Is the Colorado AI Act still in effect?

No. In May 2026 Colorado repealed and replaced the Colorado AI Act (SB 24-205) with SB 26-189, which takes effect January 1, 2027.

What does Colorado SB 26-189 require of employers?

Clear notice before using automated decision-making technology for consequential decisions such as hiring or pay; a plain-language explanation within 30 days of an adverse decision; on request, data correction and meaningful human review to the extent commercially reasonable; and records kept for at least three years.

Does Colorado SB 26-189 require impact assessments?

No. SB 26-189 removed the impact assessment, risk management program, annual review, and Attorney General reporting requirements of the original Colorado AI Act.

Who enforces Colorado SB 26-189 and what are the penalties?

Only the Colorado Attorney General, with no private right of action. Violations are treated as unfair or deceptive trade practices with civil penalties up to $20,000 per violation, after a 60-day notice and opportunity to cure where a cure is possible.

Colorado AI Law SB 26-189 for Employers (2026 Guide)

Key facts

Law

Colorado SB 26-189, which replaced the Colorado AI Act (SB 24-205)

Effective

January 1, 2027

Applies to

Organizations doing business in Colorado that use automated decision-making technology for consequential decisions about Colorado residents, including hiring, selection, and pay

Core duties

Advance notice, adverse decision explanations, correction and human review on request, three years of records

Enforced by

Colorado Attorney General only (no private right of action)

Penalties

Up to $20,000 per violation, with a 60-day notice and cure period

What changed

Colorado's original AI Act (SB 24-205) was set to take effect June 30, 2026. In May 2026 the state repealed and replaced it with SB 26-189, which takes effect January 1, 2027. The new law removes several of the heaviest obligations: impact assessments, a formal risk management program, annual reviews of AI tools, and reporting discriminatory outcomes to the Attorney General. What remains focuses on transparency and individual rights.

Who is covered

The law covers automated decision-making technology that materially influences a consequential decision, including access to, eligibility for, selection for, or compensation for employment. It applies to both external hiring and internal decisions such as promotion. The definition is broader than AI: it reaches technology that processes personal data with computation. Independent contractors are not covered.

What employers must do

Give notice before use. Provide clear and conspicuous notice before using covered technology, including how to get more information.
Explain adverse decisions. Within 30 days of an adverse decision, provide a plain-language explanation of the decision and the tool's role, information about the tool and its developer, the types of data used, and how to exercise correction and review rights.
Offer correction and human review. On request, explain how to access and correct inaccurate personal data, and provide meaningful human review and reconsideration to the extent commercially reasonable.
Keep records. Retain records reasonably necessary to show compliance for at least three years after each decision.

What's exempt

Exemptions include identity verification, cybersecurity, and sanctions screening; routine tasks such as scheduling and workflow routing; basic calculators, databases, and spreadsheets that rely on human analysis; tools that only summarize, organize, or present information for human review; and chat-style tools not intended for consequential decisions where an acceptable use policy prohibits that use.

Developers and vendors

Liability is allocated between developers and deployers according to relative fault. Contract terms that shift liability for a party's own unlawful algorithmic discrimination are void, with a limited exception for unintended uses where the developer met its documentation duties.

What to do before January 1, 2027

Inventory hiring and HR tools that influence decisions about Colorado residents.
Draft pre-use notices and an adverse decision explanation template.
Set up a process for data correction requests and human review.
Collect documentation from vendors about how each tool works and what data it uses.
Establish three-year record retention, and watch for the Attorney General's implementing regulations, due by January 1, 2027.

Last reviewed October 2026. This page is general information, not legal advice.

Colorado's AI law (SB 26-189): what employers need to do by January 1, 2027