Publication
Update: Colorado’s Three-Front AI Healthcare Landscape Has Shifted — What Changed and What It Means
By Scott Driggs and Bill Ojile
Building on our April alert regarding Colorado’s three-front AI healthcare landscape, the legislature has finalized all three tracks. The compliance picture has rapidly shifted, bringing unexpected framework changes that demand immediate attention.
Front One: SB 24-205 Is Gone — Replaced by SB 26-189
The original Colorado AI Act never took effect. On May 14, 2026, Governor Polis signed SB 26-189, effective January 1, 2027, which repeals SB 24-205 and replaces it with a narrower framework focused on “automated decision-making technology” (ADMT). SB 26-189 drops the duty-of-care standard, mandatory risk management programs, and annual impact assessments. In their place, it requires:
- Consumer notice at the point of interaction with a covered ADMT;
- Post-adverse-outcome disclosures within 30 days;
- Consumer rights to access and correct personal data;
- The right to request meaningful human review after an adverse decision; and,
- Three-year recordkeeping for both developers and deployers.
For healthcare organizations, the exemption picture has changed significantly. The original Act’s three broad exemptions — for HIPAA covered entities, FDA-authorized AI systems, and ONC-certified systems — do not carry over in their prior form. SB 26-189 does include provisions accommodating HIPAA-covered entities and business associates for non-employment uses, and it excludes FDA-regulated medical devices and certain pharmaceutical and medical-device R&D activities, including clinical investigations. However, these are structurally different from the blanket exemptions in SB 24-205. They are narrower, apply only to specified obligations, and their operational scope will be shaped by the attorney general’s forthcoming rulemaking. The ONC-certified systems exemption does not appear in SB 26-189 at all. Healthcare organizations should not assume their prior exemption analysis still holds.
SB 26-189 applies to any ADMT that “materially influences” a consequential decision — defined as serving as more than a de minimis factor in the outcome. This is a more precise standard than SB 24-205’s “substantial factor” test, but it still captures AI tools that screen, rank, score, or constrain the options a human decision-maker sees. At the same time, the statute explicitly excludes routine and incidental uses — including tools that solely summarize or present information for human review, customer service triage, and administrative routing — from the definition of covered ADMT. For healthcare organizations, this means that clinical decision support tools which actively narrow or prioritize treatment paths likely trigger coverage, while documentation aids and informational displays likely do not. The line between the two will be clarified through rulemaking. Organizations should map their AI tools against both sides of this distinction now rather than assuming either blanket coverage or blanket exclusion.
The Attorney General holds exclusive enforcement authority, with penalties up to $20,000 per violation and a 60-day right-to-cure period sunsetting on January 1, 2030. The right-to-cure provision applies to AG enforcement under SB 26-189; HB 26-1195 is enforced separately through licensing board discipline and the Colorado Consumer Protection Act. Furthermore, while a pending federal lawsuit and ongoing rulemaking delay SB 26-189 enforcement, the healthcare-specific HB 26-1139 and HB 26-1195 (discussed below) proceed completely unaffected by this federal litigation.
Front Two: HB 26-1139 — Signed June 2, 2026
Governor Polis signed HB 26-1139 on June 2, 2026. It takes effect January 1, 2027. The bill was significantly narrowed during the legislative process. The final act removed provisions addressing mental health companion chatbots, unauthorized practice of psychotherapy by AI platforms, suicidal ideation protocols, and mental health data restrictions. The signed act focuses exclusively on utilization review requirements and the prohibition on payer reimbursement for AI-delivered psychotherapy.
On utilization review specifically, entities that use AI — including carriers, PBMs, private utilization review organizations, behavioral health ASOs, and managed care entities — must:
- Ensure AI-driven coverage determinations are based on the patient’s individual medical and clinical history, not solely on group data;
- Have any denial or delay of coverage based on medical necessity reviewed by a licensed clinician competent in the relevant clinical area;
- Disclose to the applicable state regulatory agency how AI will be used in utilization review, human oversight processes, and audit procedures; and,
- Refrain from paying for psychotherapy services conducted by AI.
Front Three: HB 26-1195 — Signed June 3, 2026
Governor Polis signed HB 26-1195 on June 3, 2026. It takes effect August 12, 2026 — 90 days after the legislature’s May 13 adjournment. The bill applies to all licensed, certified, or registered psychotherapy providers in Colorado. Its core restrictions are:
- Providers may not allow AI to engage in therapeutic communication with a client. The only exception is when the provider, the AI system, and the client are all participating in a synchronous, real-time interaction — meaning the provider must be actively present and engaged throughout, not merely available or monitoring passively;
- Providers must review and approve any AI-generated therapeutic recommendations or treatment plans before they are used in client care;
- Providers must obtain the client’s clear, written, revocable consent before using AI to record or transcribe sessions. One-time consent suffices unless the purpose or manner of use materially changes. Refusal or revocation cannot be grounds to deny services;
- Providers retain full responsibility for all AI-related interactions, outputs, and data use; and,
- Violations may result in disciplinary action, administrative fines up to $5,000, and civil penalties up to $20,000 under the Colorado Consumer Protection Act.
The bill also prohibits any person from providing or advertising psychotherapy services through AI unless conducted by a regulated professional — doing so constitutes a deceptive trade practice. Carve-outs exist for accredited educational and training programs, IRB-supervised research, and self-help or wellness tools that do not diagnose or treat mental health disorders and clearly disclose they are not a substitute for clinical care.
Revised Preparedness Steps to Consider
Some of our April preparedness steps have been overtaken by events. These are the steps that matter now:
- Audit AI Inventory: Re-evaluate tools previously assumed exempt; the broad HIPAA, FDA, and ONC safe harbors from SB 24-205 do not carry over, and the narrower provisions in SB 26-189 apply only to specified obligations.
- Review Vendor Liability Shifts: SB 26-189 establishes a fault-based liability allocation. Developers are responsible for harms from intended use and deployers are responsible for their own deployment decisions. The law voids indemnification clauses that purport to shield either party from liability for its own discriminatory AI violations. Review vendor contracts to confirm liability allocation reflects this framework and flag any clauses that attempt to shift discrimination liability rather than appropriately apportioning responsibility based on relative fault.
- Deploy HB 26-1195 consent and disclosure processes: Build written, revocable client consent for AI-based session recording or transcription and provide all clients with written notice of the bill’s AI prohibitions during initial contact — both required by August 12.
- Restructure Utilization Review Paths: Map payer systems to guarantee AI decisions utilize individual patient data and route coverage denials directly to a competent clinical peer.
- Maintain Segregated Workstreams: As previously mentioned, manage separate compliance tracks — HB 26-1139 for payers, HB 26-1195 for providers, and SB 26-189 as the shared general AI compliance baseline.
The Bottom Line
The landscape we described in April has evolved quickly, and the path forward is now clear. SB 24-205 is gone, replaced by a framework that changes the exemption picture for healthcare organizations. With both HB 26-1139 and HB 26-1195 signed into law, organizations now have defined timelines and concrete requirements to meet. The key dates are August 12 for HB 26-1195 and January 1, 2027, for HB 26-1139 and SB 26-189. There is still time to prepare — but not much, particularly for behavioral health providers. Organizations are encouraged to begin, refine, or finalize compliance work now that the requirements are settled and the deadlines are fixed.
About Snell & Wilmer
Founded in 1938, Snell & Wilmer is a full-service business law firm with more than 500 attorneys practicing in 17 locations throughout the United States and in Mexico, including Phoenix and Tucson, Arizona; Los Angeles, Orange County, Palo Alto and San Diego, California; Denver, Colorado; Washington, D.C.; Boise, Idaho; Las Vegas and Reno-Tahoe, Nevada; Albuquerque, New Mexico; Portland, Oregon; Dallas, Texas; Salt Lake City, Utah; Seattle, Washington; and Los Cabos, Mexico. The firm represents clients ranging from large, publicly traded corporations to small businesses, individuals and entrepreneurs. For more information, visit swlaw.com.
