Colorado AI Act: From SB 24-205 to the 2027 Automated Decision Law

The Colorado AI Act was the first broad US state law aimed at artificial intelligence used in high-stakes decisions about people. Signed in May 2024 as Senate Bill 24-205, it required companies that build or use AI in hiring, lending, housing, insurance, education and healthcare decisions to guard against algorithmic discrimination, complete impact assessments and tell consumers when AI was involved.

The law never took effect in its original form. Its start date was pushed to 30 June 2026, enforcement was paused after a federal lawsuit in April 2026, and in May 2026 Colorado repealed and reenacted it as SB 26-189, a narrower law on automated decision-making technology that takes effect on 1 January 2027. This guide explains what changed, what the new law requires of developers and deployers, and how product teams should prepare. The summary of SB 26-189 here is based on published legal analysis; check the enacted text and the attorney general's rules before relying on specific details.

What was SB 24-205?

SB 24-205, "Consumer Protections for Artificial Intelligence", was signed on 17 May 2024 and was due to take effect on 1 February 2026. It applied to developers and deployers of "high-risk artificial intelligence systems", meaning systems that make, or are a substantial factor in making, consequential decisions about consumers. Its main obligations were:

• A duty of reasonable care for developers and deployers to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination.
• Developer documentation and disclosures to deployers, and public statements about high-risk systems.
• Risk management policies and annual impact assessments by deployers.
• Notices to consumers when a high-risk system was used in a consequential decision, explanations of adverse decisions, and opportunities to correct data and appeal.
• Disclosure to consumers whenever they interacted with an AI system, even outside consequential decisions.
• Reporting discovered algorithmic discrimination to the attorney general.

Small deployers had some exemptions, and the law included a rebuttable presumption of reasonable care for those following recognised frameworks such as the NIST AI RMF or ISO/IEC 42001.

Delay, litigation and replacement

• August 2025: in an extraordinary session, the legislature passed SB 25B-004, moving the effective date to 30 June 2026 without changing the substance, after failing to agree on amendments.
• April 2026: xAI sued in federal court challenging the law on constitutional grounds, and the US Department of Justice filed a related complaint. On 27 April 2026, a stipulated court order paused the attorney general's enforcement of SB 24-205 pending further proceedings.
• 14 May 2026: the governor signed SB 26-189, which repeals and reenacts the framework as a narrower, notice-based law on automated decision-making technology (ADMT), effective 1 January 2027, with attorney general rulemaking to be completed by then.

Commentators expect SB 26-189 may also be challenged. Companies should track both the rules and any litigation, and plan features so they can be switched on or adjusted once the final requirements are clear, rather than waiting until late 2026 to start engineering work.

Timeline at a glance

Date	Event
17 May 2024	SB 24-205 signed, originally effective 1 February 2026.
August 2025	SB 25B-004 moves the effective date to 30 June 2026.
April 2026	Federal lawsuit and stipulated order pausing enforcement.
14 May 2026	SB 26-189 signed, repealing and reenacting the framework.
By 1 January 2027	Attorney general rulemaking to be completed.
1 January 2027	SB 26-189 takes effect.

The wider US context

There is no federal AI law in the United States. Instead, states have passed narrower laws on specific uses, such as New York City's rules on automated employment decision tools, Illinois rules on AI in hiring, and privacy-law provisions on profiling and automated decisions in California and other states. Colorado's 2024 law was the first attempt at a broad, cross-sector framework, and other states considered similar bills. At the federal level, a December 2025 executive order directed agencies to challenge state AI laws seen as conflicting with a minimally burdensome national approach, which helped prompt the Department of Justice's involvement in the Colorado case. For businesses, the result is a patchwork that may keep changing, so building flexible notice, explanation and review features is more practical than designing for a single law.

Who must comply under SB 26-189?

The new law applies to developers and deployers of ADMT that materially influences "consequential decisions" about Colorado consumers. Reported areas of consequential decisions include:

• Education enrolment or opportunities.
• Employment or employment opportunities.
• Financial or lending services.
• Healthcare services.
• Housing.
• Insurance.

Out-of-state companies are covered if their tools are used for decisions about Colorado consumers. Check the enacted text for definitions and any exemptions, such as for small businesses or specific technologies.

Is it mandatory or voluntary?

Mandatory from 1 January 2027 for covered developers and deployers, unless a court blocks it. The attorney general enforces it as a deceptive trade practice under the Colorado Consumer Protection Act. Neither the original nor the replacement law creates a private right of action.

Developer obligations

According to published analyses, developers of ADMT that materially influences consequential decisions must give deployers technical documentation covering:

• Intended uses and known limitations.
• Categories of training data.
• Instructions for appropriate use and for human review.

Developers must also notify deployers of material updates or modifications. Compared with SB 24-205, the more detailed requirements on evaluation methods, data governance, mitigation and discrimination risk disclosures, and submissions to the attorney general, were removed.

Deployer obligations

• Notice: tell consumers when ADMT is used in a consequential decision about them, at the point of interaction.
• Adverse outcome explanation: within 30 days after an adverse outcome, provide a plain-language description of the ADMT's role in the decision.
• Correction: let consumers correct inaccurate personal data used in the decision.
• Human review: offer an opportunity for human review of adverse decisions, as provided in the law.

The general requirement to disclose any AI interaction, and the affirmative duty to prevent discriminatory outcomes, were removed. Notice duties now focus on ADMT in consequential decisions.

Liability and enforcement

SB 26-189 allocates liability between developers and deployers based on whether the tool was used for its intended purpose and whether the developer provided adequate documentation. Published summaries report that it prohibits joint and several liability and contractual indemnities that shift liability inconsistently with this allocation. Before enforcement, the attorney general must give a 60-day notice and opportunity to cure, a provision that sunsets three years after the effective date. Penalties follow the Colorado Consumer Protection Act.

How SB 26-189 compares with SB 24-205

Topic	SB 24-205 (original)	SB 26-189 (from 1 January 2027)
Core approach	Duty of care against algorithmic discrimination	Notice, explanation and documentation
Scope term	High-risk AI systems	Automated decision-making technology materially influencing consequential decisions
Impact assessments	Required annually for deployers	Removed, per published analyses
General AI interaction disclosure	Required	Removed
Adverse decision explanation	Detailed reasons and data sources	Plain-language description within 30 days
Cure period	Affirmative defence for frameworks	60-day notice and cure, sunsetting after three years

Scoping your tools

Many products include automation without being labelled AI. To decide whether a tool might be in scope, ask practical questions. Does the tool rank, score, filter or recommend people? Is that output used in a decision about access to a job, loan, home, insurance policy, school place or healthcare service? Would the decision likely be different without the tool's output? Are Colorado residents among the people affected? A resume parser that only extracts text may be low concern, while a model that ranks candidates and auto-rejects the bottom half almost certainly matters. Final definitions will come from the enacted text and the attorney general's rules, so keep the inventory and revisit it when rules are published.

Designing useful explanations

The requirement to describe the automated tool's role in plain language after an adverse outcome is easy to meet badly. A useful explanation names the type of tool used, what kinds of information it considered, how its output fed into the decision, whether a person reviewed it, and what the consumer can do next, including correcting data and requesting human review. It should avoid jargon and avoid generic statements that would apply to every applicant. Building explanations from logged decision factors, rather than writing them by hand, keeps them accurate and consistent, and allows the 30-day deadline to be met at scale.

What this means for offshore development teams

Many US HR, lending and insurance products are built or maintained by teams in India and elsewhere. The law applies to the developer and deployer companies, not to individual engineers, but development partners are usually the ones who implement decision logging, model versioning, explanation generation and review queues. Contracts should state who maintains developer documentation, how model changes are tracked and communicated, and how quickly data correction and human review features can be adjusted when the attorney general's rules are finalised.

How to prepare, step by step

1. Inventory automated decision tools used in employment, lending, housing, insurance, education and healthcare decisions.
2. Identify Colorado consumers affected by those decisions.
3. Classify your role for each tool: developer, deployer or both.
4. Developers: prepare documentation on intended uses, limitations, training data categories and human review, and a process for notifying deployers of material changes.
5. Deployers: design point-of-interaction notices, adverse outcome explanations within 30 days, data correction and human review workflows.
6. Review contracts for liability allocation and indemnities consistent with the law.
7. Monitor attorney general rulemaking and litigation through 2026.
8. Keep good practice such as bias testing even though the explicit duty was removed, because federal and state anti-discrimination laws still apply.

Documentation you will need

• Inventory of ADMT and consequential decisions.
• Developer technical documentation and update notices.
• Consumer notice and explanation templates.
• Records of adverse outcome explanations and timing.
• Data correction and human review records.
• Contracts showing liability allocation.
• Testing and monitoring records for accuracy and bias.

Common mistakes

• Assuming the law is gone because SB 24-205 was replaced.
• Ignoring tools that "only score" but materially influence human decisions.
• Explanations that are generic rather than describing the tool's role in the specific decision.
• No human review route for adverse outcomes.
• Vendor contracts with broad indemnities that conflict with the new allocation.
• Dropping bias testing, which still matters under civil rights and lending laws.

Best practices, tools and technologies

• Log each automated decision with inputs, model version and output for explanation and audit.
• Generate explanation text from decision factors, reviewed for clarity.
• Build a human review queue with service levels.
• Version models and track material changes for developer notices.
• Use the NIST AI RMF or ISO/IEC 42001 to structure governance.

We build decision logging, explanation features and human review workflows into HR, lending and insurance platforms through our custom software and recruitment platform work.

How it relates to other laws

Law or framework	Relationship
EU AI Act	Broader risk-based law with high-risk obligations including employment and credit.
NYC Local Law 144	Bias audits and notices for automated employment decision tools in New York City.
CCPA/CPRA	California rules on automated decision-making technology under the privacy law.
US state privacy laws	Opt-outs of profiling in decisions with legal or similarly significant effects.
NIST AI RMF	Voluntary risk management framework widely used to show reasonable care.

Real-world example

A US HR tech company, with engineering in India, sells a candidate screening tool used by Colorado employers. As a developer, it prepares documentation on intended use, limits, training data categories and how recruiters should review rankings, and sends notices when it retrains models. Its Colorado customers, as deployers, show candidates a notice that automated screening is used, send a plain-language explanation within 30 days when a candidate is rejected, and offer a form to correct data and request human review. The company's contracts are updated to align liability with the law.

Next steps

1. Inventory automated decision tools and Colorado exposure.
2. Prepare developer documentation or deployer notices.
3. Build explanation, correction and human review workflows.
4. Update contracts.
5. Track rulemaking and litigation before 1 January 2027.

Frequently asked questions

Is the Colorado AI Act in effect?

SB 24-205 never took effect as enacted. Its replacement, SB 26-189, takes effect on 1 January 2027.

What did SB 26-189 change?

It replaced the duty to prevent algorithmic discrimination and impact assessments with a narrower notice, explanation and documentation regime for automated decision-making technology.

What is a consequential decision?

A decision with significant effects in areas such as education, employment, lending, healthcare, housing or insurance.

Who enforces the law?

The Colorado Attorney General, under the Colorado Consumer Protection Act. There is no private right of action, so consumers cannot sue directly under this law.

Is there a cure period?

Yes, a 60-day notice and cure period before enforcement, which sunsets three years after the effective date.

Does the law apply to companies outside Colorado?

Yes, if their tools are used in consequential decisions about Colorado consumers.

Do I still need impact assessments?

Published analyses indicate SB 26-189 removed them, but check the enacted text and rules.

What must deployers tell consumers after an adverse decision?

A plain-language description of the automated tool's role, within 30 days, with routes for correction and human review.

Why was enforcement paused in 2026?

A federal lawsuit by xAI, joined by the Department of Justice, led to a stipulated order pausing enforcement of SB 24-205.

Should we still test for bias?

Yes. Federal and state anti-discrimination laws still apply to automated decisions.

What must developers give deployers?

Technical documentation on intended uses, limitations, training data categories and instructions for appropriate use and human review, plus notice of material updates.

Can contracts shift all liability to the developer or deployer?

Published analyses report that SB 26-189 prohibits joint and several liability and indemnities that conflict with its allocation of responsibility between developers and deployers.