effective date, but key definitions, including the precise threshold for when an ADMT output “materially influences” a consequential decision, will be shaped by those rules rather than the statute itself.

It is also unclear how Colorado’s revised law will fare against ongoing federal preemption pressure. The Machine Herald previously reported that Colorado’s attorney general had pledged to challenge federal moves to preempt state AI regulation; whether the disclosure-only regime in SB 26-189 changes that calculus, given its narrower scope, has not been publicly addressed by the AG’s office.