Colorado rewrites its AI anti-discrimination law before it ever took effect, shifting compliance from systems to individual decisions
Colorado Governor Jared Polis signed SB 26-189 on May 14, 2026, repealing and replacing the state's 2024 AI Act. The new law abandons the original's system-level compliance architecture — advance bias audits, risk management programs, and ongoing monitoring — in favor of decision-level accountability: plain-language disclosure after adverse AI-assisted decisions, a right to challenge and correct the underlying data, and a right to human review where commercially reasonable.
- Issuing body
- Colorado General Assembly; Governor Jared Polis
- Jurisdiction
- Colorado, United States
- Who is bound
- Businesses and employers in Colorado that use automated decision-making technology to make consequential decisions affecting individuals in employment, housing, credit, insurance, healthcare, or education
- Decided
- Effective
- TBD
What's now different
The 2024 Colorado AI Act — the first US state law to impose comprehensive anti-discrimination obligations on AI systems — never took effect; it was extended twice and was approaching a June 30, 2026 deadline when SB 26-189 replaced it. The prior law required companies to conduct impact assessments before deploying covered AI systems, maintain formal risk management programs, and test and monitor systems on an ongoing basis. The new law drops all of those front-loaded infrastructure requirements. What remains: within 30 days of any adverse consequential decision made with AI assistance, the affected individual must receive a plain-language description of the decision and the role the automated tool played. They can then request access to the underlying data, correct inaccuracies, and seek human review or reconsideration — with that last right qualified to "the extent commercially reasonable." A 60-day cure period follows any attorney general notice of violation.
For AI developers, the practical change is to their customer obligations: they must now provide deployers with enough information about their systems to enable per-decision disclosure and explainability — but they are no longer required to produce the broader pre-deployment documentation and validation architecture the 2024 act demanded. For deployers, the compliance posture flips: instead of proving systems are fair before use, they must be able to justify individual outcomes after the fact. The law was the product of a Polis-convened task force of tech companies, business groups, and labor and progressive organizations — a consensus its own participants described as "a bill nobody's happy with, but everyone can live with." The exact effective date of SB 26-189 has not been confirmed from the primary text of the statute; the prior act's last extended deadline was June 30, 2026, and the new law was timed to replace it before that date.