What the Colorado AI Act requires now
Aranv’s short answer: the Colorado AI Act of 2024, SB 24-205, was repealed and reenacted by SB 26-189, signed May 14, 2026. The new law governs automated decision-making technology used in consequential decisions such as hiring, lending, housing and health care, with developer duties starting January 1, 2027.
Colorado passed SB 24-205 in 2024 as a broad law on high-risk AI systems and algorithmic discrimination. A 2025 special-session bill moved its duties to June 30, 2026, and before then SB 26-189 repealed and reenacted those provisions, so Colorado advice written before May 2026 is probably out of date.
Under SB 26-189, developers of covered automated decision-making technology must, starting January 1, 2027, give deployers technical documentation and tell them about material updates. Deployers owe consumers a notice at the point of interaction and, after an adverse outcome, a plain-language account of the technology’s role within 30 days; the attorney general must adopt rules on those accounts by January 1, 2027. Both sides keep compliance records for at least three years.
How Colorado’s AI law changed from 2024 to 2026
From SB 24-205 to SB 26-189
- 01 2024: SB 24-205 signed Approved May 17, 2024, with duties first due February 1, 2026.
- 02 2025: start date moved SB 25B-004, approved August 28, 2025, pushed the requirements to June 30, 2026.
- 03 2026: repealed and reenacted SB 26-189, signed May 14, 2026, replaced the act with rules on automated decisions.
- 04 2027: first duties begin Developer documentation duties start January 1, 2027, when attorney general rules are also due.
Dates come from the Colorado General Assembly’s bill pages.
Four points on the Colorado AI Act today
Much of what was written about the 2024 law no longer applies, so start from the current text.
A narrower replacement law
SB 26-189 regulates automated decision-making technology that processes personal data and produces scores, predictions or recommendations used in decisions about a person.
Consequential decisions only
Covered decisions concern access to education, employment, housing, financial or lending services, insurance, health care, and essential government services and benefits.
Developers document, deployers disclose
Developers hand deployers documentation on intended uses, training data categories, known limits and human review. Deployers give consumers clear notice when they interact with the technology.
Human review on request
After an adverse outcome a consumer can ask for their data, correct errors and request meaningful human review, so AI scoring tools need a review path.
What changed from the 2024 law
The 2024 act centered on high-risk AI systems and a duty of reasonable care against algorithmic discrimination, with risk programs and impact assessments. The 2026 law centers on documentation, notices, explanations and consumer rights. Recheck any plan built for the old act.
What we do
- New scope: automated decision technology
- Developer documentation to deployers
- Point-of-interaction consumer notice
- 30-day adverse-outcome explanation
- Three-year record keeping
- Cure period until 2030
Building a review path into AI decisions
Consumers can ask for meaningful human review and reconsideration after an adverse outcome. The software therefore has to show a reviewer the inputs, score and reasons, record the decision and let staff fix wrong data.
What we do
- Reviewer screen with inputs and score
- Data access and correction requests
- Decision log per consumer
- Plain-language outcome notices
- Vendor update tracking
How we approach a project
The attorney general enforces the law under the Colorado Consumer Protection Act. Before January 1, 2030, the office must give a 60-day notice and a chance to cure, where a cure is possible, before bringing an action. Some entities are exempt to the extent they meet other legal obligations, so regulated firms should ask counsel whether one fits.
Hiring screens, tenant scoring, loan pre-qualification and claims triage are the tools most likely to be covered. Our pages on AI for staffing agencies and AI for insurance describe review steps for such uses, AI governance consulting helps set up the records, and the EU AI Act guide covers the European rules. We offer this summary as general information; it is not a substitute for advice from a Colorado lawyer.
How we work
- Read the 2026 law, not 2024’s
- Decisions about people come first
- Keep records from day one
Our Process
-
Find decisions about people
List every tool that scores, ranks or recommends in hiring, lending, housing, insurance, education, health care or benefits.
-
Ask vendors for documentation
Request intended uses, training data categories, known limits and review guidance from each developer, and note how updates reach you.
-
Write the consumer notices
Draft the point-of-interaction notice and the adverse-outcome explanation, and watch for the attorney general’s rules on the latter.
-
Set up review and records
Create a path for data requests, corrections and human reconsideration, and keep compliance records for at least three years.
How Aranv helps with Colorado’s law
Decision tools found and listed
We walk through your hiring, lending, leasing or claims workflow with you and list each place a model scores or ranks a person.
Vendor documentation requested
We help you request the documentation the law expects from each AI vendor and compare it with how staff use the tool.
Review screens in the software
When we build a scoring or triage tool, the human review step, the reasons shown to reviewers and the decision log ship in the first release.
Counsel stays in charge
We prepare the system facts and records; your lawyer decides how the law applies, and we change the design to match.
Ready to act on this guide?
Ask our team in a 30-minute conversation.
Or see how we build it: Explore all services
Colorado AI Act questions
-
Is the Colorado AI Act in effect?
The 2024 act was repealed and reenacted by SB 26-189, signed on May 14, 2026. The bill summary dates developer documentation duties from January 1, 2027. Check the signed act for the start of each obligation rather than planning around a single date.
-
What was Colorado SB 205?
SB 24-205 was the 2024 law on high-risk AI systems and algorithmic discrimination, with duties for developers and deployers. Its start date moved from February 1, 2026 to June 30, 2026, and SB 26-189 replaced it before that date.
-
Does the new law still regulate high-risk AI in Colorado?
It uses different terms. The focus moved from high-risk AI systems to automated decision-making technology used in consequential decisions. The same kinds of tools are in view: systems that help decide who gets a job, loan, home, insurance, health care, schooling or public benefits.
-
Can consumers sue under the Colorado law?
The act creates no new private right of action; the attorney general enforces it. It does address how fault is shared between developers and deployers in discrimination claims brought under existing law.
-
We only buy AI tools. Do we have duties?
Yes. Using covered technology in consequential decisions makes you a deployer, with consumer notices, adverse-outcome explanations, data and review requests, and records to keep. Ask each vendor for the developer documentation the law requires.
Let’s talk about your next step
Contact Aranv to discuss your workflow, current tools, and goals. Meet with our team or send an inquiry.
Book a meeting with our team
Choose an available date and time for a 30-minute conversation about your project.
Tell us about your project
Share a few details so we can discuss a useful next step.
Prefer email? sales@aranv.com