Colorado SB 26-189 vs. the Old AI Act: What Actually Changed

The repeal-and-replace

SB 26-189, signed May 14, 2026, repeals and reenacts C.R.S. Title 6, Article 1, Part 17 — the section the 2024 Colorado AI Act (SB 24-205) had created — as "Automated Decision-Making Technology in Consequential Decisions" (C.R.S. 6-1-1701 to 6-1-1709). It takes effect January 1, 2027 and applies to consequential decisions made on or after that date.

What's gone

• Impact assessments. The old law's annual impact-assessment duty for high-risk systems does not exist in the reenacted Part 17.
• Risk-management programs. The mandatory NIST-style risk-management framework is gone.
• The NIST/ISO affirmative defense. Compliance frameworks no longer buy a statutory defense.
• The "algorithmic discrimination" / "high-risk AI system" architecture. Replaced wholesale by "covered automated decision-making technology" that "materially influences" a "consequential decision."

If your vendor's marketing or your internal policy still references SB 24-205 impact assessments, it is describing a repealed law.

What replaced it

• A two-element pre-use notice. Before using a covered ADMT to materially influence a consequential decision: a clear and conspicuous notice that the technology is or will be used, plus instructions for getting more information (6-1-1704(1)). A prominent public posting at the point of interaction — a careers-page link near the application — satisfies it (6-1-1704(2)). Tool purpose and human-review rights are not pre-use elements.
• The 30-day adverse-outcome disclosure. After an adverse outcome, the employer has 30 days to provide: a plain-language description of the decision and the ADMT's role; instructions for requesting details about the tool and its data (name, version, developer, data types and sources); and an explanation of the consumer's rights (6-1-1704(3)).
• Rights on request, not by default. After an adverse outcome the individual may request their data, correction of factually incorrect data, and meaningful human review and reconsideration "to the extent commercially reasonable" (6-1-1705).
• Three-year records. Deployers keep records sufficient to demonstrate compliance for at least three years after each consequential decision (6-1-1703).
• Developer duties. Vendors must supply intended-use statements, training-data categories, known limitations, and everything the employer needs to comply — with update notices (6-1-1702).

Details employers miss

• Employees and applicants are "consumers." The definition expressly includes employees and Colorado-resident job applicants (6-1-1701(4)(b)); employment is a covered domain (6-1-1701(6)(b)).
• No small-business exemption. The reenacted Part 17 has none — the exemptions (insurers, HIPAA entities, FDA devices) expressly do not cover those entities' own employment decisions (6-1-1708).
• Enforcement is AG-only. Violations are deceptive trade practices under the Colorado Consumer Protection Act, enforced exclusively by the Attorney General, with a 60-day cure where the AG deems cure possible — waived for knowing or repeated violations. No new private right of action; existing anti-discrimination remedies are preserved, with fault allocated between developers and deployers and developer-deployer indemnification clauses void (6-1-1706, 6-1-1707, 6-1-1709).
• AG rules are coming. The Attorney General must adopt rules clarifying the adverse-outcome disclosure content on or before January 1, 2027 (6-1-1704(4)) — re-check your letter templates against them before the effective date.

The dates

• May 14, 2026 — SB 26-189 signed; SB 24-205 regime repealed before ever taking effect.
• On or before January 1, 2027 — AG clarifying rules due on adverse-outcome disclosures.
• January 1, 2027 — the law takes effect and applies to consequential decisions made on or after this date.