Colorado Repeals and Replaces Landmark AI Act with Narrower Disclosure Framework (SB 26-189)

In a major legislative turnabout with significant implications for financial services firms deploying AI, Colorado has scrapped its comprehensive 2024 AI consumer protection law before it ever took effect. On May 14, 2026, Colorado Governor Jared Polis signed Senate Bill 26-189 (SB 189) into law, officially repealing and replacing the original Colorado Artificial Intelligence Act (SB 24-205).

The original 2024 law, which was scheduled to take effect on June 30, 2026, was widely considered the most comprehensive state-level AI anti-discrimination and consumer protection measure in the United States. However, it faced intense criticism and lobbying from business groups and technology developers due to its heavy system-level compliance, risk-management, and reporting requirements.

Shift from "System-Level Compliance" to "Decision-by-Decision Accountability"

The newly enacted SB 26-189 establishes a narrower, transparency-based regulatory framework. Instead of imposing sweeping system-level compliance burdens on AI developers and deployers, the new law shifts accountability to a disclosure and notice regime.

Under SB 26-189, employers and deployers of automated decision-making technology (ADMT) or AI tools must provide:

1. Pre-use notices: Informing individuals when AI tools are being used to influence consequential decisions.
2. Post-adverse-outcome notices: Providing clear explanations to individuals when an AI tool leads to an adverse outcome in a consequential decision (such as denying employment, credit, housing, or healthcare).

Legal analysts at Jackson Lewis highlighted this fundamental shift:

"Colorado's new law replaces its 2024 AI statute, shifting from system-level compliance requirements to decision-by-decision accountability for employers..." — Jackson Lewis P.C. Analysis

Implications for Financial Services and AI Deployers

For banks, insurers, and fintech platforms deploying AI-driven underwriting, credit scoring, or automated claims-handling systems, this legislative shift has dual consequences:

• Reduced Compliance Overhead: Firms are relieved of the heavy, proactive, system-wide algorithmic auditing and risk-management compliance programs mandated by the 2024 Act (SB 24-205).
• Operational Disclosure Burdens: Firms must build robust operational mechanisms to consistently explain individual automated decisions. If an AI model denies credit or housing, the deployer must be prepared to explain why that specific decision was made, risking significant litigation exposure if disclosures are inconsistent or inadequate.

This "notice-only" or "transparency-based disclosure" model represents a massive lobbying victory for the tech industry, but it cements a strict individual disclosure requirement that financial services firms must comply with before the January 1, 2027 deadline.