Colorado SB 189: Complete AI Law Rewrite — Developer/Deployer Liability Split and Reduced Employer Burdens
On May 14, 2026, Colorado Governor Jared Polis signed SB 26-189, which repeals and replaces the Colorado Artificial Intelligence Act (CAIA) that was originally enacted in 2024. The new law shifts the regulatory scope from "high-risk artificial intelligence systems" to a broader category of "automated decision-making technology" (ADMT), while substantially reducing employer obligations and establishing a fault-based liability split between developers and deployers.
Key Changes from the Previous Law (Eliminated Obligations)
- No mandatory impact assessments
- No risk management policy or program requirements
- No annual review of AI tools
- No mandatory reporting of discriminatory outcomes to the AG
- No requirement to update privacy policies describing AI use
- No requirement to affirmatively avoid algorithmic discrimination (instead relies on existing anti-discrimination law)
What Remains: Three Core Employer Requirements (effective January 1, 2027)
- Prior Notice: Clear and conspicuous notice before using ADMT to materially influence consequential employment decisions
- Adverse Action Process: Within 30 days of an adverse decision, notice with description and the role ADMT played, plus a right to correct inaccurate data and meaningful human review (subject to "commercially reasonable" limitation)
- Record Retention: Three years of records demonstrating compliance
Developer-Deployer Liability Split (Fault-Based)
The law establishes explicit liability boundaries:
- If a deployer uses ADMT as the developer intended, documented, marketed, and contracted, and outcomes are discriminatory → the developer is liable
- If a deployer uses ADMT in ways not intended, documented, marketed, or contracted → the deployer is liable, developer is not
- No joint and several liability except as permitted under existing law
Indemnification Provisions Invalidated
Contractual indemnification clauses that shift liability for a party's own acts or omissions in violation of Colorado discrimination laws are void as against public policy. This does not apply if the ADMT was used in an unintended manner and the developer complied with documentation obligations.
Enforcement
- No private right of action — only the Colorado Attorney General can enforce
- Violations constitute unfair and deceptive trade practices (civil penalties up to $20,000 per violation)
- 60-day notice and opportunity to cure before enforcement action (at AG's discretion)
Broader Context
The rewrite follows:
- White House criticism of state-level AI laws as excessive
- Colorado's earlier postponement of CAIA from February to June 2026
- Active AI legislative developments in California, Connecticut, Illinois, and dozens of other states
Colorado is now the third state (joining California and NYC) with a comprehensive AI employment law combining notice, rights, and anti-discrimination provisions.