Colorado AI Law Compliance
Colorado's AI law changed substantially in 2026. The original Colorado AI Act (SB 24-205) never took effect — it was replaced before its delayed effective date arrived. The current law is SB 26-189, effective January 1, 2027, and its enforcement is contingent on the Attorney General completing rulemaking. This page reflects that current status; treat anything you've read elsewhere about “SB 24-205 requirements” as historical.
Current status
SB 24-205 — superseded, never enforced
Originally effective February 1, 2026, then postponed to June 30, 2026 by SB 25B-004. Before that date arrived, a federal magistrate judge stayed enforcement (April 27, 2026) amid a constitutional challenge, and the Colorado legislature replaced the law entirely.
SB 26-189 — the current law
Signed by Governor Polis on May 14, 2026. Takes effect January 1, 2027, and enforcement is contingent on the Attorney General completing rulemaking — the effective date is real, but the enforceable date depends on rulemaking finishing on schedule.
What SB 26-189 requires
SB 26-189 reframes the law around automated decision-making technology (ADMT) — a narrower and differently-scoped concept than SB 24-205's “high-risk AI system.” Confirmed deployer obligations:
- Pre-use notice — tell consumers before ADMT is used in a consequential decision about them
- Post-adverse-outcome notice — within 30 days, if the ADMT materially influenced an adverse decision
- Meaningful human review — a path to one, where commercially reasonable
“Consequential decision” domains carry over substantially from the prior law — education, employment, housing, financial/lending services, insurance, health care, and essential government services/public benefits. Enforcement authority rests solely with the Attorney General; specific penalty amounts have not been confirmed in public reporting as of this writing.
Zabta's Colorado jurisdiction pack
# In the dashboard: Go to Jurisdictions → Activate "Colorado" pack
# Or via API:
import requests
requests.post(
"https://api.zabta.ai/api/v1/jurisdiction-packs/colorado/activate",
headers={"Authorization": "Bearer <your_token>"}
)Once activated, Colorado policies evaluate in addition to universal policies. If you also operate in the EU, both jurisdiction packs run simultaneously — the policy engine enforces the stricter standard.
Related