Colorado AI Act and AI Laws: SB 26-189, SB 24-205 (2027)

As of November 2026, Colorado has enacted the ADMT Act (SB 26-189, C.R.S. 6-1-1701 ff.), a rewrite of the Colorado AI Act (SB 24-205) that is scheduled to take effect January 1, 2027, but a federal court order bars the Attorney General from starting enforcement for alleged violations that occurred or occur on or before 14 days after a ruling on xAI's expected injunction request.

Colorado also has narrower AI laws on chatbots, health coverage, psychotherapy, insurance and deepfakes. As of November 4, 2026, Colorado is the only state we found with a cross-sector statute on automated decisions, among the state laws reviewed for our national guide, and it starts January 1, 2027. That review was not a full-text search of every state code. California reaches similar ground by regulation. For the national picture, see our US AI laws guide.

Status as of November 4, 2026: SB 26-189 is signed and scheduled, and only a handful of its provisions took effect on passage. The Attorney General's implementing rules (4 CCR 904-6) had a hearing on October 26, 2026, and the Attorney General's rulemaking page shows no adoption. The public copy of the xAI v. Weiser docket shows no preliminary injunction motion and no merits ruling.

Colorado AI Laws at a Glance

Colorado ADMT Act (SB 26-189): What It Covers

SB 26-189 is Chapter 131 of the 2026 session laws. Governor Polis signed it on May 14, 2026. Its heading in the statute is "Automated Decision-Making Technology in Consequential Decisions."

It regulates a narrower thing than "AI." The test has three parts: a technology that counts as ADMT, a consequential decision in a covered domain, and a material influence linking the two.

What Is Automated Decision-Making Technology?

ADMT is "a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual" (C.R.S. 6-1-1701(2)(a)).

A "covered ADMT" is ADMT "that is used to materially influence a consequential decision" (6-1-1701(5)). The statute excludes ordinary infrastructure such as anti-virus software, calculators, databases, firewalls, spam filtering, spell-checking and web hosting. Spreadsheets are excluded only if they "require human analysis and do not use machine learning, foundation models, or large language models."

Two more exclusions matter for generative AI:

• A tool "used by an individual solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing."
• Consumer-facing conversational technology, but only if it is not "contracted, advertised, marketed, configured, or intended" for a consequential decision and it is under an acceptable use policy that bars using its content in a consequential decision. Both conditions must be met.

The Seven Covered Domains

A consequential decision must relate to one of seven covered domains in C.R.S. 6-1-1701(6):

• Education enrollment or an education opportunity
• Employment or an employment opportunity that creates or may create an employer-employee relationship
• The lease or purchase of residential real estate in Colorado
• A financial or lending service
• Insurance, including underwriting, pricing, coverage, claims adjudication, or other determinations that materially affect access to benefits
• Health-care services
• Essential government services and public benefits, including eligibility and renewal determinations

Legal services are not on the list.

A consequential decision is one about a consumer relating to the provision of, or access to, eligibility for, selection for, or compensation for a covered domain. It also includes a differentiated price, cost sharing, compensation or other material terms "reasonably likely to materially limit, delay, effectively deny, or otherwise fundamentally alter" access.

The definition excludes low-stakes or routine processes such as routine scheduling and customer service triage. It also excludes advertising, marketing, differentiated product recommendations, search, content moderation, cybersecurity, anti-money-laundering controls, and fraud prevention, among others.

What "Materially Influence" Means

Under C.R.S. 6-1-1701(13), an output materially influences a decision only if both of these are true:

• It is "a non-de minimis factor that is used in making a consequential decision."
• It "affects the outcome of a consequential decision, including by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how a consequential decision is made."

"Incidental, trivial, or clerical uses" do not count. The Attorney General's proposed rules address this phrase, as described in the rulemaking section below.

Who Is Covered

A developer or deployer must be "a person doing business in Colorado." The definitions set no revenue or headcount threshold.

• Deployer: a person doing business in Colorado that deploys a covered ADMT (6-1-1701(7)).
• Developer: a person doing business in Colorado that develops, offers, sells, leases, licenses or otherwise makes a covered ADMT commercially available. It also includes one that builds a component designed for that use, or intentionally and substantially modifies an ADMT so it becomes covered (6-1-1701(8)).
• Not a developer: research-only and internal-only developers, on the statute's conditions; a preceding developer whose system an unaffiliated person changes for a different use; and a component maker that lacks actual knowledge of the integration.
• Consumer: the Colorado Privacy Act meaning, plus an employee, a job applicant who is a Colorado resident, and "any individual whose access to, eligibility for, or opportunity in Colorado is evaluated in a consequential decision by a person doing business in Colorado" (6-1-1701(4)).

Government agencies. The Colorado Department of Law says in the cover page to its October 6, 2026 interim draft that, based on the definitions of deployer and person, "the ADMT Law does not apply to governments." It adds that it "would encourage governments to comply with the ADMT Act to the extent they provide essential government services such as Medicaid." Its October 21, 2026 regulatory analysis does not fully line up with that: it says the act may minimally add work for the state's Office of Information Technology "to ensure covered state agencies are in compliance." These are the agency's statements, not a court ruling. The cover page's reading rests on who counts as a person, so it does not take a private company doing business in Colorado out of the essential-services domain.

What Developers Must Do (C.R.S. 6-1-1702)

From January 1, 2027, a developer must give each deployer, in understandable form that protects trade secrets:

• A general statement of intended uses and known harmful or inappropriate uses
• The categories of data, including personal data, used to train the system, to the extent known
• Known limitations, including known risks and circumstances in which it should not be used
• Instructions for appropriate use, monitoring and meaningful human review, where applicable
• Information reasonably necessary for the deployer to comply with C.R.S. 6-1-1704, with notice to the deployer if anything is withheld

Developers must also give notice of material updates, intentional and substantial modifications, and changes to intended use, limitations or risk mitigation "within a reasonable time." Public release notes work only if the developer gives each deployer direct notice of the release.

These duties attach only where the ADMT "was marketed, advertised, configured, contracted, sold, or licensed to be used to materially influence a consequential decision." Developers keep compliance records for at least three years after a record is created, or longer if other law requires.

What Deployers Must Do (C.R.S. 6-1-1703 and 6-1-1704)

Before use. A deployer must give consumers a clear and conspicuous notice that it used or will use a covered ADMT in a consequential decision, with instructions for getting more information. A prominent public notice "reasonably accessible at points of consumer interaction" satisfies this, including a link or posting reasonably close to the transaction.

After an adverse outcome. Within 30 days after making the decision, the deployer must provide:

• A plain language description of the decision and the role the covered ADMT played
• Instructions and a simple process to request more information, including the system's name, version number if applicable, developer, and the types, categories and sources of personal data used, to the extent the deployer received that from the developer
• An explanation of the consumer's rights and how to exercise them

An adverse outcome is a decision that denies, terminates, revokes, or materially reduces or restricts access, eligibility, selection, compensation or a service. It also includes materially less favorable differentiated terms compared with similarly situated consumers (6-1-1701(1)).

Limits and shortcuts. A deployer need not reveal trade secrets, but must tell the consumer if it withholds information. A creditor whose federal Equal Credit Opportunity Act notice also satisfies these requirements need not send a duplicate. Schools subject to FERPA may use their FERPA channels. Notices must be reasonably accessible to people with disabilities and people with limited English proficiency.

Records. Deployers keep records reasonably necessary to show compliance for at least three years after the date of the decision, or longer if other law requires (6-1-1703).

Consumer Rights After an Adverse Decision (C.R.S. 6-1-1705)

If a covered ADMT materially influenced a decision that produced an adverse outcome, the consumer may request, and the deployer must provide:

• Instructions for requesting personal data and correcting "factually incorrect or materially inaccurate" personal data used in the decision
• "An opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable"

The correction right does not reach "opinions, predictions, scores, or protected evaluations." So a consumer can fix a wrong fact but cannot demand a different score under this section.

Meaningful human review has a defined meaning. The reviewer must be designated by the deployer, have authority to "approve, modify, or override" the decision, consider relevant available primary evidence, be trained to do the review, not default to the system output, and have enough information to understand the output (6-1-1701(15)).

Enforcement, Penalties and the 60-Day Cure Period (C.R.S. 6-1-1706)

The Attorney General enforces the act through the Colorado Consumer Protection Act. Violations of the disclosure and consumer-rights sections, 6-1-1702 through 6-1-1705, are enforceable "exclusively by the attorney general." The Department of Law's October 21, 2026 regulatory analysis refers in passing to "the Attorney General and district attorneys" when discussing those ADMT duties, but the statute's wording is the one quoted here.

Penalties. A violation is a deceptive trade practice (6-1-1706(2)(a), 6-1-105(1)(uuuu)). The act itself states no dollar figure. The Consumer Protection Act, as published in the 2025 C.R.S., sets a civil penalty of not more than $20,000 for each violation, counted separately for each consumer or transaction involved (6-1-112(1)(a)). Subsection (1)(c) sets up to $50,000 per violation where the violation was committed against an elderly person.

Cure. The cure period has conditions:

• Before enforcing, the Attorney General must issue a notice of violation "if a cure is deemed possible by the attorney general."
• The Attorney General may sue if the violation is not cured within 60 days after the notice.
• No cure period is required if the Attorney General "finds and can demonstrate" a knowing violation or repeated violations.
• A court may treat a cure within 60 days as a mitigating factor on penalties.
• The whole cure subsection, 6-1-1706(3), is repealed effective January 1, 2030.

Private suits. "Nothing in this part 17 creates a new private right of action." The same subsection adds that nothing in the act limits existing rights under state or federal law, including the Colorado Anti-Discrimination Act, the Consumer Protection Act and product liability law (6-1-1706(4)).

Reporting. Beginning in January 2028, the Attorney General must report each year on actions brought and cure periods offered, at the Department of Law's SMART Act hearing.

Liability and Vendor Contracts (C.R.S. 6-1-1707)

The rewrite keeps discrimination claims in the picture without adding a new duty of care. A developer or deployer "may be held liable" in an action alleging unlawful discrimination under state anti-discrimination law, arising from a decision materially influenced by a covered ADMT.

• Fault: allocated among deployers and developers by relative fault. The section creates no joint and several liability, except as existing law permits.
• Developers: liable under this section only to the extent the deployer used the system as intended, documented, marketed, advertised, configured or contracted for, and it materially influenced the decision.
• Indemnity: a contract term that indemnifies a party against liability for its own acts or omissions in violation of Colorado anti-discrimination law is "contrary to public policy and void," with stated exceptions. Insurance claims are not limited.
• No defense: compliance with the act "is not a defense to" noncompliance with any other applicable law.

Exemptions: Insurers, HIPAA Entities and FDA-Regulated Products

SB 26-189's own C.R.S. 6-1-1708 sets out sector carve-outs:

• Insurers: an insurer and affiliates subject to C.R.S. 10-3-1104.9 "are in compliance with this part 17 in the practice of insurance." Uses in the insurer's own employment decisions stay covered.
• HIPAA covered entities and business associates: sections 6-1-1701 to 6-1-1706 do not apply, except for a decision about employment or an employment opportunity. For a health-care provider, this applies only if it operates from a location in Colorado.
• Notice duties that remain for covered entities: a general notice to patients of the use of advanced technologies. If a covered ADMT determines eligibility for financial assistance, including discounted care, the entity owes four specific disclosures, either in advance or within 30 calendar days after an adverse outcome.
• FDA: medical devices under FDA oversight, and pharmaceutical or device makers' research and development under FDA oversight.
• Privacy law: nothing requires a disclosure that would violate federal health privacy law or the Gramm-Leach-Bliley Act.

Colorado AI Act (SB 24-205): What Happened to the 2024 Law

Colorado passed a broad high-risk AI law in 2024. SB 24-205, signed May 17, 2024, was set to require developers and deployers of high-risk AI systems to use reasonable care against algorithmic discrimination from February 1, 2026.

SB 25B-004, signed August 28, 2025, then moved the date once, to June 30, 2026.

SB 24-205 became law May 17, 2024, and its developer and deployer duties were written to apply "On and after June 30, 2026," the date set by SB 25B-004. SB 26-189 was signed May 14, 2026, but apart from a few subsections that took effect on passage, Section 5 of that act sets its effective date at January 1, 2027. That is when the repeal and reenactment takes effect, and the new act applies to decisions made on or after that date.

We found nothing in either act that suspends the 2024 duties from June 30 to December 31, 2026, and no ruling on the question in the public copy of the xAI docket. A federal court order bars the Attorney General from starting enforcement for alleged violations through 14 days after a preliminary injunction ruling, and the public copy of the docket shows no such ruling.

The table compares the enacted text of SB 24-205 with the enacted text of SB 26-189.

There is no NIST or ISO safe harbor in SB 26-189. Compliance with the act is also not a defense to other law.

Attorney General Rulemaking (4 CCR 904-6)

SB 26-189 requires the Attorney General to adopt rules on post-adverse-outcome disclosures and consumer rights "on or before January 1, 2027" (6-1-1704(4)(b), 6-1-1705(3)). Those two rulemaking subsections took effect on passage, along with 6-1-1706(6), a joinder provision, and the insurance rule authority in 10-3-1104.9(3)(e). The Attorney General's general rulemaking authority in 6-1-1706(5) is not on the on-passage list.

The rulemaking page covers both the ADMT Act and the Chatbot Safety Act in one rule set:

The largest open issue is the meaning of "materially influence." The August notice offered two definitions of a de minimis factor: one with "only a trifling, trivial, or incidental impact," the other "not a substantial factor." The October 6 interim draft uses the "not a substantial factor" wording.

The interim draft also proposes a rebuttable presumption of material influence. It applies when an output constrains an option set, sets a threshold, or produces a rank, score, classification, recommendation, prediction or other inference that pertains to the individual, is reviewed by the decision-maker or screens data for them, and is consistent with the outcome. Draft Rule 1.3 says the rules become effective January 1, 2027.

Because the draft is not final, its presumption, examples and numbering may change. It matters beyond compliance planning: final adoption of the rules starts xAI's deadline in federal court.

xAI v. Weiser: The Federal Lawsuit and the Enforcement Order

X.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo.), was filed April 9, 2026, against the Colorado Attorney General, and challenges SB 24-205. It is assigned to Chief Judge Daniel D. Domenico and referred to Magistrate Judge Cyrus Y. Chung.

xAI pleads First Amendment claims (two counts), an extraterritorial Commerce Clause claim, a Pike burden claim, vagueness and Equal Protection. There is no preemption count.

On April 24, 2026, the Justice Department intervened in xAI's lawsuit. It relies on 42 U.S.C. 2000h-2, part of the Civil Rights Act of 1964, and pleads two Equal Protection counts. Its complaint quotes Executive Order 14365 and does not mention the AI Litigation Task Force.

What the April 27, 2026 Order Says

On April 27, 2026, Magistrate Judge Chung entered a minute order (ECF 24) granting a joint motion and stipulation by xAI, the United States and the Attorney General (ECF 22). The operative terms:

• The Attorney General "shall not initiate enforcement, including but not limited to the initiation of an investigation, for alleged violations of SB24-205 (or any legislation replacing or amending SB24-205 enacted during this legislative session) that occurred or may occur on or before 14 days after the date the Court issues a ruling on xAI's forthcoming motion for a preliminary injunction in this case."
• xAI must file its preliminary injunction motion and, if necessary, an amended complaint "within 28 days after final adoption of rulemaking implementing SB24-205 or any legislation that may replace or amend SB24-205."
• The June 16, 2026 scheduling conference is vacated, and case deadlines are stayed pending a ruling on that motion.

What the Order Does and Does Not Do

• It is conduct-based. The bar is framed by when an alleged violation occurred, through 14 days after a preliminary injunction ruling. It is not a fixed end date.
• It is not a ruling on the merits. The court found good cause for a stay and made no finding on the law's validity. No preliminary injunction has been granted after a contested motion.
• It binds the Attorney General, the defendant. In the stipulation, the Attorney General is described as holding exclusive authority to enforce SB 24-205.
• It does not say the duties are suspended. It restrains enforcement. SB 26-189's own text still sets January 1, 2027 as its effective date.

The chain runs in this order: final rule adoption, a preliminary injunction motion within 28 days, a ruling, then the end of the covered period 14 days later. The public RECAP copy of the docket shows 25 entries, the last dated October 2, 2026, and no such motion. RECAP copies can lag the court's own system, so a later filing may not appear there.

Separately from the order, the Department of Law's cover page to the October 6, 2026 interim draft responds to requests for a grace period. It says the laws go into effect January 1, 2027, that the Attorney General's policy "has been to focus on egregious and intentional violations of the law," and that the office "will exercise appropriate discretion in enforcement of the laws" while entities work to come into compliance. That is a statement of policy, not a rule.

Chatbot Safety Act (HB 26-1263)

HB 26-1263 (Chapter 208, approved May 29, 2026) regulates operators of a "conversational artificial intelligence service." That means an AI system "accessible to the general public" that "primarily simulates human conversation and interaction through adaptive textual, visual, or aural communications."

The act lists 12 exclusions. They include tools for developers and researchers, commerce and customer-service bots, narrow-topic bots that cannot produce sexual content or maintain dialogue about self-harm, business tools, internal business use, certain voice assistants, video game and theme park characters, HIPAA covered entities, and certain school tools. An app store or search engine is not an operator solely because it provides access.

Duties for minors (under 18), from January 1, 2027, where the operator knows a user is a minor:

• Clearly disclose that the user is talking to AI, by a persistent disclaimer, an intermittent audio disclaimer, or at the start of each interaction and at least every three hours
• No points or similar rewards at unpredictable intervals meant to increase engagement
• Technically feasible measures against explicit sexual conduct, intimate digital depictions, and sexualized interaction with the minor
• Reasonable measures against responses that simulate "emotional dependence or isolation from real-world supports," including claims of being human or sentient, romantic companionship statements, and adult-minor romantic role-play
• Privacy and account tools for the minor and for a parent or guardian, including control over memory and use of data for training

Operators must use "commercially reasonable methods or generally accepted methods" to estimate age and may not "willfully disregard clear and convincing information" that a user is a minor.

Duties for all users, from January 1, 2027:

• AI disclosure at the first interaction each day, at least every three hours or persistently, and in response to a user's prompt
• A suicide and self-harm protocol with referral to a crisis service provider, "but not including a law enforcement agency"
• No statement that output is provided by, endorsed by, or equivalent to services of a licensed health-care professional, licensed legal professional, licensed mental health professional or qualified dietitian

Reports. "On and after July 1, 2027," operators report annually to the Attorney General on crisis referrals and protocols, without user identifiers. The Attorney General must post data from the reports.

Enforcement. HB 26-1263 has no enforcement subsection of its own and states no penalty. The Attorney General's proposed rules cover the act, citing rulemaking authority. The Colorado Department of Law's October 21, 2026 regulatory analysis says "a violation of the ADMT Act or Chatbot Safety Act is considered an unfair trade practice under the CCPA," meaning the Colorado Consumer Protection Act, and refers to enforcement by "the Attorney General and district attorneys under the Chatbot Safety Act." That is the agency's reading, not a court ruling. If it holds, the Consumer Protection Act's civil penalty of up to $20,000 per violation would be the starting point. See the open questions below.

AI in Health Care: HB 26-1139 and HB 26-1195

HB 26-1139: Utilization Review and AI Psychotherapy Coverage

HB 26-1139 (Chapter 325, approved June 2, 2026) takes effect January 1, 2027, unless a referendum petition was filed. It adds C.R.S. 10-16-112.7 and 25.5-1-209.

It applies to carriers that use AI for utilization review or work through someone who does. It also applies to pharmacy benefit managers and private utilization review organizations under contract with a carrier, and to behavioral health administrative services organizations and managed care entities reviewing mental or behavioral health services.

Those entities must ensure the AI bases its determination on the individual's clinical history and circumstances, not solely on group data. They must keep documentation, audit logs and model-governance records, and file written disclosures with the Division of Insurance, the Department of Human Services or the Department of Health Care Policy and Financing, as applicable.

The key limit: a carrier's denial based in whole or in part on medical necessity "shall not be issued solely on the output of an artificial intelligence system without human review and approval of the denial by a licensed clinician, licensed physician, or other regulated professional" competent to evaluate the clinical issues. AI may still assist with utilization review, including expedited approvals.

The act also bars coverage or payment for psychotherapy services "provided directly to an individual" and "conducted by an artificial intelligence system." For carriers, that applies to plans issued or renewed on or after the effective date. A parallel section reaches payers under the Colorado Medical Assistance Act and the Children's Basic Health Plan Act.

HB 26-1195: AI and Therapists

HB 26-1195 (Chapter 358, approved June 3, 2026) names August 12, 2026 as its effective date if the session adjourned May 13, 2026, and no referendum petition was filed. It applies to actions on or after that date. We have not confirmed the petition status.

A licensee, registrant, certificate holder or other person lawfully permitted to provide psychotherapy services (a provider, below) may use AI for administrative and supplementary support, such as scheduling, billing and therapy notes, while staying responsible for reviewing outputs. A provider may not allow AI to engage in therapeutic communication without synchronous, real-time involvement of the provider, or to generate therapeutic recommendations or treatment plans without the provider's review and approval.

Using AI to record or transcribe a session requires advance written notice and written consent from the client or the client's legally authorized representative. Consent is needed for the initial use, not each session, unless the purpose or manner of use materially changes. A refusal or revocation cannot be used to deny services.

Providers must also give clients written information about these prohibitions at initial contact. For a person licensed, registered or certified under the mental health practice article, failing to comply is a violation of C.R.S. 12-245-224(1)(y).

The section does not apply to a provider who uses or recommends self-help, coaching, journaling, mood monitoring or similar wellness tools, or certain FDA-authorized tools, that do not diagnose or treat mental health disorders and that clearly disclose they are no substitute for clinical care (12-245-224.5(9)). Approved training programs and review-board research have their own carve-outs.

Separately, new C.R.S. 6-1-1705.2 applies to any "person." It bars advertising, interface or output language that implies AI output comes from, is endorsed by, or equals services of a licensed therapist, that represents the system provides psychotherapy services, or that suggests therapist-client style confidentiality. Training programs, review-board research, and certain wellness or FDA-authorized tools that do not diagnose or treat, and that disclose they are no substitute for clinical care, are carved out.

AI in Hiring and Employment

Employment is one of the ADMT Act's seven domains, so the act's notice, adverse-outcome and human-review duties apply to covered hiring and employment decisions from January 1, 2027, subject to the enforcement order described above. "Consumer" expressly includes an employee and a job applicant who is a Colorado resident.

SB 26-189 has no bias-audit requirement, and we found none for hiring tools in the other Colorado acts reviewed on this page. That search was not a full sweep of Colorado law. Existing discrimination claims remain available under the Colorado Anti-Discrimination Act, and 6-1-1707 addresses how fault is shared in those cases.

Insurance Algorithms: SB 21-169

SB 21-169, at C.R.S. 10-3-1104.9, bars insurers from unfairly discriminating based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity or gender expression in any insurance practice, including through external consumer data, algorithms and predictive models.

The Division of Insurance's amended Regulation 10-1-1, covering individual life, private passenger auto and health benefit plan insurers, is effective October 15, 2025. Insurers that do not use such data or models file an attestation each December 1.

SB 26-189 added 10-3-1104.9(3)(e), effective on passage, which lets the commissioner adopt rules on insurer notices and disclosures to consumers.

Deepfakes in Colorado

HB 24-1147, in effect since July 1, 2024, restricts undisclosed deepfakes of candidates close to an election and requires a set disclosure statement. SB 25-288 covers intimate digital depictions, with crimes at C.R.S. 18-7-107 to -109 and a civil claim whose remedies include the greater of actual damages or $150,000 in liquidated damages (C.R.S. 13-21-1506). Our Colorado deepfake laws guide covers both in detail.

AI Note-Takers and Recording in Colorado

AI meeting assistants raise recording-consent questions covered on our Colorado AI meeting recording page. The one AI-specific recording rule among the acts reviewed on this page is HB 26-1195's written notice and consent for therapy sessions, described above.

Other Colorado AI Bills and Government Use

Task force. HB 24-1468 reconstituted the AI impact task force at C.R.S. 2-3-1707, with 26 members, four of them legislators. The section is repealed effective September 1, 2027.

Bills that did not pass into law. As of November 4, 2026, the General Assembly's bill pages show these statuses:

• HB 26-1210, limiting the use of intimate personal data to make inferences about a person's financial position: Did Not Become Law.
• HB 25-1004, on algorithmic rent-setting devices: Did Not Become Law.
• HB 24-1057, on landlord algorithmic rent-setting: Lost.
• SB 25-318, a 2025 bill to amend the 2024 law: Lost.

We found no Colorado frontier-model safety statute. That search covered named bills and web results, not a full sweep of the session laws.

Federal AI Policy and Colorado

As of November 4, 2026, we found no federal statute in the public laws of the 119th Congress that sets general rules for private AI systems or generally preempts state AI laws. In December 2025, Executive Order 14365 directed federal agencies to challenge or discourage state AI laws the administration views as conflicting with national policy, and called for a federal framework from Congress. The order itself does not declare any state law invalid. See our pages on Trump's AI executive orders and state AI law preemption.

Executive Order 14365 refers to "a new Colorado law banning 'algorithmic discrimination'" without naming an act. The FTC's proposed policy statement names "Colorado's recently revised Artificial Intelligence Act" and says "the new version poses many of the same concerns." That is a proposed statement of the agency's views.

What Changes in Colorado AI Law in 2027

The 2027 regular session has not convened. As of November 4, 2026, we found no prefiled Colorado AI bill for 2027. That search covered bill pages we opened on leg.colorado.gov and web results, not a full-text sweep, so it does not prove none exists.

Open Questions Colorado Law Has Not Settled

• June 30 to December 31, 2026. We found no court ruling on how the 2024 duties, dated June 30, 2026, apply to decisions made before the repeal takes effect on January 1, 2027. We take no position beyond the wording above.
• Two sections numbered 6-1-1708. SB 26-189 and HB 26-1263 each enact a 6-1-1708. The Attorney General's interim draft refers to the chatbot section as 6-1-1710. Until the codifier publishes, we cite it as C.R.S. 6-1-1708 as enacted by HB 26-1263.
• Chatbot enforcement. HB 26-1263 and HB 26-1195's 6-1-1705.2 both sit in part 17, and SB 26-189 says a violation of part 17 is a deceptive trade practice. Neither of those two bills says how that applies to its new section. The Department of Law's regulatory analysis treats a chatbot violation as an unfair trade practice under the Consumer Protection Act and mentions district attorneys as well as the Attorney General. In SB 26-189, the exclusivity clause at 6-1-1706(1)(b) names only 6-1-1702 to 6-1-1705. But 6-1-1706(1)(a) says the Attorney General enforces part 17, and 6-1-1706(2)(b) sets aside Consumer Protection Act provisions inconsistent with exclusive Attorney General authority for a violation of part 17. We found no court ruling on how those provisions fit together.
• Reach of the order. ECF 24 covers SB 24-205 and legislation "replacing or amending" it enacted that session. It does not name HB 26-1263 or HB 26-1195, and we found nothing addressing whether it reaches them.
• Age estimation timing. In HB 26-1263, the sentence requiring age estimation carries no date of its own. The January 1, 2027 date attaches to the duties that follow it.
• A cross-reference. HB 26-1139 borrows its "artificial intelligence system" definition from C.R.S. 6-1-1701(2). After SB 26-189's reenactment, that subsection defines ADMT.
• Referendum petitions. HB 26-1263, HB 26-1139 and HB 26-1195 each carry a referendum clause. We have not confirmed whether any petition was filed. SB 26-189 has a safety clause instead.

More Colorado Laws

• Colorado Recording Laws
• Colorado Data Privacy Laws
• Colorado Surveillance Camera Laws
• Colorado Background Check Laws
• Colorado Whistleblower Laws
• Colorado Deepfake Laws
• Colorado AI Meeting Recording Laws

Frequently Asked Questions

Does Colorado have an AI law?

Yes. Colorado's main AI law is the ADMT Act (SB 26-189), signed May 14, 2026, and scheduled to take effect January 1, 2027. Colorado also has laws on chatbots, AI in health coverage, AI in psychotherapy, insurers' algorithms, and deepfakes, with different dates.

When does the Colorado AI Act take effect?

The rewritten law, SB 26-189, takes effect January 1, 2027, for consequential decisions made on or after that date. That date does not by itself open enforcement. A federal court order bars the Attorney General from starting enforcement for alleged violations that occurred or occur on or before 14 days after a ruling on xAI's expected preliminary injunction motion, and that end date is unknown.

Was the Colorado AI Act repealed?

SB 24-205 became law May 17, 2024, with developer and deployer duties dated June 30, 2026. SB 26-189, signed May 14, 2026, repeals and reenacts it, and under Section 5 of that act the repeal takes effect January 1, 2027. The rewritten law applies to decisions made on or after that date. We found nothing in either act that suspends the 2024 duties from June 30 to December 31, 2026, and a federal court order bars the Attorney General from starting enforcement for alleged violations through 14 days after a preliminary injunction ruling.

Did a court block the Colorado AI Act?

No court has ruled on the merits, and no injunction has been granted after a contested motion. On April 27, 2026, a magistrate judge entered an order on a stipulation that bars the Attorney General from starting enforcement for a defined period of alleged violations. The court made no finding on the law's validity.

Did the Justice Department sue Colorado over its AI law?

The Justice Department intervened in xAI's lawsuit against the Colorado Attorney General on April 24, 2026, relying on 42 U.S.C. 2000h-2 and pleading two Equal Protection counts. Its complaint does not mention the AI Litigation Task Force.

Who does the Colorado ADMT Act apply to?

It applies to persons doing business in Colorado that develop or deploy a covered ADMT, meaning technology used to materially influence a consequential decision in one of seven domains. The definitions set no revenue or headcount threshold. Exclusions and sector carve-outs apply, including for insurers subject to C.R.S. 10-3-1104.9 and HIPAA covered entities. The Colorado Department of Law's cover page to its October 2026 interim draft says the ADMT law does not apply to governments, which is the agency's reading, not a court ruling.

What does Colorado SB 26-189 require?

Developers give deployers documentation. Deployers give notice before use, explain an adverse outcome within 30 days, and on request offer a route to correct personal data and meaningful human review to the extent commercially reasonable. Both keep records for at least three years.

What are the penalties under the Colorado AI Act?

SB 26-189 states no dollar figure. A violation is a deceptive trade practice, and the Colorado Consumer Protection Act, as published in the 2025 C.R.S., sets a civil penalty of up to $20,000 per violation, or up to $50,000 where committed against an elderly person. The Attorney General enforces it, with a 60-day cure period where the Attorney General deems cure possible.

Can I sue a company under the Colorado AI Act?

SB 26-189 creates no new private right of action. It also does not limit existing rights, including claims under the Colorado Anti-Discrimination Act and the Consumer Protection Act.

Is there a NIST safe harbor in Colorado AI law?

Not in SB 26-189. A defense tied to a recognized AI risk-management framework appeared in SB 24-205. The rewritten law has no duty of reasonable care, risk program or impact assessment for such a defense to attach to, and compliance with it is not a defense to other law.

Has Colorado adopted rules for its AI law?

As of November 4, 2026, the Attorney General's page shows proposed rules (4 CCR 904-6) and an October 26, 2026 hearing, but no adoption. SB 26-189 requires disclosure and consumer-rights rules on or before January 1, 2027.

Does Colorado have a chatbot law?

Yes. HB 26-1263, the Chatbot Safety Act, requires operators of public conversational AI services to disclose that users are talking to AI, follow a suicide and self-harm protocol, and protect known minors, with duties from January 1, 2027. Annual reports to the Attorney General start on and after July 1, 2027. Many business and narrow-purpose tools are excluded.

Can a Colorado health insurer deny a claim using AI?

From January 1, 2027, unless a referendum petition was filed, HB 26-1139 says a carrier's medical necessity denial may not be issued solely on an AI system's output without review and approval by a licensed clinician, licensed physician, or other competent regulated professional. AI may still assist with utilization review.

Can a therapist use AI in Colorado?

HB 26-1195 allows AI for administrative and supplementary support if the provider reviews outputs. It bars AI from therapeutic communication without the provider's real-time involvement, and from generating treatment plans without provider review and approval. Recording or transcribing a session with AI needs written notice and consent. Certain wellness and FDA-authorized tools that do not diagnose or treat are carved out.

Does Colorado require bias audits of AI hiring tools?

SB 26-189 has no bias-audit requirement, and we found none for hiring tools in the other Colorado acts reviewed on this page, though that search was not a full sweep of Colorado law. The ADMT Act covers employment decisions from January 1, 2027, with notice, adverse-outcome and human-review duties rather than an audit.