Colorado's AI Act just changed significantly. Governor Polis signed SB 189 on May 14, 2026, replacing the original SB 24-205 framework with a narrower, more practical law. The effective date is now January 1, 2027, giving employers time to prepare. But "more time" does not mean "nothing to do."
This article covers what changed, what the new law requires, and the 5-step preparation checklist for Colorado employers before January 1.
TL;DR: SB 189 replaces SB 24-205. Key changes: effective date January 1, 2027; narrower scope (automated decision-making technology vs. broad high-risk AI); dropped mandatory impact assessments; kept disclosure and explanation rights; added safe harbor for documented compliance. Small businesses under 50 employees are generally exempt from ADMT disclosures.
Timeline: how Colorado AI law arrived here
2024: Colorado passes SB 24-205, one of the first state AI laws in the US. Broad "high-risk AI system" framework, mandatory impact assessments for any employer using AI in hiring, credit, healthcare, or housing decisions. Set to take effect February 1, 2026.
April 27, 2026: A U.S. District Court issues an enforcement injunction. xAI and the U.S. Department of Justice challenged the law's constitutionality. The Colorado AG agrees not to enforce SB 24-205 until rulemaking is finalized. The statutory February 1 date still exists but enforcement is paused.
May 7-9, 2026: SB 189 passes the Colorado legislature (Senate May 7, House May 9).
May 14, 2026: Governor Polis signs SB 189.
January 1, 2027: SB 189 takes effect. SB 24-205 is replaced.
What changed from SB 24-205 to SB 189
Change 1: Effective date moved from February 2026 to January 2027
The original February 1, 2026 date under SB 24-205 no longer applies. The new effective date for the actual obligations is January 1, 2027 under SB 189.
The enforcement injunction from April 2026 is moot from a practical standpoint: SB 24-205 is being replaced, so the injunction applies to a law that no longer governs AI obligations for Colorado employers.
Change 2: "High-risk AI systems" replaced with "automated decision-making technology"
SB 24-205 used a broad "high-risk AI system" concept that covered many types of AI used in consequential decisions. SB 189 narrowed this to "automated decision-making technology" (ADMT): AI that makes or substantially influences a consequential decision affecting a Colorado resident.
The practical effect: a system where a human makes the final decision with full information and can override the AI recommendation may not qualify as ADMT. A system where AI scores, ranks, or recommends candidates in a way that substantially determines who advances likely does qualify.
Change 3: Mandatory impact assessment removed
SB 24-205 required documented impact assessments for high-risk AI systems before deployment, including bias testing and risk documentation. SB 189 removed the mandatory impact assessment requirement.
Impact assessments are still good practice (and support the safe harbor under SB 189), but they are no longer legally required. The EEOC's disparate impact guidance under Title VII still makes voluntary bias testing valuable regardless of state law.
Change 4: Disclosure and explanation rights kept
SB 189 retains the core disclosure and explanation obligations from SB 24-205:
- Notice: Employers using ADMT in consequential decisions must inform Colorado residents when automated decision-making substantially influenced a decision affecting them
- Explanation: Upon request, employers must explain the decision in a way that is meaningful and understandable, including what factors the AI system weighted
- Appeal: In some contexts, Colorado residents may request a human review of decisions made with ADMT
Change 5: Safe harbor added
SB 189 adds a safe harbor that was not in SB 24-205. Companies that implement documented AI risk management practices consistent with recognized standards are less likely to face enforcement action. The law does not name specific standards but NIST AI RMF, ISO 42001, and the EU AI Act's governance frameworks are likely candidates.
What SB 189 requires in practice
Who is covered
SB 189 applies to any employer that:
- Uses AI that substantially influences a consequential decision about a Colorado resident
- Has 50 or more employees (smaller employers are generally exempt from ADMT obligations)
- Operates in Colorado or uses AI that affects Colorado residents (remote or out-of-state employers are covered if their decisions affect Colorado residents)
What ADMT covers
ADMT under SB 189 covers AI systems used in:
- Employment decisions: hiring, promotion, performance evaluation, termination, compensation decisions
- Credit decisions: lending, credit limit changes, loan approvals
- Education decisions: admissions, financial aid
- Healthcare decisions: insurance coverage, treatment authorization, access determinations
- Housing decisions: rental approvals, mortgage applications
- Insurance decisions: coverage, underwriting, claims
- Legal services decisions: eligibility, representation
The law focuses on decisions that substantially affect access to these domains for Colorado residents.
Disclosure requirements
When ADMT substantially influences a consequential decision, affected Colorado residents must be:
- Notified that ADMT was used in the decision
- Informed of the categories of data the ADMT processed
- Given an explanation of how the ADMT affected the outcome
- Told how to request a human review (where applicable)
The notice must be provided in a way the person can understand. Dense technical descriptions of the AI model are not sufficient.
5-step preparation checklist for Colorado employers
Step 1: Inventory AI-assisted decision processes affecting Colorado residents
List every AI tool or automated system your company uses that influences consequential decisions for Colorado residents. For each one: does the AI substantially influence the outcome, or is it purely advisory (human has full information and full discretion)?
Step 2: Classify as ADMT or not
For each AI system identified: does it meet the ADMT definition? The key question: could a Colorado resident argue that the AI substantially influenced a consequential decision affecting them? If yes, treat it as ADMT.
Step 3: Prepare disclosure templates
For each ADMT system, draft the disclosure notice you will send to affected Colorado residents. The notice should cover: that ADMT was used, what data it processed, what factors it weighted, and how to request an explanation or review.
Step 4: Implement the safe harbor governance documentation
Even though impact assessments are no longer mandatory, document your AI governance practices. This documentation supports your safe harbor defense if the AG investigates. At minimum: what AI tools you use, what decisions they influence, what bias or accuracy testing you have done, and who is responsible for each system.
Step 5: Review your employment processes specifically
Colorado's consequential decision definition covers employment decisions. If you use AI in resume screening, video interview analysis, performance evaluation, or compensation review for Colorado-based employees or candidates, review those processes against the ADMT definition and disclosure requirements.
Colorado SB 189 and other state laws
If you operate in multiple states, you are likely navigating several AI laws simultaneously:
| State | Law | Key obligation | Effective date |
|---|---|---|---|
| Colorado | SB 189 | ADMT disclosure for consequential decisions | January 1, 2027 |
| Illinois | AI Video Interview Act | AI interview disclosure + consent | January 1, 2026 (already in effect) |
| Connecticut | SB 5 | AI employer obligations | October 1, 2026 |
| New York City | Local Law 144 | Bias audit for automated employment tools | Already in effect |
| California | AB 2013 | AI training data transparency (for developers) | January 1, 2026 |
The practical recommendation: implement disclosure and governance documentation as a universal baseline, not state-by-state. An employer with employees in Colorado, Illinois, and Connecticut needs a unified AI hiring governance program more than three separate compliance checklists.
What was not affected by SB 189
The enforcement injunction from April 2026 (related to SB 24-205) does not affect SB 189. The two are legally separate.
Federal law applies on top of SB 189: EEOC disparate impact liability, Title VII, ADA, ADEA remain in effect regardless of what Colorado state law requires. AI tools that create disparate impact against protected groups remain actionable under federal law even if they are not ADMT under SB 189.
The April 2026 injunction is academic now that SB 24-205 is replaced. If SB 189 is challenged, that would be a separate legal proceeding.
