Colorado & AI Law
Colorado's New AI Law: What You Have to Do by January
Colorado replaced its AI law. The new one starts January 1, 2027, and it asks three things of you. Most of what you will find online still describes the old one, which got thrown out before any of it took effect.
The whole thing in fifteen seconds
- Colorado's 2024 AI law was repealed before a single rule took effect. The paperwork you were told to prepare is off your plate.
- The replacement is SB 26-189. It starts January 1, 2027.
- Three rules: say when it's AI, tell people inside 30 days when AI helped turn them down, let them fix bad data and get a human second look.
- All three assume you know where AI already talks to your customers. Building that list is the actual work.
01
What happened
Colorado passed SB 24-205 in 2024, called it the Colorado AI Act, and for a year and a half it was the most discussed state AI law in the country. Firms staffed for it. Consultancies sold readiness assessments against it.
Then the legislature repealed it before a single rule took effect.
The replacement is SB 26-189. Governor Polis signed it on May 14, 2026.
Then vs now
Two laws, one of which never happened
Repealed
SB 24-205
Deadline June 30, 2026
Written risk program
An assessment per AI system
Extra anti-discrimination rule
In force January 1
SB 26-189
Signed May 14, 2026
Say when it's AI
30-day notice on bad news
Correction plus human review
02
What came off your plate
Three of the heaviest pieces did not survive. A formal written risk program. A separate assessment for every AI system you use, kept current. And a new rule, stacked on top of the ones that already exist, saying AI cannot be used to discriminate.
All three are gone. If you were bracing for a year of documentation, that was most of the documentation.
Be careful with the third one. It does not mean you can now discriminate. Every law already covering hiring, housing, lending, and serving customers is untouched. What went away was one AI-specific layer sitting on top of them. Where you stood last year is where you stand today.
03
The three things it asks for
That is the whole list. You can carry it in your head.
One
Say when it's AI. If a reasonable person might think there is a human on the other end, tell them otherwise.
Two
Thirty days. When AI plays a part in a decision that goes against somebody, denied, declined, screened out, not selected, they get told inside 30 days. Writing that notice takes four sentences. Knowing the software was scoring in the first place is what takes a month.
Three
Fix it, then a human looks. Two separate things in one sentence. They can correct wrong information about themselves, and they can get an actual person to review the outcome.
All three rules assume you already know where AI is speaking inside your business. Almost nobody does.
The part that takes five months, not five minutes
04
Why what you'll read online is wrong
Search "Colorado AI Act compliance" today and you get a wall of confident, well-formatted results. Law firm alerts. Consultancy explainers with nice charts. Vendor posts offering to get you ready. A large share of them describe the 2024 law.
Ask a chatbot instead and it gets worse. Those models learned this topic from the same stale pile, so the dead law comes back in clean paragraphs with no hedging anywhere in sight. The first real test of Colorado's new AI law is whether you can tell when an AI is confidently wrong about it.
Fifteen-second check
Is the page you're reading out of date?
| If the page says… | Verdict |
|---|---|
| Impact assessments | out of date |
| Risk-management program | out of date |
| June 30, 2026 deadline | out of date |
| Never names SB 26-189 | out of date |
| SB 26-189 and January 1, 2027 | current |
Check the date stamp before you read the body. Somebody who does thirty honest minutes of homework on a Sunday night can come away with a very clear, very wrong picture, and then spend real money building toward it.
05
Where AI is already talking to your customers
Nobody sat down and bought "an AI system." They bought a phone answering service, a scheduling tool, a chat widget, an applicant tracker, a CRM with a follow-up sequence. Each of those vendors shipped an update with a model behind it and mentioned it in a release note nobody read.
Walk the building
Six places it usually turns up
- The website chat box that greets people at eleven at night.
- The phone system that answers after the front desk goes home.
- The portal assistant that tells a client where their file stands.
- Follow-up emails going out under your name and your signature.
- The screening tool that scores an applicant before anybody human reads the application.
- The scheduling bot nobody remembers buying.
Picture a managing partner clicking the chat bubble on her own homepage, just to see what it does, and watching it collect a prospective client's name, their situation, and their cell number without once saying it is software. That is rule one, in plain view, probably for the last two years.
The screening tools worry me more than the chat widgets do. A chat box is embarrassing when you find it. A hiring platform that filters applicants before a human reads anything is turning people down all day, quietly, at volume, and rules two and three both land on it.
06
What I'd do between now and January
Four moves. None need a consultant, and the first one is most of the value.
Inventory
One page, not a project. List every place a customer, client, applicant, tenant, or patient touches your systems. Then go vendor by vendor with two blunt questions: does this use AI, and does it make or influence any decision about a person? Ask in writing. Vendors answer differently in writing, and the written answer is the one their legal team already saw.
Sort
Two columns. Things that talk to people need a disclosure. Things that decide about people need a disclosure, a 30-day clock, a correction path, and a named reviewer. Plenty of software lands in both. Start with the overlap.
Write it once
A line in the chat window, a line in the phone greeting, a line in the portal. Plain sentences beat legal paragraphs here.
Name the human
Not a department, a person. Somebody owns telling people when they have been turned down, and somebody owns the second look. If that is you, write your own name down. An unowned process is a process that does not happen, and January arrives whether or not anybody has been assigned.
That is the work. Colorado asked for less this time, and asked for it more plainly. The catch is that the one thing it does ask for is the thing almost nobody has lying around: an honest map of where your software talks to people and where it decides things about them. Build the map first. Everything after that is short, cheap, and mostly copywriting.
Then take the map to your attorney, because I am still not one.
Questions we get
Is the Colorado AI Act still in effect?
What does Colorado's new AI law actually require?
Do I still need an AI impact assessment in Colorado?
Does the repeal mean AI discrimination is legal now?
What counts as AI inside a small business?
Let's Build Your AiOS.
Book a call and you get the map: where AI already speaks and decides inside your business, built from the apps you already pay for.
Book a callBlueprint → Build → Partner · Denver + remote