Preparing for the Convergence of SB 24-205, HB 26-1139, and HB 26-1195 — Three New Colorado Laws Targeting AI in Healthcare

By Scott Driggs and Bill Ojile

Preparing for the Convergence of SB 24-205, HB 26-1139, and HB 26-1195 — Three New Colorado Laws Targeting AI in Healthcare

Healthcare in Colorado is currently facing three separate artificial intelligence (AI) legislative tracks at once. The Colorado AI Act (SB 24-205) takes effect June 30, 2026, unless the legislature passes a proposed replacement bill before its session ends on May 13. At the same time, HB 26-1139 targets AI in health insurance and utilization review and HB 26-1195 restricts AI in mental health therapy. Each with their own requirements and timelines. Healthcare organizations should not wait to see how any single bill plays out.

Front One: The Colorado AI Act (SB 24-205)

The AI Act applies to “high-risk” AI systems, which the law defines as any AI system that, when deployed, makes or is a “substantial factor” in making a “consequential decision.” A consequential decision is one that has a material legal or similarly significant effect on the provision or denial to a consumer of, or the cost or terms of, essential services—including healthcare services among others. In practical terms, any AI tool that influences clinical decisions, insurance determinations, patient access, or healthcare pricing in Colorado likely qualifies as high-risk and triggers the Act’s requirements. The Act requires developers and deployers of these high-risk systems to exercise reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination.

On March 17, 2026, a Governor-appointed Work Group proposed a replacement bill that would take effect January 1, 2027. The replacement narrows the law’s scope: it drops impact assessments and risk management mandates but keeps consumer notice, adverse outcome disclosure, human review, and records retention requirements. The legislature has until May 13, 2026, to act. If it does not, the current law kicks in on June 30, 2026. Note: if the replacement passes, there may be a gap between June 30, 2026, and January 1, 2027, during which the general AI law does not apply—but the two healthcare-specific bills described below would still be on track.

Front Two: HB 26-1139 — AI in Health Insurance and Utilization Review

HB 26-1139 already passed the Colorado House and is now before the Senate. It targets entities conducting utilization review—insurers, pharmacy benefit managers, and managed care organizations—and would prohibit basing coverage decisions solely on AI-generated group data. Instead, it requires that coverage determinations rely on an individual patient’s medical history. This bill imposes obligations that are distinct from SB 24-205 and applies to a different set of actors. Payers, in particular, should treat this as a separate compliance workstream.

Front Three: HB 26-1195 — AI in Mental Health Therapy

HB 26-1195 also passed the Colorado House. If enacted, it will require licensed (or otherwise authorized) psychotherapy providers to use AI only for administrative or supplementary support, and to remain responsible for reviewing AI outputs. Use of AI to record or transcribe sessions will require advance written notice that AI will be used, advance written notice of the specific purpose, and the client’s clear, written, revocable consent; refusal or revocation will not be used to deny psychotherapy services. The bill prohibits the use of AI to engage in therapeutic communication with a client unless the provider, the AI system, and the client are interacting synchronously in real time. Providers may not rely on AI to generate therapeutic recommendations or treatment plans, unless the provider reviews and approves. Separately, the bill restricts how AI systems are advertised and offered in Colorado; but it will permit specified carve-outs (education/training and Institutional Review Board-supervised research) and exclusions (certain self-help/wellness tools that do not diagnose or treat and that clearly disclose they are not a substitute for clinical care).

Key Exemptions Under SB 24-205

The current Act includes three exemptions relevant to healthcare:

(1) Health Insurance Portability and Accountability Act (HIPAA) Covered Entities — applies when AI recommendations require a provider to exercise independent clinical judgment before acting.

(2) Food and Drug Administration (FDA)-Authorized Systems — covers AI tools that have been approved, authorized, or cleared by the FDA.

(3) Office of the National Coordinator for Health Information Technology (ONC)-Certified Systems — covers AI systems certified under ONC standards, including those meeting the HTI-1 Final Rule.

These exemptions narrow the Act’s reach for many clinical AI tools, but they do not cover all AI- use cases, and they may not survive in a replacement bill. Critically, these exemptions apply only to SB 24-205. HB 26-1139 and HB 26-1195 contain their own separate requirements, and the clinical exemptions under the AI Act do not shield organizations from obligations under those bills.

Preparedness Steps to Consider

Inventory your AI tools across all three fronts. List every AI or automated tool used in Colorado operations. Include clinical, administrative, payer/utilization review, and revenue cycle use cases. Note the owner, vendor, data inputs, outputs, and where the tool influences decisions. Map each tool to SB 24-205, HB 26-1139, and HB 26-1195, as applicable.

Analyze exemptions under SB 24-205. Check whether each tool fits the HIPAA, FDA, or ONC exemptions. Document why an exemption applies. Do not assume an SB 24-205 exemption reduces obligations under HB 26-1139 or HB 26-1195.

Build notice, consent, and disclosure workflows. Prepare consumer notices for SB 24-205 transparency and adverse-outcome requirements. For HB 26-1195 use cases, build written notice and written, revocable consent processes for any AI recording or transcription. Train staff on documenting refusals and revocations and on maintaining access to care.

Review vendor contracts and product configurations. Confirm what your AI tools do in practice, not just in marketing. Require clear documentation on intended use, limitations, and required human review. Add controls that prevent prohibited configurations (for example, AI-only therapeutic communications). Address data handling, security, and retention for recording/transcription tools.

Stand up AI governance and clinical guardrails. Assign accountable owners for each AI system and each compliance front. Require provider review and approval before using AI-generated therapeutic recommendations or treatment plans. Set escalation paths for safety events and client complaints. Maintain records that support compliance and internal auditing.

Separate compliance tracks for payers, providers, and consumer-facing tools. Treat HB 26-1139 as a payer/utilization review workstream. Treat HB 26-1195 as a provider and digital-therapy workstream. For HB 26-1195, assess whether any tools fit carve-outs (education/training or IRB-supervised research) or exclusions (certain self-help/wellness tools). Document the basis and keep the deployment within the carve-out or exclusion.

The Bottom Line

Colorado healthcare organizations are not dealing with one AI law—they are potentially dealing with three, each with its own scope, obligations, and timeline. No other industry in the state faces this level of convergent AI regulation. Organizations that treat these bills as a unified compliance challenge—mapping each AI system to the specific laws that govern it and building separate workstreams for payer and provider functions—will likely be far better positioned than those that address each bill in isolation or wait for final legislative outcomes.