GuideColorado SB26-189Version 1.025 October 2026
The Colorado AI Act from 1 January 2027
From 1 January 2027, Colorado SB26-189, signed on 14 May 2026, repeals and reenacts the 2024 AI Act around automated decision-making technology in consequential decisions; the enacted text no longer mentions the NIST AI RMF, and, according to the fiscal note of 8 September 2026, a federal court has barred enforcement of the 2024 text since 27 April 2026. This page reads the enacted text: who is covered, the records a deployer keeps, and how one record answers Colorado, Texas and the EU AI Act.
On this page
A reading of the enacted text, dated and sourced.
In this document, "we" means Hikari Blue, the firm that installs the governance controls cited below on client engagements and hands them over. This is not legal advice. Whether the act applies to a given system is a question for counsel.
Section numbers refer to part 17 of article 1 of title 6 of the Colorado Revised Statutes (C.R.S.), as repealed and reenacted by section 1 of SB26-189. Summaries follow the signed act; the official text governs.
Where we map the act onto records and controls, we say so: in our reading. Mapping prepared by Hikari Blue; the Colorado attorney general has not reviewed it.
Notices, records and human review replace the 2024 risk program.
SB26-189 repeals and reenacts part 17 of article 1 of title 6, C.R.S., the part that SB24-205 created. Under section 5 of the act, it takes effect on 1 January 2027 and applies to consequential decisions made on or after that date; the rulemaking mandates took effect on passage.
The enacted text contains no duty of reasonable care, no risk management program, no impact assessment and no reference to the NIST AI RMF or ISO/IEC 42001. SB24-205 contained all 5.
Developer documentation · 6-1-1702
From 1 January 2027, a developer gives each deployer the intended and known harmful uses of the covered ADMT, the categories of training data, its known limitations, instructions for use, monitoring and meaningful human review, and notice of material updates. It keeps its records for at least 3 years.
Deployer records · 6-1-1703
A deployer keeps, for at least 3 years after each consequential decision, the records reasonably necessary to demonstrate compliance. They may include version identifiers, changelogs and documentation of material mitigation changes.
Notice before use · 6-1-1704(1) and (2)
Before a covered ADMT materially influences a consequential decision, the deployer gives the consumer a clear and conspicuous notice. A prominent public notice at the points of consumer interaction satisfies the duty.
Adverse-outcome disclosure · 6-1-1704(3)
Within 30 days after a decision with an adverse outcome, the deployer describes the decision and the role the ADMT played, explains how to request the ADMT name, version, developer and the personal data used, and states the consumer's rights.
Correction and human review · 6-1-1705
On request after an adverse outcome, the deployer gives instructions to correct inaccurate personal data and an opportunity for meaningful human review and reconsideration of the decision, to the extent commercially reasonable.
Enforcement · 6-1-1706
The attorney general enforces part 17 alone, as a deceptive trade practice under the Colorado Consumer Protection Act, after a notice of violation and 60 days to cure where a cure is possible. The cure right is repealed on 1 January 2030. The act creates no private right of action.
The act requires the attorney general to adopt rules on the adverse-outcome disclosures and on the consumer rights on or before 1 January 2027 (6-1-1704(4)(b) and 6-1-1705(3)). This page reads the statute only.
Liability stays under existing law: a developer or deployer may be held liable under state anti-discrimination law for a consequential decision materially influenced by a covered ADMT, with fault allocated between them (6-1-1707). Compliance with part 17 is not a defense to noncompliance with any other law (6-1-1709(2)).
3 acts in 2 years, and an order that bars enforcement.
Each status below was read in its primary source on 25 October 2026. The dates are those of the US context in our NIST AI RMF crosswalk.
| Instrument | What it does | Status on 25 October 2026 |
|---|---|---|
| Colorado SB24-205, Consumer Protections for Artificial Intelligence | Created part 17: a duty of reasonable care against algorithmic discrimination, deployer risk programs judged against the latest NIST AI RMF, ISO/IEC 42001 or an equivalent framework (C.R.S. 6-1-1703(2)), and an affirmative defense in attorney general actions tied to those frameworks (6-1-1706(3)). | Signed 17 May 2024. Requirements moved to 30 June 2026 by SB25B-004. Repealed and reenacted by SB26-189 from 1 January 2027. |
| Colorado SB25B-004, Increase Transparency for Algorithmic Systems | Moved the requirements of SB24-205 from 1 February 2026 to 30 June 2026. | Signed 28 August 2025, in the special session of August 2025. |
| Colorado SB26-189, Automated Decision-Making Technology | Repeals and reenacts part 17 around automated decision-making technology used in consequential decisions. The enacted text mentions neither the NIST AI RMF nor a framework-based defense. | Signed 14 May 2026. Most provisions take effect on 1 January 2027 and apply to consequential decisions made from that date. |
| X.AI LLC v. Weiser, US District Court | According to the final fiscal note of SB26-189, the court ordered the attorney general not to initiate enforcement of SB24-205 or any legislation amending it until the attorney general completes rulemaking and the court rules in the case. | Order of 27 April 2026, reported by Colorado Legislative Council Staff on 8 September 2026. We have not read the order itself. |
The fiscal note states that the timing of implementation and enforcement will depend on court actions. Whether the order reaches SB26-189 after 1 January 2027 is a question for counsel.
Guides that still present the Colorado act as a NIST safe harbor describe the 2024 text. The safe harbor does not survive the reenactment.
A deployer is any person doing business in Colorado that deploys a covered ADMT.
Scope follows the definitions of C.R.S. 6-1-1701 and the carve-outs of 6-1-1708. The enacted text sets no size threshold and no small-deployer exemption.
| Term | What the enacted text says | Section |
|---|---|---|
| Automated decision-making technology (ADMT) | Technology that processes personal data and uses computation to generate output, such as predictions, recommendations, classifications, rankings or scores, used to make, guide or assist a decision about an individual. | 6-1-1701(2)(a) |
| What is not ADMT | 14 listed tools, among them anti-malware, calculators, databases, firewalls and spreadsheets without machine learning; a tool used solely to summarize, organize, translate, draft, route or present information for human review; and a conversational tool not intended for consequential decisions and barred from them by an acceptable use policy. | 6-1-1701(2)(b) |
| Consequential decision | A decision, determination or action about a consumer that relates to access to, eligibility for, selection for or compensation for a covered domain, or to a differentiated price or other material terms reasonably likely to materially limit, delay or deny that access. | 6-1-1701(3)(a) |
| What is not a consequential decision | Low-stakes or routine processes such as scheduling, customer service triage or workflow management; advertising, marketing, search and content moderation; summaries that produce no score or recommendation; cybersecurity, fraud prevention, anti-money laundering and sanctions controls. | 6-1-1701(3)(b) |
| Covered domain | Education enrollment or opportunity, employment, residential real estate in Colorado, financial or lending services, insurance, health-care services, and essential government services and public benefits. | 6-1-1701(6) |
| Covered ADMT and materially influence | An ADMT used to materially influence a consequential decision: its output is a non-de minimis factor in the decision and affects its outcome. Incidental, trivial or clerical uses are excluded. | 6-1-1701(5) and (13) |
| Consumer | A consumer as defined in C.R.S. 6-1-1303(6)(a), plus employees, job applicants who are Colorado residents, and any individual evaluated in a consequential decision by a person doing business in Colorado. | 6-1-1701(4) |
| Deployer | A person doing business in Colorado that deploys a covered ADMT. | 6-1-1701(7) |
| Developer | A person doing business in Colorado that makes a covered ADMT commercially available, develops a component intended for one, or intentionally and substantially modifies an ADMT so that it becomes one. Development solely for research, or for internal use not made available to others, is excluded. | 6-1-1701(8) |
| Meaningful human review | Review by an individual designated by the deployer, with authority to approve, modify or override the decision, who considers the available primary evidence, is trained, does not default to the system output, and can understand the output's intended use, limitations, inputs and principal factors. | 6-1-1701(15) |
4 carve-outs, read in the enacted text.
Insurers · 6-1-1708(1) and (2)
An insurer subject to C.R.S. 10-3-1104.9 is in compliance with part 17 in the practice of insurance. Its uses of a covered ADMT in employment decisions stay covered.
HIPAA covered entities · 6-1-1708(3)
Sections 6-1-1701 to 6-1-1706 do not apply to a HIPAA covered entity or its business associates, except for employment decisions. The entity gives patients a general notice of advanced technologies, and specific disclosures when a covered ADMT decides eligibility for financial assistance.
FDA oversight · 6-1-1708(4)
Medical devices subject to FDA oversight, and pharmaceutical or device research under that oversight, are outside sections 6-1-1701 to 6-1-1706.
Credit and education · 6-1-1704(6) and (9)
A creditor whose notice under the Equal Credit Opportunity Act, and the Fair Credit Reporting Act where it applies, also meets the act's requirements gives no duplicate notice. A deployer subject to FERPA uses its FERPA channels.
In our reading, a company that runs a general-purpose model in a workflow becomes a deployer under the act only when that output materially influences a consequential decision in a covered domain. The use-case register is where that classification is made, dated and signed.
3 years of records, written when each decision is made.
C.R.S. 6-1-1703 asks for the records reasonably necessary to demonstrate compliance, kept at least 3 years after each consequential decision. It names version identifiers, changelogs and documentation of material mitigation changes, and leaves the rest to the deployer.
In our reading, each duty of the act is answered by a field of the 9-field record of an AI audit trail, produced by a control of our governance framework. Mapping prepared by Hikari Blue; the Colorado attorney general has not reviewed it.
| What the act asks | Field of the 9-field record | Governance control |
|---|---|---|
| Which systems materially influence a consequential decision · 6-1-1701(5) and (13) | No field: the use-case register, with a signed classification | GOV-P-01 |
| Version identifiers and changelogs · 6-1-1703 | Model and version | GOV-P-03 |
| Notice before use · 6-1-1704(1) | Policy applied, Timestamp | GOV-P-04 |
| Role the ADMT played in an adverse decision · 6-1-1704(3)(a) | Action, Human verification | GOV-E-01 |
| ADMT name, version, developer and personal data used · 6-1-1704(3)(b) | Model and version, Inputs reference | GOV-P-03 · GOV-D-03 |
| Disclosure within 30 days after the decision · 6-1-1704(3) | Timestamp | GOV-E-01 |
| Meaningful human review by a designated, trained individual · 6-1-1705(1) and 6-1-1701(15) | Human verification, Actor identity | GOV-A-03 · GOV-E-02 |
| Cure within 60 days of a notice of violation · 6-1-1706(3) | Hash chain, Policy applied | GOV-E-03 |
Controls. GOV-P-01 use-case register and classification; GOV-P-03 model selection and change control; GOV-P-04 instructions for use and transparency; GOV-D-03 inputs by reference; GOV-A-03 human verification of consequential outputs; GOV-E-01 append-only, chained trail; GOV-E-02 dated literacy records; GOV-E-03 monitoring and incident record.
In our reading, a record written at the moment of the decision answers the 30-day disclosure and a later request for human review without reconstruction; a record assembled after the notice of violation does not show what the system did on the date of the decision.
Colorado, Texas and the EU AI Act ask different questions of the same record.
The 3 texts differ in trigger, duty and enforcement. The record that answers them holds the same facts: who acted, with which model, under which rule, with which human check, and when.
| Point | Colorado SB26-189 | Texas HB 149 | EU AI Act, deployer |
|---|---|---|---|
| In force | From 1 January 2027, for consequential decisions made from that date | Since 1 January 2026 | Article 26 applies from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Annex I systems |
| Trigger | A covered ADMT materially influences a consequential decision in a covered domain | Developing or deploying an AI system with a prohibited intent; listed uses by governmental entities | Use of a high-risk AI system as deployer |
| Deployer duties | Notice before use, adverse-outcome disclosure within 30 days, correction and meaningful human review on request | No affirmative duty for a private deployer beyond the prohibitions | Use according to the instructions for use, human oversight by persons with competence, training and authority, monitoring of operation |
| Records | At least 3 years after each consequential decision (6-1-1703) | No retention duty; documentation on civil investigative demand (552.103) | Logs under the deployer's control, at least 6 months (Article 26(6)) |
| Human review | Meaningful human review, defined in 6-1-1701(15) | Not required by the act | Human oversight (Article 26(2)); right to explanation for decisions based on Annex III systems (Article 86) |
| Enforcement | Attorney general alone; 60 days to cure where possible, until 1 January 2030 | Attorney general alone; 60-day notice to cure; up to $200,000 per uncurable violation | National market surveillance authorities |
In our reading, one record kept 3 years meets the 3-year retention of Colorado and the 6-month floor of Article 26(6), subject to data protection law, and holds what a Texas civil investigative demand can request. Mapping prepared by Hikari Blue; no authority named on this page has reviewed it.
EU AI Act dates and duties are those served on our AI audit trail entry and EU AI Act deployer guide, after Regulation (EU) 2026/1744.
- Texas HB 149, the Texas Responsible AI Governance Act In effect since 1 January 2026: scope, the framework defense, the 60-day cure and penalties.
- EU AI Act deployer obligations What the AI Act asks of the company that runs the system, not of the model vendor.
- AI laws in the United States No federal AI act: the NIST AI RMF, Texas and Colorado, page by page.
The questions buyers ask about the Colorado AI Act.
When does the Colorado AI Act take effect?
SB26-189 takes effect on 1 January 2027 and applies to consequential decisions made on or after that date, under section 5 of the act. It replaces the 2024 text, whose requirements had been moved to 30 June 2026 and whose enforcement a federal court order has barred since 27 April 2026.
Does the Colorado AI Act still refer to the NIST AI RMF?
No. SB24-205 judged deployer risk programs against the latest NIST AI RMF, ISO/IEC 42001 or an equivalent framework, and tied an affirmative defense to them. The text enacted by SB26-189 mentions neither the NIST AI RMF nor a framework-based defense.
Who is a deployer under SB26-189?
A person doing business in Colorado that deploys a covered ADMT: automated decision-making technology used to materially influence a consequential decision in education, employment, housing, financial or lending services, insurance, health care or essential government services. The enacted text sets no size threshold.
What records must a Colorado deployer keep?
The records reasonably necessary to demonstrate compliance, for at least 3 years after each consequential decision, which may include version identifiers, changelogs and documentation of material mitigation changes (C.R.S. 6-1-1703). They also have to support the 30-day adverse-outcome disclosure and a meaningful human review on request.
Who enforces the act, and with what penalty?
The attorney general alone, as a deceptive trade practice under the Colorado Consumer Protection Act, after a notice of violation and 60 days to cure where a cure is possible; the cure right is repealed on 1 January 2030. The final fiscal note cites a civil penalty of up to $20,000 per violation under that act. There is no private right of action.
Is the Colorado AI Act suspended?
Enforcement of the 2024 text is. According to the final fiscal note of SB26-189, a US District Court order of 27 April 2026 in X.AI LLC v. Weiser bars the attorney general from initiating enforcement of SB24-205 or any legislation amending it until rulemaking concludes and the court rules. Whether the order reaches SB26-189 is a question for counsel.
Reference documents and primary sources.
Every Colorado date and provision on this page comes from the primary sources below, consulted on 25 October 2026. EU AI Act and Texas facts come from the pages listed first.
Reference documents
- NIST AI RMF implementation, control by control v1.0 Crosswalk of 21 October 2026; section 4 dates the Texas and Colorado instruments.
- Enterprise AI Governance Framework v1.0 15 controls with owners, cadences, evidence and EU AI Act hooks. CC BY 4.0.
- AI audit trail: definition, fields and EU AI Act mapping The 9-field record, Articles 12, 19 and 26 of the AI Act, retention and dates.
- What is an AI operating layer? The definition, the 4 tests and the regulatory doctrine this guide applies.
Primary sources, consulted on 25 October 2026
- Colorado General Assembly · SB26-189 (opens in a new tab) Bill history: signed by the governor on 14 May 2026; session laws, chapter 131.
- Colorado General Assembly · SB26-189, signed act (opens in a new tab) Sections 6-1-1701 to 6-1-1709 as reenacted, and section 5 on the effective date and applicability. PDF.
- Colorado Legislative Council Staff · SB26-189, final fiscal note (opens in a new tab) 8 September 2026. The court order of 27 April 2026, the effective dates and the civil penalty under the Colorado Consumer Protection Act. PDF.
- Colorado General Assembly · SB24-205 (opens in a new tab) Signed 17 May 2024; sections 6-1-1703(2) and 6-1-1706(3) of the signed act.
- Colorado General Assembly · SB25B-004 (opens in a new tab) Signed 28 August 2025; requirements of SB24-205 moved to 30 June 2026.
- Texas Legislature Online · HB 149, enrolled text (opens in a new tab) Chapters 551 to 554 of the Business and Commerce Code, for the Texas column of section 5.
How to cite this document.
This URL is permanent and always serves the current version. Each change of substance increments the version and is listed in the changelog below, so a citation stays traceable to the text it quoted.
Preferred citation
Hikari Blue, "The Colorado AI Act from 1 January 2027 v1.0", 25 October 2026, https://hikariblue.com/united-states/colorado-ai-act
Section anchors are stable: #status, #what-changes, #history, #scope, #records, #three-regimes, #faq, #references, #cite.
Changelog
v1.0 · 25 October 2026. First public version.
License. Published under CC BY 4.0: free to cite, quote and reuse with attribution to Hikari Blue and a link to this page. The license covers Hikari Blue’s text, tables and diagrams on this page; it does not cover third-party data, quotations or legal texts, which keep their own terms, nor the Hikari Blue name and logo, trademarks of UNITED4 LLC.
Test one decision against SB26-189 before 1 January 2027.
30 minutes with a named partner. We take one decision your systems already influence, read it against the definitions of the act, and show which of the records the act expects exist today. You leave with the list, whether or not we ever work together.
- One decision read against the definitions of SB26-189
- The records that exist today, and the ones missing
- Who should own each gap