Colorado’s AI Act Just Got a Reset: What SB 26-189 Means for Your Compliance Program Before 2027

Colorado repealed its original 2024 AI Act (SB 24-205) and replaced it in May 2026 with SB 26-189, the Colorado Automated Decision-Making Technology (ADMT) Act. The new law drops the impact-assessment and risk-management-program mandates but adds developer documentation duties, deployer notice requirements, and consumer review rights, effective January 1, 2027 — while Colorado’s separate insurance AI law, SB21-169, has been in force since 2023 and is unaffected by any of this.

If your team quietly moved “Colorado AI Act” to the bottom of the compliance backlog after two years of delayed effective dates, that instinct is understandable but costly. The law didn’t disappear. It was rewritten under a new name, with a real deadline four months out from today, and a narrower-but-still-binding set of obligations that most governance inventories haven’t been updated to reflect. Meanwhile, a second, unrelated Colorado AI law that never got delayed — SB21-169, covering insurers — has been quietly expanding its own scope all year. Conflating the two, or assuming both are “on hold,” is the exact kind of gap an AI Act audit or a plaintiff’s attorney would be delighted to find.

A quick timeline: how we got from SB 24-205 to SB 26-189

Colorado’s original AI Act, Senate Bill 24-205, was signed in 2024 as the first comprehensive US state law regulating “high-risk” AI systems, built loosely around EU AI Act-style risk tiers. Lawmakers pushed its effective date back more than once, most recently to June 30, 2026, amid pressure from industry groups and warnings that Colorado risked being out of step with other states. In April 2026, the Colorado Attorney General’s office signaled it would delay enforcement further while the legislature worked on a rewrite.

That rewrite arrived on May 14, 2026, when the governor signed SB 26-189. It repeals SB 24-205 in its entirety and reenacts a new, narrower framework — the Colorado Automated Decision-Making Technology Act — with an operative date of January 1, 2027. In effect, Colorado didn’t cancel its AI law; it replaced it with a leaner version and reset the clock.

What SB 26-189 actually requires

Who’s covered: developer vs. deployer

The ADMT Act keeps the developer/deployer structure familiar from other US state AI laws:

• A developer is an organization doing business in Colorado that develops, offers, sells, leases, licenses, or otherwise makes available a covered ADMT system — or substantially modifies one.
• A deployer is an organization doing business in Colorado that uses a covered ADMT system to make a “consequential decision” about a consumer.

A “consequential decision” is defined around consumer access, eligibility, selection, cost, or material terms in education, employment, housing, lending/finance, insurance, healthcare, or government services — or decisions involving differentiated pricing likely to materially limit or deny an opportunity.

At the time of writing, available legal summaries of SB 26-189 do not describe a small-business or employee-count exemption comparable to the one in the original 2024 law. Treat that as unconfirmed rather than settled: verify the current statutory text (or consult counsel) before scoping which of your business units are in or out.

What the new law removed

Compared with the 2024 original, SB 26-189 eliminates three of the heaviest compliance lifts:

• The mandatory AI risk-management program.
• Formal impact assessments before deploying a high-risk system.
• The standalone statutory duty to use “reasonable care” to prevent algorithmic discrimination.

What the new law adds instead

In place of those program-level mandates, SB 26-189 imposes more operational, document-driven obligations:

• Developers must give deployers technical documentation covering the ADMT’s intended uses, known limitations, categories of training data, and reasonably foreseeable risks — and must notify deployers of material updates.
• Deployers must give consumers clear, conspicuous notice before using ADMT to make a consequential decision about them, and — within 30 days of an adverse decision — a plain-language explanation of the decision and the ADMT’s role in it. Deployers must also retain compliance records for three years.
• Consumers gain the right to access relevant data, correct factual errors, and request meaningful human review of an adverse ADMT-driven decision.

Enforcement runs through the Colorado Attorney General as a deceptive trade practice under the state’s Consumer Protection Act, with a 60-day cure notice available through 2030 — a grace window, not an exemption.

SB 24-205 vs. SB 26-189 (ADMT Act): what changed

Where SB21-169 fits and why it’s not the same law

It’s easy to see “Colorado” and “AI” in the same headline and assume it’s all one law. It isn’t. SB21-169, Colorado’s Protecting Consumers from Unfair Discrimination in Insurance Practices Act, is a separate, older, and already-enforced statute that applies specifically to insurers using external consumer data, algorithms, or predictive models in underwriting, pricing, or claims. It requires insurers to test those systems for unfair discrimination based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression, and to correct any harm found.

Implementing rules under Amended Regulation 10-1-1 have been rolling out by line of business: life insurance underwriting first (2023), with private passenger auto insurance underwriting and health insurance brought in as of October 15, 2025. None of this was affected by the SB 24-205 repeal or the SB 26-189 rewrite — SB21-169 obligations for insurers licensed in Colorado are live today, independent of the broader ADMT Act’s January 2027 date.

For a governance team, the practical implication is that Colorado now runs two parallel AI compliance tracks: an insurance-specific, already-active one (SB21-169), and a horizontal, document-and-notice one that starts January 1, 2027 (SB 26-189/ADMT Act). An inventory that tracks only one of them is incomplete. See Fruggr’s Colorado SB21-169 compliance guide for insurers for the insurance-specific detail.

What to do before January 1, 2027

Three moves are worth starting now rather than in Q4:

1. Re-scope your AI inventory. If your Shadow AI or AI-system register still lists “Colorado AI Act — delayed” as a single line item, split it: confirm which of your systems could make a “consequential decision” under the ADMT Act’s definition, and separately confirm whether any business unit (insurance especially) is already inside SB21-169’s scope.
2. Get developer documentation flowing now. If you deploy third-party ADMT systems, the documentation deployers will need from vendors under SB 26-189 — intended use, known limitations, training data categories — is exactly the kind of artifact that takes longer to collect than expected. Start requesting it before the deadline, not after.
3. Build the 30-day adverse-decision workflow. The requirement to explain an adverse ADMT-driven decision to a consumer within 30 days is an operational process, not a policy document. It needs an owner, a template, and a way to trace which system made which decision — which is the same audit trail EU AI Act Annex III logging and NIST AI RMF documentation already push organizations toward.

Fruggr already helps enterprises like BPCE, EDF, and Vinci govern AI systems across overlapping regulatory frameworks — from the EU AI Act to sector- and state-specific US rules like Colorado’s.

Next step: Run your AI system inventory against both Colorado tracks — SB21-169 (if you’re an insurer) and the SB 26-189 ADMT Act (if you deploy or develop systems making consequential decisions about consumers) before Q4 2026. Request a Fruggr demo to see how an AI governance registry maps your systems to every active framework, including Colorado’s, in one place.