Written and maintained by CASRAI Editorial Board
Last updated
“The Colorado AI Act” is the common name for SB 24-205, signed into law on May 17, 2024. As of today, that law has never actually taken effect. Its implementation date was pushed from February 1, 2026 to June 30, 2026, and before that later date arrived, the Colorado legislature repealed SB 24-205’s substantive provisions and reenacted them under a new bill, SB 26-189, signed May 14, 2026. This guide explains what the reenacted law actually requires, who it covers, and the enforcement date that applies now — not the original 2024 text, which is superseded.
Unlike California’s SB 53 or New York’s RAISE Act, Colorado’s law was never a frontier-model safety statute. It does not use a training-compute threshold and does not regulate the handful of labs building the largest general-purpose models. It regulates any developer or deployer — of any size — whose automated system is used to make or influence decisions about individual people in specific high-stakes contexts. That is a fundamentally different regulatory model, even though the three laws are often discussed together as “state AI laws.”
From SB 24-205 to SB 26-189: what changed
SB 24-205 was built around two ideas: a “high-risk artificial intelligence system” (one that is a substantial factor in a consequential decision) and “algorithmic discrimination” (the law’s core harm to prevent), with duties running to both “developers” and “deployers” of such systems. That framework was delayed once — Colorado’s legislature passed SB 25B-004 in an August 2025 special session, signed August 28, 2025, which extended SB 24-205’s effective date from February 1, 2026 to June 30, 2026.
Before the June 2026 date arrived, lawmakers went further than a delay. SB 26-189, signed May 14, 2026, repeals SB 24-205’s provisions and reenacts a revised version in their place, built around “automated decision-making technology” (ADMT) rather than “high-risk artificial intelligence systems.” The result is that SB 24-205’s original obligations never came into force at all — they were replaced first. Older coverage of “the Colorado AI Act” describing algorithmic discrimination duties effective mid-2026 is describing the superseded version, not current law.
Who SB 26-189 covers
The reenacted law applies to developers and deployers of automated decision-making technology, defined as technology that processes personal data and uses computation to generate output — predictions, recommendations, classifications, rankings, scores, or similar information — that is used to make, guide, or assist a decision, judgment, or determination concerning an individual.
The obligations only attach when that technology is used in a consequential decision: a decision relating to an individual’s access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits. A general-purpose AI tool with no role in decisions like these is outside the law’s scope; a hiring-screening tool, a lending-eligibility model, or a benefits-eligibility system is squarely inside it.
What developers and deployers must do
The two roles carry different duties:
- Developers must provide technical documentation describing the ADMT’s intended uses, the categories of data used to train it, its known limitations, and instructions for use; notify deployers of material updates or modifications; and retain compliance records for at least three years.
- Deployers must give consumers clear notice at the point they interact with the ADMT, and must supply a plain-language explanation to a consumer within 30 days of an adverse consequential decision made using it; deployers must also retain compliance records for at least three years.
What happened to “algorithmic discrimination”
SB 24-205 centered on preventing “algorithmic discrimination” — language tied to known or reasonably foreseeable risks that an AI system would produce discriminatory outcomes. SB 26-189 does not carry that defined term forward. Instead, the reenacted law addresses discrimination by allocating fault between developers and deployers in civil actions alleging unlawful discrimination under Colorado’s existing discrimination law, rather than by creating a free-standing “algorithmic discrimination” prohibition of its own. In practice, discrimination arising from ADMT use is now litigated under the state’s general anti-discrimination statutes, with SB 26-189 setting how responsibility splits between the company that built the system and the company that deployed it.
Enforcement
The Colorado Attorney General has exclusive enforcement authority, through the Colorado Consumer Protection Act; a violation is treated as a deceptive trade practice. There is no private right of action. Before January 1, 2030, the Attorney General must give a developer or deployer 60 days’ notice and an opportunity to cure an alleged violation before bringing an action, where a cure is possible. The Attorney General also has rulemaking authority under the act.
The date that actually matters: January 1, 2027
SB 26-189’s operative requirements — including developer documentation duties and the Attorney General’s rulemaking deadline — take effect January 1, 2027. As of this writing, neither SB 24-205’s original obligations nor SB 26-189’s obligations are yet in force. Anything describing Colorado AI Act compliance duties as currently binding, or as taking effect June 30, 2026, is out of date.
Colorado’s law vs. SB 53 and the RAISE Act
Colorado, California, and New York are frequently grouped together as “state AI laws,” but Colorado’s is a different kind of statute from the other two:
| Dimension | Colorado (SB 26-189) | California SB 53 | New York RAISE Act |
|---|---|---|---|
| Regulatory model | Consequential-decision / algorithmic accountability | Frontier-model safety | Frontier-model safety |
| Who is covered | Any developer/deployer of ADMT used in consequential decisions | Developers who trained a model above a compute threshold | Developers who trained a model above a compute threshold |
| Trigger | Use in education, employment, housing, lending, insurance, health care, or government-benefits decisions | Training compute above 1026 operations, plus revenue | Training compute above 1026 operations, plus revenue |
| Core concern | Discriminatory or unexplained decisions about individuals | Catastrophic, mass-casualty-scale risk | Catastrophic, mass-casualty-scale risk |
| Enforcement | Colorado AG, Consumer Protection Act | California AG | New York AG plus new DFS office |
| Effective date | January 1, 2027 | January 1, 2026 | January 1, 2027 |
A company that has already scoped its compliance work to SB 53 or the RAISE Act has not thereby addressed Colorado’s law, and the reverse is also true: building an ADMT notice-and-documentation program for Colorado says nothing about whether an organization trains frontier models at all. The two categories of obligation run on separate tracks and, for a company that both trains large models and deploys AI in hiring or lending decisions, both can apply at once.
Why the distinction matters for NIKOLAI
NIKOLAI, CASRAI’s open dictionary of frontier-AI safety elements, is scoped to frontier-model safety terminology — the vocabulary used by laws like SB 53 and the RAISE Act, and by developer frameworks like Anthropic’s Responsible Scaling Policy or Google DeepMind’s Frontier Safety Framework. Colorado’s SB 26-189 is not a frontier-model safety law, and terms like “automated decision-making technology” and “consequential decision” sit in a different regulatory tradition — closer to algorithmic-accountability and anti-discrimination law than to catastrophic-risk governance. Treating “colorado ai act,” “SB 53,” and “RAISE Act” as interchangeable search terms for the same underlying obligation is a common but material mistake; NIKOLAI’s scope reflects that distinction rather than collapsing it.
Frequently asked questions
Is the Colorado AI Act in effect right now?
No. Neither the original SB 24-205 text nor its replacement, SB 26-189, has reached its effective date. SB 24-205 was superseded before its (twice-set) effective date arrived. SB 26-189’s obligations take effect January 1, 2027.
Is SB 26-189 the same law as “the Colorado AI Act,” or a different one?
It is the same underlying statute, amended by repeal and reenactment. SB 26-189 replaces SB 24-205’s text in the Colorado Revised Statutes rather than existing alongside it. Most current references to “the Colorado AI Act” should be understood as referring to the law as SB 26-189 left it.
Does Colorado’s law regulate frontier AI models, like California’s SB 53?
No. Colorado’s law has no training-compute threshold and does not single out the developers of the largest general-purpose models. It applies based on how a system is used — specifically, whether it is used to make or assist a consequential decision about a person — regardless of the developer’s size or the model’s scale.
Does “algorithmic discrimination” still exist as a legal standard in Colorado?
Not as a standalone defined term under this act. SB 26-189 instead allocates fault between developers and deployers of ADMT in civil discrimination actions brought under Colorado’s existing anti-discrimination law, rather than creating its own separate algorithmic-discrimination prohibition the way SB 24-205 did.
Who enforces SB 26-189, and is there a private right of action?
The Colorado Attorney General has exclusive enforcement authority under the Colorado Consumer Protection Act; violations are deceptive trade practices. There is no private right of action. Before January 1, 2030, the Attorney General must offer a 60-day cure period before bringing an action, where a cure is possible.
What is a “consequential decision” under the law?
A decision affecting an individual’s access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits. ADMT obligations only attach when the technology is used in a decision of this kind.
