Colorado rewrites AI law SB 26-189

Colorado rewrote its AI law on May 14, when Governor Jared Polis signed Senate Bill 26-189. The new statute repeals and replaces the state’s 2024 AI Act before that earlier law could take effect, and recasts the regime around “automated decision-making technology,” or ADMT, used in consequential decisions. (nortonrosefulbright.com) The earlier law had made Colorado the first U.S. state to impose broad obligations on developers and deployers of “high-risk” AI systems. (nortonrosefulbright.com) SB 26-189 removes that terminology and instead regulates covered ADMT used to materially influence decisions involving employment, housing, education, lending, insurance, health care and essential government services. (leg.colorado.gov) For employers, the rewrite matters because employment decisions are expressly inside the law’s definition of “consequential decisions.” Hiring, compensation and workforce-management tools can therefore still fall within the statute, but under a narrower and more operational framework than the one Colorado enacted in 2024. (nortonrosefulbright.com) ### So what, exactly, did Colorado change? Senate Bill 26-189 repeals and reenacts the prior law with new definitions, new notice rules and a different enforcement design. The Colorado General Assembly’s bill summary says developers of covered ADMT must give deployers technical documentation on intended uses, training-data categories, known limitations and instructions for appropriate use and human review. (hklaw.com) The new law also shifts the state away from the prior statute’s “algorithmic discrimination” and duty-of-care structure. Norton Rose Fulbright said the revised act “depart[s] from the AI Act’s algorithmic discrimination and duty of care framework,” while Holland & Knight said the new law replaces those obligations with a lighter framework governing ADMT in consequential decisions. (buchalter.com) ### What still applies to employers using hiring or workplace tools? January 1, 2027, is the key date in the statute. Starting then, developers and deployers must retain records needed to show compliance for at least three years, according to the General Assembly summary. (leg.colorado.gov) Deployers must also provide “clear and conspicuous” notice to consumers at the point of interaction with covered ADMT. After an adverse consequential decision, a deployer must provide a plain-language description of the tool’s role within 30 days, and consumers can request personal data, correction of factually incorrect personal data, meaningful human review and reconsideration. (nortonrosefulbright.com) Buchalter said employers that were preparing for the 2024 law should note what is gone: no mandatory risk-management program aligned to NIST AI RMF or ISO 42001, no annual impact assessments within 90 days of deployment, no duty to self-report harms to the attorney general, and no standalone duty of reasonable care. (leg.colorado.gov) ### Does this mean Colorado backed off AI regulation? May 14 did not eliminate Colorado’s AI rules; it changed the model. Holland & Knight said the revised law still imposes obligations on businesses and adds a liability and indemnification framework, including a provision voiding contract clauses that would indemnify a party for its own discriminatory ADMT-related acts. (leg.colorado.gov) Buchalter said anti-discrimination exposure remains because the Colorado Anti-Discrimination Act and federal anti-discrimination laws still apply. That means employers may face fewer AI-specific procedural duties than under the 2024 statute, while still carrying exposure under existing employment law. (buchalter.com) ### Why are lawyers and companies watching this so closely? Colorado’s 2024 law had already drawn litigation and federal attention before the rewrite. Norton Rose Fulbright said xAI sued in early April to block enforcement of the earlier statute, the federal government moved to intervene, and the Colorado attorney general agreed to suspend enforcement pending court action and legislative changes. (hklaw.com) That sequence makes SB 26-189 more than a local cleanup bill. The revised law takes effect on January 1, 2027, and the attorney general must adopt rules clarifying post-adverse-outcome disclosure requirements by that same date, according to the General Assembly summary. (buchalter.com) Those rulemaking steps are the next formal checkpoint for employers, vendors and lawyers tracking how Colorado intends to police automated decision tools in practice. (leg.colorado.gov) (nortonrosefulbright.com)