Publication
Colorado Rewrites Its AI Law
By Matthew T. Kramer and Martin C. Walsh
On May 14, 2026, Governor Polis signed Senate Bill 26-189, replacing Colorado’s first-in-the-nation act focused on regulating artificial intelligence, the 2024 Colorado Artificial Intelligence Act (SB 205), with a narrower notice-and-transparency framework for automated decision-making technology (ADMT).1 The law takes effect January 1, 2027, but the Attorney General must complete rulemaking first, and pending litigation may further shape the timeline. The new approach follows two years of criticism and uncertainty. The 2024 law would have required enterprise risk management programs, annual bias review, impact assessments, and other obligations for “high-risk AI systems.” Governor Polis signed that law with reservations and urged the legislature to revisit it. A subsequent federal executive order2 and litigation3 challenging the prior law created additional pressure for a narrower approach before the law took effect.
Key Takeaways:
- Colorado has shifted from broad AI governance obligations to consumer-facing rights: notice, explanation, data correction, and human review.
- Enforcement rests exclusively with the Colorado Attorney General; there is no private right of action.
- Indemnification clauses that shift liability for violations of Colorado anti-discrimination laws in AI contexts are void and unenforceable.
- Constitutional challenges raised in x.AI LLC v. Weiser remain pending and many legal theories may survive under the revised framework.
- Companies should use the pre-enforcement rulemaking period to inventory ADMT systems, update consumer-facing disclosures, review vendor contracts, and consider engaging in the Attorney General’s rulemaking process.
What Changed
SB 26-189 centers on a new defined concept: ADMT. The law defines ADMT as technology that processes personal data and uses computation to produce outputs such as predictions, recommendations, classifications, rankings, or scores that make or materially influence consequential decisions about individuals. Consequential decisions include those involving hiring and employment, lending or credit, healthcare, housing, insurance, education, and government services. Routine tools used for pure calculations, cybersecurity, fraud-prevention, and consumer-facing large language models not deployed for consequential decisions are excluded.
For businesses, the most important change is the shift from broad governance obligations to consumer-facing notice, explanation, correction, and review rights. Key points include:
- Deployers must disclose ADMT use, allow correction of personal data, provide an explanation within 30 days upon request after an adverse consequential decision, offer human review where commercially reasonable (a standard the Attorney General’s rulemaking is expected to clarify), and retain records for three years.
- Developer obligations have been narrowed relative to the original 2024 law but remain meaningful. Developers must disclose a description of data used to train covered ADMT, instructions for appropriate use, known risks and prohibited uses, and information sufficient for the deployer to comply with its obligations. The notes to the bill also reference obligations to build governance frameworks, document known limitations and intended uses, including known bias-related risks, conduct model risk assessments, and retain documentation.
- Enforcement rests exclusively with the Colorado Attorney General, who must publish annual enforcement metrics. A 60-day right to cure applies to enforcement actions until January 1, 2030.
- Compliance with SB 26-189 does not immunize a business from other anti-discrimination laws. Indemnification clauses that shift liability for violations of Colorado anti-discrimination laws are void and unenforceable. Businesses should review existing AI vendor agreements for such provisions.
- Banks, insurers, and other federally regulated businesses fall within scope where they use covered ADMT.
What Happens Next
The law is scheduled to take effect on January 1, 2027, but two factors may shape the practical timeline: rulemaking and litigation.
Rulemaking. The Attorney General must complete public notice, comment, and at least one hearing before the law takes effect. Key definitions — including when ADMT “materially influences” a decision and what constitutes “commercially reasonable” human review — will be central to that process. Enforcement will not begin until rulemaking is complete, giving businesses a window to prepare but leaving the final contours of compliance uncertain.
Litigation. The lawsuit challenging the prior law, x.AI LLC v. Weiser, remains pending in the U.S. District Court for the District of Colorado. The case raised First Amendment, Dormant Commerce Clause, due process, and equal protection challenges to the original statute, and the U.S. Department of Justice intervened. Most of these constitutional theories survive under the revised framework. After the Attorney General finalizes rulemaking, the plaintiffs will have 28 days to seek injunctive relief against the new law. If the court grants an injunction, the effective date and enforcement timeline could shift. Businesses should monitor the litigation alongside rulemaking developments.
What Businesses Should Consider Doing Now
- Identify systems that use personal data and computation to make or materially assist consequential decisions in employment, lending, healthcare, housing, insurance, education, or government services.
- Prepare ADMT disclosures, 30-day explanation processes, data-correction procedures, and human-review protocols where commercially reasonable.
- Review and update AI procurement and vendor agreements to address compliance responsibilities, record retention obligations, and the voiding of indemnification provisions that shift liability for AI-related discrimination claims.
- Assess whether existing AI governance programs developed in anticipation of the 2024 law can be adapted to the new framework’s narrower requirements.
- Monitor the Attorney General’s rulemaking process and consider submitting comments on key definitions, particularly the scope of “materially influences” and the standard for “commercially reasonable” human review.
- Track developments in x.AI LLC v. Weiser, including any motion for injunctive relief following the completion of rulemaking, which could delay enforcement.
Colorado’s decision to replace its original AI law before it took effect signals that state-level AI regulation remains in flux. SB 26-189 is narrower than its predecessor, but it remains one of the most significant state AI consumer protection frameworks in the United States. The rulemaking period presents both uncertainty and opportunity: companies using automated tools in consequential decisions should consider moving now to inventory systems, update consumer-facing processes, revisit vendor contracts, and prepare to engage in the rulemaking process that will define the law’s practical scope.
Footnotes
-
S.B. 26-189, 75th Gen. Assemb., 2d Reg. Sess. (Colo. 2026).
-
Exec. Order No. 14,365, 90 Fed. Reg. 58,499 (Dec. 16, 2025).
-
x. AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo. filed Apr. 9, 2026).
About Snell & Wilmer
Founded in 1938, Snell & Wilmer is a full-service business law firm with more than 500 attorneys practicing in 17 locations throughout the United States and in Mexico, including Phoenix and Tucson, Arizona; Los Angeles, Orange County, Palo Alto and San Diego, California; Denver, Colorado; Washington, D.C.; Boise, Idaho; Las Vegas and Reno-Tahoe, Nevada; Albuquerque, New Mexico; Portland, Oregon; Dallas, Texas; Salt Lake City, Utah; Seattle, Washington; and Los Cabos, Mexico. The firm represents clients ranging from large, publicly traded corporations to small businesses, individuals and entrepreneurs. For more information, visit swlaw.com.
