Colorado's landmark artificial intelligence law, the most comprehensive in the country, has been replaced before it ever took effect.
After years of concern over the implications of Colorado's Concerning Consumer Protections in Interactions with AI Systems law, which was set to take effect on June 30, Gov. Jared Polis recently signed into law S.B. 26-189, a bill that repealed the Colorado AI law and replaced its broad "high-risk artificial intelligence system" framework with a narrower regime focused on automated decision-making technology, or ADMT, used in consequential decisions.
S.B. 26-189 will apply to job applicants and employees who are residents of Colorado, in addition to "any individual whose access to, eligibility for, or opportunity in Colorado is evaluated in a consequential decision by a person doing business in Colorado."
The Colorado AI law has been a source of concern for employers since it was enacted in 2024. Had the law gone into effect without changes, it would have imposed a host of onerous requirements on employers, including implementation of risk management programs, impact assessments, annual reviews and disclosures regarding algorithmic discrimination.
S.B. 26-189 will eliminate many of these requirements and impose a far narrower framework focused on transparency, notice, disclosure, recordkeeping, and human review and reconsideration.
Employers that were preparing for the original law's June 30, 2026, effective date should now shift their compliance planning toward S.B. 26-189's obligations, which will become effective Jan. 1, 2027.
While the new law is significantly narrower, it does impose some requirements on employers regarding the use of AI tools. The new law will regulate the use of automated tools in employment decisions, and employers that use such tools in decisions related to hiring, promotion, compensation or performance management should begin identifying which tools may be covered and what notices, records and review processes may be required.
The Original Law and Recent Challenges
The Colorado AI law would have imposed several requirements, including implementation of risk management programs, impact assessments, annual reviews and disclosures regarding algorithmic discrimination. Although it was supposed to go into effect on Feb. 1, its effective date was postponed to June 30.
For employers, the Colorado AI law raised serious compliance concerns, because AI tools used in hiring, promotion, compensation, performance management and other employment decisions triggered its compliance obligations.
The original law's breadth was its defining feature and the source of much of the concern. It did not merely require employers to tell applicants or employees when automated systems were involved in decision-making.
Instead, it contemplated a broader governance framework around covered AI systems, including formalized risk management policies and impact assessment obligations. As such, the original law presented the possibility of a significant compliance undertaking on an aggressive timeline.
The Colorado AI law had already faced significant challenges prior to the recent legislative action. On April 9, xAI filed suit in the U.S. District Court for the District of Colorado challenging the Colorado AI law on constitutional grounds. In X.AI LLC v. Weiser, xAI argued that designing and training AI models is expressive activity protected under the First Amendment.
The U.S. Department of Justice moved to intervene on April 24 to join xAI's effort to invalidate the law, raising other constitutional challenges. One primary argument was that the Colorado law violates the equal protection clause of the 14th Amendment by requiring AI companies to prevent unintentional disparate impact.
Also on April 24, the Colorado attorney general joined with the plaintiffs and filed a joint motion stipulating to a temporary stay of the law's enforcement. The motion noted that because of efforts to amend the Colorado AI law, the attorney general did not intend to promulgate rules implementing the Colorado AI law until the legislative session and rulemaking processes concluded.
On April 27, the court issued an order prohibiting enforcement of the law until 14 days after the court rules on xAI's forthcoming request for a preliminary injunction, which the court said will be filed within 28 days after adoption of the Colorado AI law or any legislation replacing or amending it.
The New Law
On May 1, Colorado lawmakers introduced S.B. 26-189, which moved remarkably quickly through the Colorado Legislature, passing the Senate on May 7 and the House on May 9. Polis signed the measure into law on May 14.
S.B. 26-189 repeals the Colorado AI law and replaces its so-called high-risk AI system structure with rules for ADMT. The bill defines ADMT as technology that "processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision" about an individual.
However, not every automated tool will be covered. The bill excludes, among other things, calculators, databases, firewalls, spell-checking, and certain spreadsheets and tools that are used "solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing."
The bill's requirements will apply where ADMT is used to "materially influence a consequential decision," including decisions relating to an individual's access to, eligibility for, selection for, or compensation related to employment.
The bill defines "materially influence" to mean the ADMT output is a "non-de minimis factor" in the decision and affects the outcome, including by "constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering" how the decision is made.
S.B. 26-189 provides that, beginning Jan. 1, 2027, employers using covered ADMT to materially influence consequential employment decisions will have notice, disclosure, recordkeeping and review obligations.
Deployers will need to retain records for at least three years after an employment-related decision, provide "clear and conspicuous notice" that they have used or will use covered ADMT in a consequential decision affecting the individual, and, within 30 days following an adverse decision, provide "a plain language description of the consequential decision and the role the covered ADMT played."
Individuals will also have the right to request correction of "factually incorrect or materially inaccurate personal data," and seek "meaningful human review and reconsideration" to the extent commercially reasonable.
Notably, S.B. 26-189 does not provide for a private right of action. Instead, it provides for the Colorado attorney general to enforce the law through the Colorado Consumer Protection Act.
Before commencing any enforcement action, the Colorado attorney general must provide the employer a notice of violation and a 60-day period to cure. However, the notice and cure period are not required if the Colorado attorney general can demonstrate that the employer knowingly or repeatedly violated the law.
Practical Tips for Employers
For employers, S.B. 26-189 is a welcome reprieve from the burdens that the original Colorado AI law would have imposed.
The original law would have required a much broader AI governance structure, including risk management programs, impact assessments, annual reviews and disclosures regarding algorithmic discrimination. S.B. 26-189 removes most of these onerous requirements and replaces them with a more limited set of obligations that are directly tied to how automated tools are actually used in employment decisions.
While S.B. 26-189 applies only to Colorado resident applicants and employees, and individuals who are evaluated in a consequential decision by a person doing business in Colorado, employers will want to consider whether it is more feasible to limit application or to apply the requirements of the law, or some of them, across the U.S.
In order to ensure compliance with the new framework set forth in S.B. 26-189, employers will need to have a concrete grasp of which AI tools they use, what data they use AI to process, what outputs AI is generating, how AI outputs are used by human decision-makers and whether AI outputs materially influence employment decisions.
Distinguishing between AI tools that merely assist with administrative tasks and AI agents that actually materially influence consequential employment decisions will likely become one of the most important compliance questions under the new law. Employers should expect that the analysis will be fact-specific and that an AI tool's label will matter less than how it is actually used.
Employers should begin by identifying automated tools that relate to hiring, promotion, compensation, performance management, workforce planning or other employment decisions, focusing not on whether a product is marketed as AI, but instead on what the tools actually do. To determine how these tools function in practice, employers should speak with the employees who are using them.
Employers should also prepare for the parts of the law that will be visible to applicants and employees, including notice, adverse decision explanations, correction requests and meaningful human review.
Conclusion
S.B. 26-189 represents a significant shift away from the intense regulatory framework that the original Colorado AI law would have imposed on employers. The new law focuses more on transparency and accountability, eliminating many of the most burdensome requirements that had raised concerns about the original law. Even so, S.B. 26-189 imposes a host of requirements on employers.
As the Jan. 1 effective date approaches, employers should prepare by understanding how they are using automated tools and whether those uses fall within the scope of the new law. Employers that proactively assess their AI-related employment practices will be best positioned to navigate Colorado's evolving regulatory landscape.
The opinions expressed are those of the author(s) and do not necessarily reflect the views of their employer, its clients, or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.
Reproduced with permission. Originally published June 9, 2026, "What Colorado AI Law's Major Rewrite Means For Employers," Law360.
