Colorado AI Legislation in 2026

The Colorado Picture

Colorado spent two years as the most watched name in American AI regulation, and in 2026 it spent two weeks dismantling the very thing that made it famous. When Governor Polis signed SB 24-205 in May 2024, Colorado became the first state in the country to enact a comprehensive, cross-sector AI law. It borrowed the architecture of the EU AI Act: a risk-based regime built around high-risk systems, a developer and deployer duty of care to prevent algorithmic discrimination, mandatory impact assessments, and risk management programs. For a year and a half, every compliance team in the country treated Colorado as the template for what state AI law would look like. That assumption is now obsolete.

The repeal and replace saga is the real story. Polis signed the original law while openly warning it would impose heavy costs, and the legislature never let the substantive obligations actually take effect. A 2025 special session produced SB 25B-004, which pushed the compliance date from February 2026 to June 2026 to create room for a rewrite. That rewrite arrived as SB 26-189, signed in May 2026, which repeals and reenacts the entire framework before the old one ever bound anyone. The new law throws out the EU-style scaffolding. Gone are the duty of care, the risk management programs, and the impact assessments. In their place is a leaner, transparency-first regime built around automated decision-making technology that materially influences a consequential decision, with documentation duties for developers, notice and human-review rights for consumers, and Attorney General enforcement through existing consumer-protection law. The framework does not bind anyone until January 1, 2027.

For builders and businesses, the practical message is that Colorado got materially easier to comply with, but not simpler to predict. The obligations are narrower and more clearly scoped, the most expensive items are removed, and there is no new private right of action, though civil penalties can reach $20,000 per violation. The biggest update since the spring is that the Attorney General's rulemaking, which I earlier described as not yet begun, is now well underway. The Department of Law filed proposed rules (4 CCR 904-6) on August 11, 2026, took more than sixty public comments, issued a revised interim draft on October 6, and has set a formal rulemaking hearing for October 26, 2026. Those rules fill in critical definitions, including what materially influence means, through a rebuttable presumption that certain ADMT outputs influence a consequential decision unless a deployer shows the factor was de minimis. Until the rules are final, the operative scope of the statute is still not fully settled.

The 2026 session did more than rewrite the flagship law. The same month SB 26-189 was signed, Polis also signed the Chatbot Safety Act (HB 26-1263), which forces conversational AI systems to tell users they are not talking to a human and layers on protections for minors, and he vetoed HB 26-1210, an aggressive ban on individualized pricing and wage setting built on surveillance data, on the grounds that it was overly broad and duplicated the new ADMT regime. Together those two moves show the shape of Colorado's current posture: it will regulate AI disclosure and consumer-facing transparency, but it is wary of sweeping prohibitions and new private rights of action.

The law also still sits inside active litigation. xAI's constitutional challenge in x.AI LLC v. Weiser remains pending, a federal magistrate judge stayed enforcement of the original act in late April 2026, and xAI agreed to seek a preliminary injunction within 28 days after final rules or replacement legislation. With rulemaking now heading toward a late-October hearing and a January 1, 2027 effective date, that clock is close to starting. Realistically, no one should expect live enforcement before the rules are finalized, and the Attorney General has signaled he will not enforce until they are.

Where this is heading is a story about the collapse of the Colorado model as a national template. Colorado pioneered the EU-style comprehensive approach and then publicly walked away from it under cost concerns, industry pressure, and federal headwinds. The pivot toward disclosure and consumer rights, rather than upstream discrimination liability, is the direction I expect other hesitant states to copy, precisely because Colorado already absorbed the political cost of the experiment. My read for executives: treat January 1, 2027 as the planning horizon, build for documentation, notice, and human-review workflows now, read the draft 4 CCR 904-6 rules closely, and watch both the October rulemaking hearing and the xAI litigation, because either could still reshape the obligations before they bite.