Colorado’s AI law is moving again before many companies have even finished mapping the original version.
If you want the official text, the Colorado bill is here: SB26-189.
In May 2026, lawmakers passed SB 26-189, a major rewrite of the state’s earlier AI framework. The main shift is from regulating broadly defined “high-risk AI systems” to regulating automated decision-making technology, or ADMT, when it materially influences consequential decisions.
That matters because the law is aimed at real decision environments legal teams already care about: employment, housing, lending, insurance, health care, education, and essential government services. The practical question is no longer just what a tool is called. It is how that tool is used when it affects a person in a meaningful way.
The new focus is operational accountability
The revised bill is set to take effect on January 1, 2027. That buys time, but it also makes the compliance direction clearer.
Developers would need to give deployers technical documentation on intended uses, training data categories, limitations, and human-review instructions. Deployers would need to provide consumer notices and, after an adverse outcome, a plain-language explanation of the role the system played. Consumers would also have rights to seek correction of inaccurate data and meaningful human review.
Why this matters for legal teams
This is especially important for employment and other high-impact workflows. Recruiting tools, ranking systems, interview-analysis products, and recommendation engines can all end up inside the regulatory frame if they materially influence decisions.
That means the compliance question becomes more concrete: what is the system doing, who is relying on it, what notice is required, and what happens when someone challenges the outcome?
The bigger lesson
Colorado’s rewrite is a useful reminder that state AI compliance is still moving in real time. Static AI policies are going to age badly. Legal and compliance teams need a more flexible operating model that can absorb changing definitions, disclosure duties, and review rights across states.
The takeaway is not that Colorado is backing away from AI regulation. It is that Colorado is trying to make its law more targeted and more workable. For companies using AI in consequential decisions, the safer question is not “do we use AI?” but “can we explain and defend how this system influenced the decision?”