Docs

Appearance

Colorado SB 26-189 ​

Colorado SB 26-189 illustration

Colorado Senate Bill 26-189 (SB 26-189) is a Colorado act on automated decision-making technology (ADMT) that is used to materially influence consequential decisions. The Governor signed SB 26-189 on May 14, 2026. In Section 1, SB 26-189 repeals and reenacts part 17 of article 1 of title 6 of the Colorado Revised Statutes "with amendments" (§§ 6-1-1701 to 6-1-1709). SB 26-189 replaces SB 24-205, which added part 17 in 2024.

SB 26-189 takes effect on January 1, 2027 and applies to consequential decisions made on or after that date. Some provisions took effect upon passage (see When SB 26-189 applies). SB 26-189 gives duties to developers and deployers of a covered ADMT, and rights to consumers (see Sections of SB 26-189).

Modulos has two Frameworks for SB 26-189: MFF-28 for the AI System of one covered ADMT, and OFF-28 for the Organization. For the Requirements and the steps that Modulos recommends, see Operationalizing Colorado SB 26-189 in Modulos.

Information about the Colorado AI Act

Information from before May 14, 2026 that uses the names Colorado AI Act or CAIA is about SB 24-205, not SB 26-189. The SB 24-205 duties, for example an "impact assessment", are not duties of part 17 as SB 26-189 reenacts it (see Duties that part 17 does not give).

Primary sources

Key facts
Legislator
Colorado General Assembly
Instrument
SB 26-189: part 17 of article 1 of title 6, C.R.S. (§§ 6-1-1701 to 6-1-1709), with § 6-1-105(1)(uuuu) and § 10-3-1104.9(3)(e)
Signed
May 14, 2026
Takes effect
January 1, 2027 (the provisions in Section 5(2) upon passage)
Applies to
Consequential decisions made on or after January 1, 2027
Enforced by
Colorado Attorney General, through the Colorado Consumer Protection Act
Covers
Developers and deployers of a covered ADMT, each a person doing business in Colorado
Modulos Frameworks
MFF-28 (AI System) and OFF-28 (Organization)

SB 26-189 and the other Colorado acts ​

Four Colorado acts from 2024 to 2026 changed part 17 of article 1 of title 6, C.R.S. Modulos has two Frameworks for SB 26-189: MFF-28 and OFF-28.

ActDateChange that the act madeAs of October 2026
SB 24-205, "Concerning consumer protections in interactions with artificial intelligence systems"Enacted on May 17, 2024Added part 17 (§§ 6-1-1701 to 6-1-1707). It gave duties to developers and deployers of "high-risk artificial intelligence systems", for example a duty of "reasonable care", a "risk management policy and program", and an "impact assessment". The signed SB 24-205 act applied its duties "on and after February 1, 2026".SB 26-189 repeals and reenacts part 17. This change takes effect on January 1, 2027, but the Section 5(2) provisions took effect upon passage (see When SB 26-189 applies).
SB 25B-004, "Concerning measures effective no later than June 30, 2026, to increase transparency for algorithmic systems"Approved on August 28, 2025Its Sections 1 to 3 changed the date from which the SB 24-205 duties apply, from February 1, 2026 to June 30, 2026.SB 26-189 changes part 17 from January 1, 2027. Some provisions of SB 26-189 took effect upon passage (Section 5(2)).
SB 26-189, "Concerning the use of automated decision-making technology in consequential decisions, and, in connection therewith, making an appropriation"Signed on May 14, 2026Repeals and reenacts part 17 (§§ 6-1-1701 to 6-1-1709). Adds § 6-1-105(1)(uuuu) and § 10-3-1104.9(3)(e).Takes effect on January 1, 2027, but the provisions in Section 5(2) took effect upon passage. See When SB 26-189 applies.
HB 26-1263 (chapter 208), "Concerning requirements for an operator of a conversational artificial intelligence service"Approved on May 29, 2026Adds definitions to § 6-1-1701, and a § 6-1-1708 on "conversational artificial intelligence services". Some operator duties apply "on and after January 1, 2027" (§ 6-1-1708(2) to (5)). Operators must "annually report to the attorney general's office" "on and after July 1, 2027" (§ 6-1-1708(6)(a)).A different set of duties for operators. MFF-28 and OFF-28 do not include it.

HB 26-1263 Section 3 gives the effective date of HB 26-1263: it "takes effect at 12:01 a.m. on the day following the expiration of the ninety-day period after final adjournment of the general assembly (August 12, 2026, if adjournment sine die is on May 13, 2026)". Section 3 gives a different result "if a referendum petition is filed" against HB 26-1263 in that period.

SB 26-189 has no short title. The Attorney General notice of proposed rulemaking for 4 CCR 904-6 uses the name "Automated Decision-Making Technology Act" for SB 26-189 and "Chatbot Safety Act" for HB 26-1263. Information from before May 14, 2026 that uses the names Colorado AI Act or CAIA is about SB 24-205.

HB 26-1263 Section 2 adds a § 6-1-1708 to part 17 on "conversational artificial intelligence services". The SB 26-189 § 6-1-1708 has a different name: "Compliance with other legal obligations - insurers covered entities - disclosures". The two sections have only the same number. As of October 2026, the codification of part 17 is not complete. Section numbers are from the enrolled act of SB 26-189.

When SB 26-189 applies ​

Section 5 of SB 26-189 gives its dates. Section 5(1) gives the general date:

Except as otherwise provided in subsection (2) of this section, this act takes effect January 1, 2027.

Section 5(2) gives the provisions that took effect upon passage:

Sections 6-1-1704 (4), 6-1-1705 (3), and 6-1-1706 (6), Colorado Revised Statutes, as amended in section 1 of this act, section 10-3-1104.9 (3)(e), Colorado Revised Statutes, as enacted in section 3 of this act, section 4 of this act, this section, and section 6 of this act take effect upon passage.

Section 5(3) gives the decisions to which SB 26-189 applies:

This act applies to consequential decisions made on or after January 1, 2027.

Section 6 of SB 26-189 is a safety clause. In it, the General Assembly finds that SB 26-189 is "necessary for the immediate preservation of the public peace, health, or safety or for appropriations for the support and maintenance of the departments of the state and state institutions".

SB 26-189 also gives these dates:

  • From January 1, 2027, the developer duties of § 6-1-1702 apply (§ 6-1-1702(1)). The Attorney General must adopt the rules of §§ 6-1-1704(4)(b) and 6-1-1705(3) "on or before January 1, 2027". As of October 2026, these rules are proposed rules only (see Attorney General rules and other sources).
  • From January 2028, the Attorney General reports each January on enforcement actions and cure periods (§ 6-1-1706(3)(e)).
  • On January 1, 2030, the cure subsection, § 6-1-1706(3), is repealed (§ 6-1-1706(3)(f)). See Enforcement and civil penalties.

Sections of SB 26-189 ​

SB 26-189 has six sections. Section 1 contains part 17, §§ 6-1-1701 to 6-1-1709. Each row below gives one section of part 17 or of SB 26-189, with its name in SB 26-189.

ProvisionName in SB 26-189ItemsMore information
§ 6-1-1701"Definitions"The definitions, for example ADMT, consequential decision, covered ADMT, covered domain, consumer, deployer, developer, and materially influenceCoverage and roles
§ 6-1-1702"Developer responsibilities - documentation"Documentation for each deployer, notices of material updates and other changes, developer recordsDeveloper duties
§ 6-1-1703"Deployer record keeping"Deployer recordsDeployer duties and consumer rights
§ 6-1-1704"Deployer disclosures - point-of-interaction notice public posting option - post-adverse outcome disclosures - legislative declaration - trade secrets - compliance with other law - accessibility rules"Notice before use, disclosures after an adverse outcome, Attorney General rules on these disclosures, trade secrets, creditors, federal law, accessibility, FERPADeployer duties and consumer rights
§ 6-1-1705"Consumer rights - correction - human review and reconsideration - rules"Correction, meaningful human review and reconsideration, FERPA, Attorney General rules on this sectionDeployer duties and consumer rights
§ 6-1-1706"Enforcement by the attorney general - deceptive trade practice - right to cure - no private right of action - joinder rules reporting - repeal"Enforcement, cure, reports, private right of action, Attorney General rules, "joinder"Enforcement and civil penalties
§ 6-1-1707"Liability - fault - allocation - no joint and several liability - indemnification prohibited - effect on existing law"Liability for "unlawful discrimination", relative fault, limits for developers, void indemnification provisionsDeployer duties and consumer rights
§ 6-1-1708"Compliance with other legal obligations - insurers covered entities - disclosures"Insurers, HIPAA covered entities and business associates, medical devices with FDA oversight, "a pharmaceutical or medical device manufacturer's research and development activities" with FDA oversight, protected health information, the Gramm-Leach-Bliley ActCoverage and roles
§ 6-1-1709"No new private right of action - application of other law"No new private right of action, compliance is not a defenseDuties that part 17 does not give
Section 2§ 6-1-105(1)(uuuu)A person that "violates part 17" engages in a deceptive trade practiceEnforcement and civil penalties
Section 3§ 10-3-1104.9(3)(e)Rules of the commissioner of insurance on notice and disclosures from insurers to consumersAttorney General rules and other sources
Section 4"Appropriation"The appropriation to the Department of LawNone
Section 5"Effective date - applicability"The datesWhen SB 26-189 applies
Section 6"Safety clause"The safety clauseWhen SB 26-189 applies

Who has duties in SB 26-189 ​

SB 26-189 gives duties to developers and deployers of a covered ADMT, each a person doing business in Colorado (§ 6-1-1701(7) and (8)). A covered ADMT is ADMT used to materially influence a consequential decision (§ 6-1-1701(5)). The role definitions and exclusions give the conditions for each role, and one person can have the two roles.

Section 6-1-1708 gives special provisions for insurers, HIPAA covered entities and business associates, and medical devices and research with FDA oversight, on the conditions of each provision.

Duties that part 17 does not give ​

SB 24-205 gave the items below, but part 17 as SB 26-189 reenacts it does not give them:

  • the duty of "reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination"
  • a "risk management policy and program"
  • an "impact assessment"
  • a "statement summarizing" the types of systems of a developer or deployer
  • the exception for some duties of a deployer that "employs fewer than fifty full-time equivalent employees", if all conditions in § 6-1-1703(6) apply
  • the developer and deployer "rebuttable presumption" provisions (§§ 6-1-1702(1) and 6-1-1703(1))
  • the "affirmative defense" (§ 6-1-1706(3)).

SB 24-205 refers to the NIST "Artificial Intelligence Risk Management Framework" and ISO/IEC 42001 in two provisions. These are its provisions on a "risk management policy and program" (§ 6-1-1703(2)(a)(I)) and an "affirmative defense" (§ 6-1-1706(3)(b)).

Part 17 as SB 26-189 reenacts it also gives no right to "opt out", and no duty to give the "principal reason or reasons" for an adverse outcome. It gives no "appeal" right, other than "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable" (§ 6-1-1705(1)(a)(II)).

Part 17 tells developers and deployers two times that compliance with part 17 is not a defense. Section 6-1-1709(2) gives this limit:

Compliance with this part 17 does not constitute a defense to and does not excuse noncompliance with any applicable law.

Section 6-1-1707(8) gives the same limit for "any applicable law". Section 6-1-1707(7)(b) gives a different effect to the compliance of a developer with § 6-1-1702 (see Deployer duties and consumer rights).

No provision of SB 26-189 gives a presumption or a defense to a developer or deployer that uses a governance framework or a "risk management policy and program". SB 24-205 used this name for a duty (§ 6-1-1703(2)(a) of that act).

Attorney General rules and other sources ​

SB 26-189 tells the Attorney General to adopt two sets of rules "on or before January 1, 2027":

  • Rules "to clarify and implement the post-adverse outcome disclosure requirements" of § 6-1-1704(3) (§ 6-1-1704(4)(b)). These rules "may include, as appropriate":
    1. "rules clarifying the content of required disclosures related to the types, sources, or categories of personal data"
    2. "sector-specific guidance or illustrative examples tailored to different covered domains"
    3. "standards for describing the role of the covered ADMT in a consequential decision in a manner that is reasonably understandable to a consumer"
    4. "guidance addressing how the disclosure requirements described in this section interact with federal or state laws that require or govern notices, explanations, or adverse outcome disclosures".
  • Rules "to clarify and implement the requirements of this section", for the consumer rights of § 6-1-1705 (§ 6-1-1705(3)).

The date is a time limit for the Attorney General. It does not show that the Attorney General will adopt the rules by that date. In § 6-1-1704(4)(a), the General Assembly finds that "the specific content and format of post-adverse outcome disclosures may vary across consequential decision domains".

Section 6-1-1706(5) also lets the Attorney General adopt these rules, with no date:

  • rules "as necessary to implement and clarify this part 17" (§ 6-1-1706(5)(a))
  • rules "to clarify the application of the definition of" materially influence, with "presumptions, illustrative examples, and objective indicators" (§ 6-1-1706(5)(b)).

When the Attorney General adopts rules for part 17, it must use "a process that meaningfully engages stakeholders, including consumer advocates, deployers, developers, and sector regulators, through public notice, opportunity for written comment, and at least one public hearing". It must adopt the rules "in accordance with section 24-4-103" (§ 6-1-1706(5)(c)).

Section 3 of SB 26-189 adds § 10-3-1104.9(3)(e): "The commissioner may adopt new rules or update existing rules regarding notice and disclosures from insurers to consumers."

As of October 2026, the Attorney General has a notice of proposed rulemaking for 4 CCR 904-6, "Proposed Rules for the Automated Decision-Making Technology and Chatbot Safety Acts". The proposed rules are for SB 26-189 and HB 26-1263.

On October 6, 2026, the Department of Law released an "interim draft" of the proposed rules. The "interim draft" is not law.

The notice gives a written comment period from August 11, 2026 to October 26, 2026. The public hearing starts on October 26, 2026, at 10:00 AM. If the public hearing continues after October 26, 2026, the comment period continues to the last day of the public hearing. Written comments must be received on or before October 26, 2026, at 11:59 PM MT. If the public hearing continues, they must be received before 11:59 PM MT on its last day.

The notice gives this information: the proposed rules "are subject to further changes and modifications after the public hearing and the deadline for the submission of written comments". The notice also gives two alternative standards for "Materially Influence", for written comments. These two standards are not rules, and they give no duty. As of October 2026, the rules for 4 CCR 904-6 are proposed rules only, and they are not adopted.

Modulos changes the Frameworks when the Attorney General adopts the rules of §§ 6-1-1704(4)(b) and 6-1-1705(3). See Rules and codification to monitor.

The Federal Trade Commission (FTC) proposed policy statement of July 1, 2026 refers to "Colorado’s recently revised Artificial Intelligence Act". This proposed policy statement is not adopted, and it is not law.

Enforcement and civil penalties ​

The Attorney General must enforce part 17 as SB 26-189 reenacts it through the Colorado Consumer Protection Act (§ 6-1-1706(1)(a)). In § 6-1-1706(1)(b), "violations of the disclosure requirements and consumer rights described in sections 6-1-1702, 6-1-1703, 6-1-1704, and 6-1-1705 are enforceable exclusively by the attorney general".

A violation of part 17 is a deceptive trade practice in the Colorado Consumer Protection Act (§ 6-1-1706(2)(a) and § 6-1-105(1)(uuuu)). A provision of the Colorado Consumer Protection Act that does not agree with the exclusive enforcement authority of the Attorney General does not apply to a violation of part 17 (§ 6-1-1706(2)(b)).

Section 6-1-1706(3) gives these provisions for a cure:

  • Before an enforcement action, the Attorney General must give a notice of violation to the developer or deployer "if a cure is deemed possible by the attorney general" (§ 6-1-1706(3)(a)).
  • If the developer or deployer does not cure the violation "within sixty days after receipt of a notice of violation", the Attorney General "may bring an action pursuant to this section" (§ 6-1-1706(3)(b)).
  • If the Attorney General "finds and can demonstrate" that a developer or deployer knowingly violated or repeatedly violated part 17, a different provision applies. The Attorney General "is not required to provide a cure period before seeking penalties or other relief" (§ 6-1-1706(3)(c)).
  • From January 2028, the Attorney General must give a report each January on enforcement actions and cure periods for part 17. The Attorney General gives the report at the SMART Act hearing of the Department of Law (§ 6-1-1706(3)(e) and § 2-7-203).
  • Subsection (3) "is repealed, effective January 1, 2030" (§ 6-1-1706(3)(f)).

Section 6-1-1706(3)(d) gives this provision for courts:

If a violation is discovered in the course of an enforcement action, a court may consider that a developer or deployer cured the violation within sixty days after receipt of written notice as a mitigating factor in determining civil penalties or other monetary relief, if any.

SB 26-189 does not give the value of a civil penalty. Section 6-1-1706(3)(d) refers to "civil penalties or other monetary relief". The Legislative Council Staff fiscal note for SB 26-189 gives this information on the Colorado Consumer Protection Act: "a person committing a deceptive trade practice may be subject to a civil penalty of up to $20,000 for each violation".

Part 17 gives no new private right of action (§ 6-1-1706(4) and § 6-1-1709(1)). Section 6-1-1706(4) keeps "any existing rights or remedies available under state or federal law": part 17 "limits or reduces" none of them. Examples in § 6-1-1706(4) are the Colorado Anti-Discrimination Act, the Colorado Consumer Protection Act, and "product liability law". Section 6-1-1706(6) keeps "the ability of a party to join necessary or permissive parties under the Colorado Rules of Civil Procedure" in an action "arising under existing law".

The court order of April 27, 2026 ​

In X.AI LLC v. Weiser, 1:26-cv-01515 (D. Colo.), the court gave a minute order on April 27, 2026 (ECF No. 24). The minute order applies to the Attorney General, who is the defendant. The court order gives this instruction in ¶ 1:

The defendant shall not initiate enforcement, including but not limited to the initiation of an investigation, for alleged violations of SB24-205 (or any legislation replacing or amending SB24-205 enacted during this legislative session) that occurred or may occur on or before 14 days after the date the Court issues a ruling on xAI’s forthcoming motion for a preliminary injunction in this case.

The court order gives the time for the xAI motion for a preliminary injunction (¶ 2): "within 28 days after final adoption of rulemaking implementing SB24-205 or any legislation that may replace or amend SB24-205".

SB 26-189 repeals and reenacts part 17, which SB 24-205 added, and the Governor signed SB 26-189 on May 14, 2026. As of October 2026, the court order does not change SB 26-189 or its dates.

SB 26-189 in Modulos ​

Modulos has two Frameworks with the name Colorado SB 26-189:

Each Requirement has an ADMT Role tag with the value Developer, Deployer, or the two. For the Controls that other Frameworks also use, see Control overlap.

For the Requirements, the steps that Modulos recommends, and the items with no Control, see Operationalizing Colorado SB 26-189 in Modulos.

Where to go next ​

Coverage and roles

The ADMT definition, materially influence, consequential decisions, covered domains, developer and deployer, and the insurer, HIPAA, and FDA provisions

Developer duties

Documentation for each deployer, notices of changes, and developer records

Deployer duties and consumer rights

Notice before use, disclosures after an adverse outcome, correction and human review, records, and liability

Operationalizing in Modulos

The two Frameworks, the Requirements, the steps, and the items with no Control

FAQ about Colorado SB 26-189 ​

For short entries about Colorado SB 26-189, each with a link to the provisions, see FAQ about Colorado SB 26-189.

Sources ​

Disclaimer

This page gives general information. It is not legal advice. SB 26-189 takes effect on January 1, 2027, but the provisions in Section 5(2) took effect upon passage. As of October 2026, the Attorney General rules of §§ 6-1-1704(4)(b) and 6-1-1705(3) are proposed rules only. In § 6-1-1709(2), compliance with part 17 "does not constitute a defense to and does not excuse noncompliance with any applicable law". Always compare this page with SB 26-189, and get legal advice.