What happened

Colorado's original Artificial Intelligence Act, SB 24-205, was delayed once and was due to apply from 30 June 2026. Before that date, the governor signed SB 26-189 in mid-May 2026, which repeals and re-enacts the statute. Law-firm analyses describe the replacement as a narrower automated decision-making technology framework built around disclosure, taking effect on 1 January 2027 for decisions made on or after that date.

Several summaries note that the heavier duties of the original design - risk management programs, impact assessments, and a general duty of care - are not part of the new framework. They also report federal litigation challenging the earlier law, including a court stay of enforcement in spring 2026. Details of that litigation vary between sources, so check current status.

If you built a compliance program around the original Colorado Act, do not discard it. Much of that governance work, including inventories and documentation, still helps with other laws and with customer due diligence.

What disclosure-style laws mean for engineering

A disclosure framework still requires things to be built. If your product uses automated tools to make or substantially influence consequential decisions about people, you need to know where those decisions happen, be able to tell affected people about the use of automation, and handle questions or corrections from them.

That points to concrete work: a record of which decision points use automated tools, notices that appear at the right moment, a way to route a person's question to someone who can explain the outcome, and logging that lets you reconstruct what happened.

Map decision points

List every place an automated tool makes or shapes a decision about an individual, and what that decision affects.

Build the notice and the route

Show the disclosure at the right time and give people a working path to ask about or contest an outcome.

Plan for the state-by-state reality

Colorado is one data point in a patchwork. Rather than rewriting your program for each state, anchor it to a recognized framework and a single system inventory, then map each state's specifics onto it. Our article on the federal preemption fight explains why waiting for a single national rule has not been a safe strategy so far.

Before relying on any detail here, read the enacted text of SB 26-189 and any later amendments or court developments.

Unsure which of your products make consequential automated decisions? Talk to us about a quick scoping review.

Key takeaways

  • Colorado repealed and re-enacted its AI Act through SB 26-189, a narrower automated decision-making disclosure law reported to apply from 1 January 2027.
  • Risk management programs, impact assessments, and a general duty of care are reported as dropped from the new framework.
  • Disclosure still needs engineering: a decision-point map, well-timed notices, a path to ask or contest, and logging.
  • Anchor your program to one inventory and a recognized framework, then map each state onto it.
This is general information, not legal advice. Details are drawn from law-firm and press summaries as of October 2026, which differ in places; read the enacted statute and current court filings before relying on them.