Colorado Repeals Risk-Based AI Act, Replaces It with Disclosure-and-Rights ADMT Framework

On May 14, 2026, Governor Jared Polis signed Senate Bill 26-189, which repeals Colorado's original AI Act (SB 24-205) — the first comprehensive state AI law in the US, modeled on the EU AI Act's risk-based framework — and replaces it with a disclosure-and-rights framework focused on automated decision-making technology (ADMT). The new framework takes effect January 1, 2027.

The pivot: from algorithmic accountability to procedural transparency.

The original law imposed substantive obligations on AI development and deployment: duties of care to avoid algorithmic discrimination, mandatory impact assessments, risk management programs, and a safe harbor for NIST-aligned frameworks. SB 26-189 replaces all of that with a procedural regime built around:

• Developer documentation obligations. Developers must provide deployers with technical documentation covering intended uses, known harmful uses, training data categories, known limitations, and instructions for human review. Trade secrets and model weights are protected.
• Deployer notice. Clear and conspicuous notice at the point of interaction with covered ADMT.
• Post-adverse-outcome disclosure. A plain-language description of the ADMT's role within 30 days of an adverse outcome.
• Consumer rights. Access to personal data, correction of factually incorrect data (excluding opinions/predictions/scores), and meaningful human review of adverse decisions.
• Recordkeeping. Three-year retention for both developers and deployers.
• Enforcement. Exclusive AG enforcement under the Colorado Consumer Protection Act, with a 60-day right to cure.

What was removed: The affirmative duty of reasonable care to avoid algorithmic discrimination, mandatory impact assessments, deployer risk management program requirements, and the safe harbor for NIST-aligned frameworks.

Notable scope changes: SB 26-189 eliminates the original law's exemption for businesses with fewer than 50 FTEs, potentially bringing smaller organizations into scope. It expressly excludes "low-stakes or routine" activities (advertising, content moderation, cybersecurity, fraud prevention) from the definition of consequential decision, and excludes calculators, databases, spreadsheets, and tools used solely for summarization from the definition of ADMT.

"No contractual provision that would shield a developer or deployer from liability for off-label use of AI tools" will be effective — per the Littler analysis, employers cannot escape liability through contract.

The federal backdrop: The pivot occurred against active federal pressure. A December 2025 White House executive order directed federal agencies to challenge conflicting state AI laws and created a DOJ AI Litigation Task Force. xAI sued to enjoin the original Colorado AI Act, and the DOJ intervened. On April 27, 2026, a federal magistrate judge stayed enforcement of the original Act.

Enterprise implication: Colorado now joins California in anchoring a US-state model focused on disclosure, consumer notice, and rights-based remedies — not the EU-style risk-management framework. Multinationals will increasingly need to maintain two distinct compliance postures (EU risk-management + US disclosure-and-rights) rather than one harmonized framework.