Colorado AI Act: What the Replacement Law Requires From 1 January 2027

People still say Colorado AI Act, but the law behind the name changed. The Colorado General Assembly's bill page describes SB 26-189 as repealing and reenacting the provisions of SB 24-205 with new requirements for automated decision-making technology used in consequential decisions.

The bill moved fast. It was introduced on 1 May 2026, passed the Senate 34 to 1 on 7 May and the House 57 to 6 on 9 May, and was signed on 14 May. It is now Session Law Chapter 131.

Davis Wright Tremaine summarizes the change in approach. The 2024 act regulated high-risk AI systems through a duty of care, risk assessments and notices to the Attorney General. The replacement regulates the moment a decision is made about a person, through notices and rights.

The first source for each row is the General Assembly's own bill summary. Where the summary is silent, the row relies on law-firm alerts written in May 2026, and the table says so.

We did not read the enrolled bill text. The summary on the bill page is written by legislative staff and is shorter than the act.

The original act was due to apply on 1 February 2026. The research notes record that a 2025 special-session bill, SB 25B-004, moved that to 30 June 2026. Baker Botts also gives 30 June 2026 as the date the 2024 act had been extended to.

On 9 April 2026, xAI sued the Colorado Attorney General in federal court, raising six constitutional claims against the 2024 act, according to the Civil Rights Litigation Clearinghouse. The United States moved to intervene as a plaintiff on 24 April and the court allowed it the same day.

On 27 April 2026 a magistrate judge granted a joint motion by the parties. The Attorney General may not start enforcement for violations occurring on or before 14 days after the court rules on a preliminary injunction motion that xAI has yet to file. The legislature passed the replacement two weeks later.

The bill summary defines automated decision-making technology as technology that processes personal data and uses computation to generate output, such as predictions, recommendations, classifications, rankings or scores, that is used to make, guide or assist a decision about an individual. A covered tool is one used to materially influence a consequential decision.

A consequential decision relates to a person's access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits.

Davis Wright Tremaine adds detail from the bill text. An output materially influences a decision when it is more than a trivial factor that affects the outcome. Tools without machine learning, such as spreadsheets and calculators, and tools that only summarize information for a human are outside the definition. The consumer definition includes Colorado employees and job applicants.

The same alert lists exemptions. Insurers subject to Colorado's insurance algorithm law are generally deemed compliant. HIPAA-covered entities are largely exempt. Uses for fraud prevention, cybersecurity and identity verification are excluded from consequential decisions.

A deployer is the business that uses the tool on people. The bill summary requires a clear and conspicuous notice to consumers at the point of interaction with a covered tool. Davis Wright Tremaine says the notice must state that the tool is or will be used in a consequential decision and explain how to get more information and request review.

When a covered tool contributes to an adverse outcome, the deployer has 30 days to give the consumer a plain-language description of the tool's role. An adverse outcome, per the alert, includes a denial, a termination, or materially worse pricing or terms than similar consumers receive.

The consumer can then ask for the personal data that was used, ask for factually incorrect data to be corrected, and ask for meaningful human review and reconsideration. Human review is owed to the extent commercially reasonable. The reviewer must have authority to change the decision and must not simply defer to the automated output.

All of these notices must be accessible to people with disabilities and to people with limited English proficiency. Deployers must keep records that show compliance for at least three years.

From 1 January 2027, a developer must provide deployers with technical documentation. The bill summary lists the contents: the tool's intended uses, the categories of training data, known limitations, and instructions for appropriate use and human review.

Developers must also notify deployers of material updates or modifications, and keep compliance records for at least three years. The duties run from vendor to customer. The 2024 act's notices from developers to the Attorney General are gone.

Liability between the two is shared by fault. For discrimination claims under existing state law that arise from a covered decision, the act allocates liability by relative fault. Davis Wright Tremaine notes that a developer is generally not liable when a deployer uses the system outside its documented use, and that contract terms shifting liability for a party's own violations are void.

For a business that spent 2025 building toward the 2024 act, the question is what work is still needed. Baker Botts notes that organizations with programs built for SB 24-205 must decide whether to update them before 1 January 2027.

The comparison below follows the Davis Wright Tremaine and Baker Botts alerts.

A violation is treated as a deceptive trade practice under the Colorado Consumer Protection Act. The Attorney General has exclusive authority, and Davis Wright Tremaine says the statute expressly rules out a private right of action. The alert gives no penalty amounts.

Before bringing an action that begins before 1 January 2030, the Attorney General must give the developer or deployer 60 days' notice and a chance to cure, if a cure is possible. Baker Botts and Davis Wright Tremaine both note that no cure period applies to knowing or repeated violations.

The enforcement budget is small. Baker Botts reports that the bill appropriates $46,190, based on 0.4 of an additional full-time position. That says something about expected volume, though it does not limit what the office may do.

The xAI case is on hold. The Clearinghouse docket, updated on 12 November 2026, shows no preliminary injunction motion and no amended complaint. Its latest entry is an attorney withdrawal on 2 October 2026. A second tracker, AI Challenge Watch, lists the case as suspended while it waits to see whether xAI will pursue its claims.

Sources read the pause order differently. Davis Wright Tremaine wrote in May that xAI's motion was due within 28 days of the replacement legislation, which it put at 11 June 2026. AI Challenge Watch reads the deadline as 28 days after implementing rules are finally adopted. The docket showing no motion is more consistent with the second reading, but we did not open the order itself.

The other open item is rulemaking. The Attorney General must adopt rules on the content and format of adverse-outcome disclosures by 1 January 2027. The Attorney General's rulemaking page did not load when we tried to read it, so we could not confirm whether rules have been proposed or adopted. Check that page and the docket in December.