The most ambitious AI law in America just got rewritten before it ever took effect. On May 14, 2026, Colorado Governor Jared Polis signed SB 189, a bill that repeals and replaces the landmark Colorado AI Act (originally SB 24-205) with a far narrower statute. The new law pushes the effective date to January 1, 2027 and quietly abandons the regulatory architecture that made Colorado a national bellwether in the first place.
This is not a tweak. It is a reset. And it tells us something uncomfortable about how AI accountability actually gets made — and unmade.
What the original Colorado AI Act tried to do
When Colorado passed SB 24-205 in 2024, it was the first comprehensive U.S. statute aimed at "high-risk" AI systems. The law targeted what it called consequential decisions: AI used in employment, housing, healthcare, education, lending, and other domains where a bad automated call can reshape someone's life.
The framework was risk-based and borrowed heavily from the EU AI Act's logic. Its core obligations were substantive, not cosmetic:
- A duty of reasonable care for both developers and deployers, aimed at preventing algorithmic discrimination.
- Mandatory impact assessments for high-risk systems.
- Risk management programs that deployers had to build and maintain.
- Reporting obligations to the Colorado Attorney General when discrimination was discovered.
- Consumer disclosures when AI factored into a consequential decision.
The duty of care was the load-bearing wall. It meant companies could be held accountable not just for hiding the ball, but for deploying biased systems in the first place. That is a meaningfully higher bar than telling people a machine was involved.
What SB 189 keeps — and what it throws out
SB 189 pivots away from governing AI risk and toward governing AI transparency. The difference matters more than it sounds.
The revised law trades a duty to prevent algorithmic harm for a duty to disclose that algorithms were used. Those are not the same thing.
Here is the practical before-and-after:
| Original Colorado AI Act (SB 24-205) | SB 189 Replacement |
|---|---|
| Duty of reasonable care to prevent algorithmic discrimination | Eliminated |
| Mandatory risk management programs for deployers | Eliminated |
| Required impact assessments for high-risk systems | Eliminated |
| AG reporting of discovered discrimination | Scaled back |
| Consumer disclosures | Retained and reframed as the centerpiece |
What survives is a disclosure-and-documentation regime built around automated decision-making technology (ADMT). Developers and deployers must disclose intended uses, known harmful uses, the categories of training data, and oversight instructions. When a covered ADMT materially influences a decision that produces an adverse outcome, consumers gain the right to access and correct factually inaccurate personal data and to request meaningful human review and reconsideration.
The Colorado Attorney General is directed to adopt rules clarifying post-adverse-outcome disclosure requirements and consumer rights by January 1, 2027 — the same day the law takes effect.
Why this happened
The rewrite did not come out of nowhere. Between the original 2024 passage and this May's signing, the law's start date slipped repeatedly: first from February 1, 2026, then to June 30, 2026 via SB 25B-004, and now to January 1, 2027 under SB 189. Each delay bought time for a lobbying fight that the compliance-cost argument ultimately won.
Industry groups argued the duty of care and impact-assessment mandates were vague, expensive, and would push AI companies out of Colorado. Smaller deployers said they lacked the resources to run formal risk programs. A state work group spent months proposing replacement frameworks. Polis, who had signed the original bill with reservations, signaled he would sign a pared-down version once the legislature passed it overnight in a special session.
The result is a law that looks regulatory on paper but asks far less of the companies it governs.
The ethics of disclosure-only AI law
Here is the harder question: is a transparency regime enough?
The case for SB 189 is real. Disclosure rules are cheaper to comply with, easier to enforce, and harder to game with paperwork theater. A duty of care without clear standards can become a compliance ritual — a binder of impact assessments that nobody reads and that does little to stop a biased model. Some defenders argue Colorado was right to wait for federal clarity rather than impose a costly framework that the state's own regulators were not ready to enforce.
But disclosure has a structural weakness. Telling someone an algorithm denied their loan does not make the algorithm fair. The right to request human review is only as good as the human doing the reviewing — and rubber-stamp review is a well-documented failure mode. By removing the affirmative duty to prevent discrimination, SB 189 shifts the burden back onto individuals to notice, object, and demand reconsideration after harm has already occurred. That is a heavy load to place on the very people least equipped to carry it.
There is also a federalism subtext. With a December 2025 federal executive order signaling intent to consolidate AI oversight, and the EU AI Act setting a much higher global bar, Colorado's retreat reads less like a considered policy judgment and more like a state blinking first. When the most aggressive state law in the country gets hollowed out before enforcement, it sends a signal to every other legislature watching.
What this means for companies right now
If you build or deploy AI that touches consequential decisions for Colorado residents, the compliance picture got simpler but not empty:
- Inventory your ADMT. You need to know which systems materially influence adverse outcomes before you can disclose anything.
- Document training-data categories and known harmful uses. These disclosures are now explicit requirements, not best practices.
- Build a human-review path. The consumer right to meaningful review and reconsideration needs an actual workflow behind it, not a dead-end form.
- Watch the AG rulemaking. The details that determine real obligations land by January 1, 2027.
The Bottom Line
The Colorado AI Act was supposed to be the template other states copied. Instead, SB 189 turned it into a cautionary tale about how quickly substantive AI accountability erodes under cost pressure. Transparency is genuinely better than nothing, and a well-run disclosure regime can do real good. But trading a duty to prevent algorithmic harm for a duty to describe it is a smaller promise than the one Colorado originally made. The fairness of an automated decision still depends on the system behind it — and that is precisely the part the new law no longer asks anyone to guarantee.
