Colorado AI Act
Colorado's AI law, rewritten. SB 26-189 repealed and reenacted the 2024 statute, dropping the high-risk-AI regime for narrower notice and disclosure duties on automated decision-making technology used in consequential decisions.
SB 26-189 · Colorado General Assembly — SB 26-189 · published 2026-05-14
00Answer
01Standing
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
Colorado AI Act is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Named and tracked only; obligations not modelled as a control catalog.
02Registry record
- Registry status
- Planned · namedTracked metadata: we name the regime and monitor its issuing authority. No control or requirement model is implemented.
- Control units
- Not on record — no catalog ingested and no authority-published count cited.
- Control families
- Developer duties · Deployer duties · Advance notice · Post-decision disclosure · Consumer rights
- Applies to
- AI · employment · lending · housing · healthcare · US-CO
- Verification
- Secondary — corroborated across independent sources; the authority blocks automated fetch or does not state it plainly. checked 2026-08-06
- Pending change
- SB 26-189 (signed 2026-05-14) repeals and reenacts SB 24-205 rather than amending it: the risk management programme, the annual impact assessment, and the duty of reasonable care against algorithmic discrimination are all gone, replaced by notice and disclosure duties on automated decision-making technology. It takes effect 2027-01-01 and leaves implementation detail to AG rulemaking. Nothing is in force today. Do not describe Colorado as a high-risk-AI regime.Expected: 2027-01-01
03Version ledger
| SB 24-205 (as enacted 2024) | Superseded | 2024-05-17 |
| SB 26-189 | Current edition · supersedes SB 24-205 (as enacted 2024) | 2026-05-14 |
05Change history
- 2027-01-01Colorado AI Act: SB 26-189 (signed 2026-05-14) repeals and reenacts SB 24-205 rather than amending it: the risk management programme, the annual impact assessment, and the duty of reasonable care against algorithmic discrimination are all gone, replaced by notice and disclosure duties on automated decision-making technology. It takes effect 2027-01-01 and leaves implementation detail to AG rulemaking. Nothing is in force today. Do not describe Colorado as a high-risk-AI regime.
- 2026-05-14Colorado AI Act SB 26-189 supersedes SB 24-205 (as enacted 2024) and is the current edition.
06Related frameworks
- Texas Responsible AI Governance ActHB 149 (TRAIGA)
Also applies to AI · Texas's AI law, narrowed before passage to intent-based prohibitions plus government-use rules, with a regulatory sandbox and AG enforcement.
- 42 CFR Part 22024 final rule
Also applies to healthcare · Confidentiality rules for substance use disorder treatment records, now aligned with HIPAA on consent, notice, and enforcement.
- CCPA/CPRA + US state privacyCCPA/CPRA with 2026 CPPA regulations
Commonly assessed together · California's consumer privacy regime and the state laws that followed it. The 2026 CPPA regulations add automated decision-making rules, mandatory risk assessments, and certified cybersecurity audits.
- HIPAA Breach Notification Rule45 CFR §§ 164.400–414
Also applies to healthcare · What a covered entity or business associate must tell individuals, the media, and HHS after a breach of unsecured protected health information, and how fast.