Skip to main content
3 days

Colorado ADMT rules: hearing and last day for written comments · Oct 26, 2026 · See what changes

US State·Passed·Effective January 1, 2027

Colorado Artificial Intelligence Act (SB 24-205, replaced by SB 26-189)

Dates and status re-checked against primary sources on October 21, 2026. How we verify

SB 26-189, signed by Governor Polis on May 14, 2026 and effective January 1, 2027, repeals and re-enacts SB 24-205. It removes the 2024 duty of care, risk management program and impact assessment requirements and replaces them with a point-of-interaction notice, a post-adverse-outcome disclosure, and limited consumer rights for people affected by covered automated decision-making technology (ADMT) used in consequential decisions such as employment, education, housing and financial services. Enforcement is also on hold in xAI's lawsuit against the attorney general (X.AI LLC v. Weiser, D. Colo. No. 1:26-cv-01515): on April 27, 2026 the court granted the parties' stipulation and ordered that the attorney general not start enforcement under SB 24-205, or legislation replacing it enacted that session, until 14 days after the court rules on xAI's preliminary injunction motion. xAI files that motion within 28 days after final rules are adopted.

What this means for your team

If you deploy ADMT that materially influences a consequential decision about a Colorado resident, plan for four things by January 1, 2027: a clear and conspicuous notice at the point of interaction, a plain-language description of the tool's role within 30 days after an adverse outcome, handling requests after an adverse outcome to get and correct the personal data used and to ask for meaningful human review and reconsideration (to the extent commercially reasonable), and keeping compliance records for at least 3 years. Developers must give deployers technical documentation (intended uses, categories of training data, known limitations, instructions for use and human review) and tell them about material updates. The attorney general enforces the act and must adopt rules on the adverse-outcome disclosure by January 1, 2027. We checked these points against the signed act (C.R.S. 6-1-1702 to 6-1-1706). The rules are not final yet: the attorney general's office filed proposed rules on August 11, 2026, posted an interim redline draft on October 6, 2026, and takes written comments through October 26, 2026, the day of its rulemaking hearing in Denver. Read the interim draft before you lock your notice wording.

Key requirements

  • Clear and conspicuous notice to consumers at the point of interaction with a covered ADMT
  • Plain-language description of the ADMT's role within 30 days after a consequential decision with an adverse outcome
  • After an adverse outcome, consumers can ask for instructions to request and correct the personal data used, and for meaningful human review and reconsideration to the extent commercially reasonable
  • Developers and deployers keep records showing compliance for at least 3 years
  • The 2024 duty of care, risk management program and impact assessment requirements no longer apply
  • Attorney general enforcement under the Colorado Consumer Protection Act; before January 1, 2030 the attorney general must first give a 60-day notice and opportunity to cure where a cure is possible, except for knowing or repeated violations. No new private right of action
← All regulations