Privacy & Cybersecurity Law Blog

On May 14, 2026, Colorado Governor Polis signed SB 189 (the “Act”), which revises Colorado’s original artificial intelligence (“AI”) law and delays the effective date from June 30, 2026, to January 1, 2027, while significantly scaling back its original requirements.

Enacted in 2024, the Colorado AI Act established a risk-based framework governing the use of AI in consequential decisions affecting areas such as employment, housing, health care and education. 

The Act moves away from the Colorado AI Act’s original risk-based framework, eliminating the duty of care aimed at preventing algorithmic discrimination, deployer obligations to maintain risk management programs and conduct impact assessments, and certain reporting obligations to the Colorado Attorney General. 

The Act adopts a narrower approach, focused on disclosures and transparency around certain automated decision-making technologies (“ADMT”). As revised, the law requires developers to provide deployers with specified information about the ADMT that the developers provide, including intended uses, potentially harmful uses, categories of training data and deployer oversight instructions. The Act also preserves certain individual rights in limited circumstances, including rights to access and correct data and to obtain meaningful human review of adverse automated decisions.