Professional Services
The Colorado AI Act and Your Law or Accounting Firm: What You Actually Have to Do
Your liability carrier just added an AI question to the renewal form, an associate is already drafting with it, and the Colorado AI law your 2024 memo was built on no longer exists. Here is the shorter list that survived.
What you'll walk away with
- The 2024 act your compliance memo cites, SB 24-205, was repealed. SB 26-189 replaced it on May 14, 2026 and takes effect January 1, 2027.
- The heavy lifts are gone: no risk-management program, no impact assessments, no standalone duty to prevent algorithmic discrimination.
- Three duties stand: tell people when they interact with AI, disclose AI's role in an adverse decision within 30 days, offer data correction and human review.
- All three turn on one question most firms cannot answer yet: where does AI actually speak or decide inside your practice?
The compliance memo your firm circulated after Colorado passed its AI Act in 2024 is now a historical document. SB 24-205, the law that had managing partners budgeting for risk-management programs and impact assessments, was repealed before those duties ever bit. Its replacement, SB 26-189, was signed on May 14, 2026 and takes effect January 1, 2027. It is a different law, and a much shorter one.
That is good news and a trap at the same time. Good news because the heaviest paperwork is gone. A trap because the duties that survived live inside your systems, not inside a binder, and most firms cannot currently answer the one question those duties turn on: where, exactly, does AI talk to clients or touch decisions in your practice? If your world is listings and closings rather than billable hours, we wrote a separate walkthrough of what the same law asks of real estate brokers. This piece is for the people holding privileged files and client financials.
One thing before the list: this article is general information from an operator, not legal advice. Anything you act on, confirm with your own counsel first.
01
The law you planned for was repealed. Read the replacement instead.
SB 24-205 passed in 2024 and set off a wave of planning across Colorado firms: stand up a risk-management program, run impact assessments, document how you prevent algorithmic discrimination. None of that survived the swap. SB 26-189 repealed the 2024 act and replaced it with a narrower law built around one idea: when automated systems interact with people or take part in decisions about them, people get told, and they get recourse. The three obligations that drove most of the 2024 budgeting are simply gone.
Side by side
What the replacement dropped, and what stands
| Requirement | SB 24-205 (2024, repealed) | SB 26-189 (from Jan 1, 2027) |
|---|---|---|
| Risk-management program | Required | Dropped |
| Impact assessments | Required | Dropped |
| Duty to prevent algorithmic discrimination | Required | Dropped |
| Tell people when they interact with AI | · | Stands |
| Disclose AI's role in an adverse decision, within 30 days | · | Stands |
| Offer data correction and human review | · | Stands |
Pull the 2024 memo out of circulation this week and replace it with a one-page summary of the three surviving duties. Half the compliance risk in a firm is a partner confidently following a repealed statute.
02
If a client is talking to a machine, they get told.
The first surviving duty is the simplest: tell people when they are interacting with AI. For a firm, that is not hypothetical. The intake chat on your website, the after-hours phone answering, the portal assistant fielding billing questions, each is a place where a client may reasonably believe a human is on the other end. And in a practice built on privilege and trust, the label matters beyond the statute. A client who discovers later that the helpful voice was software feels misled, and that feeling costs more than any filing deadline.
Before you start
Where clients meet AI without knowing it
- The intake chat on your website answering "can you take my case" at 9 pm
- AI phone answering or the after-hours receptionist line
- A client portal assistant fielding billing and status questions
- Automated follow-ups and reminders that go out under the firm's name
Walk your own intake path this week as if you were a new client. Every surface where software speaks, add one plain line telling people it is AI and how to reach a human. Done before Friday.
You cannot disclose what you cannot find. Most firms are not hiding AI from clients. They have lost track of where it is.
03
Adverse decision with AI in the loop? The clock gives you 30 days.
The second duty has a deadline attached: when AI is involved in an adverse decision about someone, that person hears about the AI's involvement within 30 days. Think about where automated screening already lives around your practice. Intake scoring that declines a matter. Software that flags a client for stricter payment terms. A hiring platform that filters candidates before a human reads a resume. The duty itself is short. The hard part is operational: thirty days is a small window when nobody can reconstruct which system touched the decision or what it contributed.
The shape of the change
Meeting a 30-day disclosure window without the scramble
Before
After
Make the log the default: any app that screens, scores, or declines writes its decisions to one place your office manager can search. The 30-day notice becomes a lookup, not an archaeology dig.
04
Correction and human review: name the human.
The third surviving duty is recourse. People get the ability to correct the data an automated decision relied on, and to ask a human to review the outcome. Most partners read that and nod, then cannot answer the follow-up: who, specifically, receives that request, and through what channel? Recourse that routes to a shared inbox nobody owns is recourse on paper only. This is the cheapest duty of the three to handle well, because it needs a name and a route more than it needs technology.
Pick the owner now, one partner or the practice manager, and put the request path in your engagement letter next to your AI disclosures. One owner, one inbox, one response habit.
05
The real exposure is not the statute. It is the missing inventory.
Every duty above turns on the same question: where does AI actually operate in your practice? Most firms cannot answer it, and not because anyone is careless. The AI arrived scattered. A feature inside the practice management app here, a pile of AI tools an associate signed up for there, a phone answering trial someone forgot to cancel. Disclosure obligations assume you know where the machines are. Sprawl guarantees you do not.
That is the case for running your apps and AI as one system instead, the argument we make at length in why operators keep buying AI that never sticks. One system means one known list of every place AI speaks to a client or touches a decision, which is the entire backbone of this law. It is the same discipline behind how Denver law firms are actually using AI, and it turns compliance from a threat into an afternoon of work.
Block one afternoon this week: list every app in the practice with an AI feature, mark the ones that talk to clients or touch decisions. That list is the backbone of your entire compliance story.
The replacement act is shorter than the law it repealed, and the deadline is real: January 1, 2027. But notice what kind of work survived. Not binders, not assessments. Disclosure, a deadline, and recourse, all of which are light work for a firm that knows where its AI lives and grinding work for a firm that does not. Get the inventory done, label the surfaces, log the decisions, name the human. Then confirm the details with counsel and get back to the billable day.
Questions we get
Is the original Colorado AI Act still in effect?
Does my firm still need an AI risk-management program or impact assessments?
What does the Colorado AI Act require a law or accounting firm to actually do?
Does the law treat law firms differently from other industries?
Let's Build Your AiOS.
Book a call and you get a plan for one system that knows every place AI speaks or decides in your practice, not a pitch for one more app. jfly.ai
Book a callBlueprint → Build → Partner · Denver + remote