Colorado's AI Act Reset: SB 26-189 Repeals SB 24-205 Amidst Federal Stay in xAI v. Weiser

In a stunning legislative and judicial reset, Colorado has completely overhauled its landmark AI Act. On May 14, 2026, Colorado Governor Jared Polis signed Senate Bill 26-189 (A Bill Concerning the Use of Automated Decision-Making Technology in Consequential Decisions) into law. This new legislation completely repeals and replaces SB 24-205 (the original Colorado AI Act), which was previously scheduled to take effect on June 30, 2026.

This dramatic shift was catalyzed by a major federal lawsuit and unprecedented federal intervention. In early April 2026, Elon Musk’s xAI LLC filed suit against Colorado Attorney General Philip J. Weiser in the U.S. District Court for the District of Colorado (xAI LLC v. Philip J. Weiser, Case No. 1:26-cv-01515-DDD-CYC), challenging the constitutionality of SB 24-205 on First Amendment, extraterritoriality, and Fourteenth Amendment vagueness grounds. On April 24, 2026, the U.S. Department of Justice (DOJ) moved to intervene in support of xAI—marking the first time the federal government has sought to invalidate a state AI law, acting under the executive branch's directive in Executive Order 14365. On April 27, 2026, the federal court granted a joint motion to temporarily suspend enforcement of the AI Act.

Although SB 26-189 is scheduled to take effect on January 1, 2027, enforcement remains on hold. The Colorado Attorney General has stated he does not intend to enforce the new law until after the mandatory AG rulemaking process (which must be completed on or before January 1, 2027) concludes.

Key Changes Under SB 26-189

For enterprise legal and risk teams, SB 26-189 narrows the scope of the original law but tightens consumer-facing rights:

• Shift to "Covered ADMT": The law replaces the broad "high-risk AI" framework with "covered Automated Decision-Making Technology" (ADMT) that processes personal data to "materially influence" a "consequential decision" (defined as a non-de minimis factor in domains like employment, compensation, housing, lending, insurance, health care, and education).
• Reduced Governance Burden: It eliminates the most burdensome compliance requirements of SB 24-205, including mandatory NIST AI RMF/ISO 42001 risk management programs, annual impact assessments, and a freestanding duty of "reasonable care."
• Retained and Tightened Consumer Rights: Deployers must still provide clear pre-decision notices, post-adverse-outcome disclosures within 30 days, maintain compliance records for three years, and support a demanding right to "meaningful human review" and reconsideration.
• Developer-Deployer Comparative Fault: It introduces a joint/comparative liability framework, explicitly voiding any contractual provisions that attempt to shield a developer or deployer from liability for its own discriminatory acts.
• Eliminated Exemptions: The new law eliminates previous conditional exemptions for certain federally regulated entities, bringing more organizations into scope.

Verbatim Quotes

"On May 14, 2026, Governor Polis signed Senate Bill 26-189 into law, repealing and replacing Colorado’s 2024 landmark AI law. Senate Bill 26-189 — A Bill Concerning the Use of Automated Decision-Making Technology in Consequential Decisions (“ADMT”) — supersedes SB 24-205 and reshapes the compliance landscape for employers using AI in hiring, compensation, and workforce management. The new law takes effect January 1, 2027, but enforcement is already subject to a legal challenge that has thrown the entire framework into limbo." — Sarah Andrzejczak & Daniel Pietragallo, Buchalter Law Alert

"Notably, this is the first time that the DOJ has sought to intervene in a lawsuit challenging a state AI law, marking the first practical illustration of the executive branch’s recent directive, promulgated in Executive Order 14365, for the DOJ to become actively involved in challenges to state AI laws. [...] On April 27, 2026, the Court granted the Parties’ joint motion, temporarily suspending enforcement of the AI Act." — Norton Rose Fulbright Legal Alert

Impact on Enterprises

While the legislative rewrite and litigation stay provide a temporary compliance reprieve, enterprises cannot afford to delay. The 60-day statutory "right to cure" violations expires on January 1, 2030, and discrimination claims arising from AI-assisted decisions remain fully actionable under existing state and federal anti-discrimination laws. Legal teams must sprint to map their ADMT systems, establish "meaningful human review" protocols, and prepare for the mandatory AG rulemaking.