Colorado’s AI Reset: SB 26-189 Repeals and Replaces SB 24-205 Following xAI Lawsuit and DOJ Intervention

In a stunning legislative and judicial reset, Colorado has completely overhauled its landmark AI regulation. On May 14, 2026, Colorado Governor Jared Polis signed Senate Bill 26-189 (SB 26-189, or the "Revised CO AI Act") into law, which completely overrides, repeals, and replaces the 2024 Colorado Artificial Intelligence Act (SB 24-205)—the nation's first comprehensive state AI law. The new law, which goes into effect on January 1, 2027, marks a massive retreat from the risk-based regulatory model and a significant victory for the tech industry and federal preemption efforts.

The Catalyst: xAI v. Weiser and DOJ Intervention

This dramatic legislative overhaul was triggered directly by a federal court showdown in Colorado. On April 9, 2026, Elon Musk’s xAI filed a lawsuit in the U.S. District Court for the District of Colorado (xAI LLC v. Philip J. Weiser, Case No. 1:26-cv-01515) seeking to enjoin the Colorado AI Act. The momentum shifted decisively on April 24, 2026, when the U.S. Department of Justice (DOJ) moved to intervene in support of xAI, filing a Complaint in Intervention alleging that the state law's disparate-impact liability requirements and diversity carve-outs violated the Equal Protection Clause.

This marked the first time the DOJ has intervened in a state-level AI regulatory lawsuit, signaling an aggressive federal campaign to preempt state AI laws under President Trump's Executive Order 14365 (issued December 11, 2025, to establish a "National Policy Framework for Artificial Intelligence").

As noted in the DOJ's press release:

"Laws that require AI companies to infect their products with woke DEI ideology are illegal... The Justice Department will not stand on the sidelines while states such as Colorado coerce our nation’s technological innovators into producing harmful products that advance a radical, far left worldview at odds with the Constitution." — Assistant Attorney General Harmeet K. Dhillon, DOJ Civil Rights Division

In response to the combined pressure of the xAI lawsuit and DOJ intervention, Colorado Attorney General Phil Weiser agreed to pause enforcement of SB 24-205, and the Colorado legislature rapidly drafted and passed SB 26-189 to dismantle the original act before its scheduled June 30, 2026 effective date.

Key Shifts Under the New SB 26-189 Framework

The new framework dramatically narrows Colorado's regulatory approach, shifting from a broad, risk-based AI model to a disclosure-and-rights framework focused on "automated decision-making technologies" (ADMTs):

1. Narrower Scope (Covered ADMTs): The law moves away from regulating all "high-risk" AI systems, instead applying only to ADMTs used to "materially influence a consequential decision" in domains like employment, education, housing, financial services, insurance, and health care.
2. Elimination of "Algorithmic Discrimination" Audits: Crucially, SB 26-189 eliminates the affirmative duty to prevent "algorithmic discrimination" and the mandatory independent bias audits that were the targets of the xAI/DOJ lawsuit. Instead, it mandates that existing state anti-discrimination laws apply to ADMTs, and establishes that developers and deployers can be held liable under those existing laws for discriminatory outcomes.
3. Transparency and Explanation Rights: Deployer obligations now center on transparency. Deployers must disclose the use of ADMTs to consumers prior to use. If an "adverse outcome" occurs, the deployer must explain the ADMT's role in the decision and provide the consumer an opportunity for meaningful human review.
4. Developer Documentation Mandate: Developers must provide downstream deployers with comprehensive documentation regarding intended uses, limitations, risks, training data, and instructions for monitoring and human review.
5. No Contractual Indemnity Escape: For enterprise risk teams, a critical provision of SB 26-189 is how it handles liability. The law states that liability will be allocated between developers and deployers based on their relative fault, and explicitly prohibits parties from avoiding violations through contractual indemnity clauses.
6. No Private Right of Action: Enforcement remains the exclusive province of the Colorado Attorney General, with violations treated as unfair trade practices.

As analyzed by DLA Piper:

"Unlike the Colorado AI Act, which regulated all “high risk” artificial intelligence (AI) systems, SB 26-189 only applies to automated decision-making technologies (ADMTs) that are used to make “consequential decisions.” ... The law states that liability will be allocated between developers and deployers based on their relative fault for the violation. It also provides that those subject to the law cannot avoid violations via contractual indemnity clauses." — Danny Tobey et al., DLA Piper Client Alert

Enterprise Risk Implications

For corporate legal and risk teams, Colorado's dramatic retreat highlights a broader national trend where states are scaling back aggressive, standalone AI regulations in favor of narrower ADMT frameworks (similar to California's CCPA ADMT regulations, also taking effect January 1, 2027). However, the prohibition on contractual indemnity clauses in SB 26-189 means that enterprises cannot simply shift all compliance risk to AI developers via vendor contracts. They must implement robust internal ADMT governance, pre-use disclosure protocols, and human-review workflows to manage their own "relative fault" exposure.