Overview
- SB 26-189, which Governor Jared Polis signed Thursday, repeals Colorado’s yet-to-take-effect 2024 AI law and installs a narrower framework centered on individual automated decisions.
- The new law shifts obligations away from risk programs and impact assessments to explaining and defending each outcome, and it drops prior references to algorithmic discrimination, a duty of care, and formal governance requirements.
- When automated tools help decide jobs, loans, housing, or similar high-impact outcomes, companies must disclose use at the point of interaction and, after a negative decision, give a plain-language explanation within 30 days, share the data used, allow corrections, and offer human review when commercially reasonable.
- Enforcement rests only with the Colorado Attorney General under the state Consumer Protection Act, there is no private right of action, most violations carry a 60‑day cure period, and companies must keep decision records, with developers and deployers sharing duties.
- The statute takes effect January 1, 2027, applies to automated decision-making technology that materially influences consequential decisions, includes many exclusions such as some internal tools and fraud prevention, and will require AG rulemaking plus new disclosure workflows and updated vendor contracts.