Home › Compliance Guides › Colorado
The Colorado AI Act, Repealed and Replaced: What SB 24-205 → SB 26-189 Means for Businesses
Enacted (not yet in effect) Primary law: SB 26-189 (Colorado ADMT Law) · SB 26-189 (Colo. 2026)
Colorado made headlines as the first US state to pass a comprehensive AI anti-discrimination law — the Colorado Artificial Intelligence Act (SB 24-205). But that law was repealed and replaced before it ever took effect. Knowing the actual current state of the law matters: planning compliance around a statute that no longer exists is a real risk for businesses. Here is what happened, what is in force in Colorado now, and what is coming.
What the law requires
- Know that SB 24-205 was repealed before taking effect. The original Colorado AI Act would have required developers and deployers of 'high-risk' AI systems to use reasonable care to prevent algorithmic discrimination. After repeated delays, it was repealed and replaced in 2026 before its effective date — so its duties never became operative.
- Plan for SB 26-189, effective January 1, 2027. The replacement law (SB 26-189) is a narrower, transparency-focused ADMT framework. From January 1, 2027, businesses using automated decision-making technology to materially influence consequential decisions (employment, housing, lending, insurance, healthcare) must give consumers pre-use notice and post-decision disclosures; developers must provide deployers technical documentation.
- Apply the privacy law that is already in force. The Colorado Privacy Act (CPA) is in effect today and gives consumers the right to opt out of profiling used for decisions producing legal or similarly significant effects.
- Apply the insurance rule that is already in force. Colorado's insurance algorithmic-discrimination law already constrains insurers' use of external consumer data and AI.
Who must comply
Today: businesses subject to the Colorado Privacy Act (which gives Colorado consumers a profiling opt-out) and insurers subject to Colorado's algorithmic-discrimination insurance law. From January 1, 2027: developers and deployers of covered automated decision-making technology used to materially influence consequential decisions about Colorado consumers, under SB 26-189. The repealed SB 24-205's 'high-risk AI' duties do not apply to anyone, because the law was repealed before taking effect.
Penalties & enforcement
SB 26-189 is enforced under the Colorado Consumer Protection Act by the Colorado Attorney General (civil penalties). The Colorado Privacy Act's profiling and other violations are treated as deceptive trade practices carrying civil penalties up to $20,000 per violation. The insurance algorithmic-discrimination law is enforced by the Insurance Commissioner with penalties up to $3,000 per non-knowing act (up to $30,000 aggregate) and up to $30,000 per knowing act (up to $150,000 aggregate). Note: the AG agreed to suspend SB 24-205 rulemaking and enforcement pending the legislative replacement.
How to comply: a practical checklist
- Do NOT build compliance around SB 24-205 — it was repealed before taking effect and is not in force.
- Honor Colorado Privacy Act consumer rights now, including the opt-out of profiling for decisions with legal or similarly significant effects.
- If you're an insurer, comply with Colorado's existing algorithmic-discrimination insurance rules on external data and AI.
- Begin preparing for SB 26-189's January 1, 2027 ADMT obligations: inventory ADMT used for consequential decisions and design pre-use notice + post-decision disclosure.
- If you're a developer, plan to give deployers the technical documentation SB 26-189 will require.
- Watch for AG rulemaking, which is due ahead of the 2027 effective date — set a watchlist alert so you catch the rules when they drop.
Get an alert the moment this changes
AI law moves fast — effective dates shift, rules get repealed and replaced, new bills pass. Create a free AI Laws USA account, watch the laws on this page, and get an email the moment one of them moves, takes effect, or is challenged. Free for the public, journalists, and students.
Create a free account & set alerts → See team plansThe laws this guide is built on
Every claim above traces to one of these verified entries in our index. Each links to its full record and its official source. Status labels reflect the live dataset as of 2026-06-17.
-
Repealed / replaced Limited protection
Colorado AI Act (repealed)
Colorado · Enacted 2024-05-17 · SB 24-205, Colo. Rev. Stat. § 6-1-1701 et seq. (repealed/replaced 2026)
The first comprehensive US state AI law would have required developers and deployers of 'high-risk' AI systems to use reasonable care to prevent algorithmic discrimination in decisions about jobs, housing, lending, insurance, education, and healthcare. After repeated delays, it was repealed and replaced in May 2026 by a narrower transparency-focused law (SB 26-189) before it ever took effect.
-
Enacted (not yet in effect) Limited protection
SB 26-189 (Colorado ADMT Law)
Colorado · Effective 2027-01-01 · SB 26-189 (Colo. 2026)
Colorado's replacement AI law focuses on transparency rather than broad anti-discrimination duties. Starting January 1, 2027, companies using automated decision-making technology to materially influence consequential decisions (employment, housing, lending, insurance, healthcare) must notify consumers before use and provide post-decision disclosures; developers must give deployers technical documentation.
-
In effect Moderate protection
CO AG Weiser
CO · Effective 2026-04-27 · CO AG Weiser — Suspension of Colorado AI Act Rulemaking and Enforcement (x.AI v. Weiser) (2026-04-27)
Joint federal filing in which AG agreed to neither promulgate rules nor enforce SB24-205 until legislative resolution (SB26-189, signed May 14, 2026). Enforcement stayed pending rulemaking by Dec 31, 2026.
-
In effect Limited protection
Colorado Privacy Act (CPA)
Colorado · Effective 2023-07-01 · Colo. Rev. Stat. Sec. 6-1-1301 et seq. (SB 21-190)
The Colorado Privacy Act gives state residents the right to opt out of having their personal data used for profiling when that profiling drives decisions that produce legal or similarly significant effects, such as decisions about credit, housing, employment, or services. Businesses that engage in higher-risk processing, including certain profiling, must conduct and document a data protection assessment weighing the benefits against the risks. The Colorado Attorney General enforces the law, and since January 1, 2025 may bring actions without first offering a chance to cure.
-
In effect Limited protection
CO Insurance Algorithmic Discrimination Law
Colorado · Effective 2021-07-06 · Colo. Rev. Stat. Sec. 10-3-1104.9 (SB 21-169)
Colorado prohibits insurers from using outside consumer data, algorithms, or predictive models in ways that unfairly discriminate against people based on protected characteristics such as race, sex, religion, sexual orientation, disability, or gender identity. The law directs the state Insurance Commissioner to write rules that require insurers to test their data and models and show they do not produce discriminatory outcomes. Insurers must also maintain a risk-management framework to monitor for unfair discrimination. Coverage was later expanded to additional lines such as private passenger auto and health benefit plans.
Browse all Colorado AI laws in the directory → · See the automated decisions topic → · Colorado jurisdiction overview →