Colorado AI Act: Compliance Gaps to Close

Colorado’s AI law has changed. If your organization built its compliance plan around the original Colorado AI Act, some of that work may need a second look.

The issue isn’t that AI governance suddenly matters less. It’s that Colorado has changed how it defines the technology, assigns responsibilities, and protects people affected by automated decisions.

In May 2026, Colorado enacted Senate Bill 26-189, replacing the original framework established by SB 24-205. The new Automated Decision-Making Technology Act is scheduled to take effect January 1, 2027.

For organizations using AI in hiring, lending, healthcare, insurance, housing, education, or public services, this creates an important question:

Can you explain how automated technology influences decisions about people, what personal data it uses, and who can review the outcome?

That’s the gap this article explores. We’ll look at what changed, which requirements matter, and where organizations can strengthen their governance programs before the new framework takes effect.

What Is the Colorado AI Act?

The Colorado AI Act commonly refers to Senate Bill 24-205, enacted in 2024 to address algorithmic discrimination involving high-risk artificial intelligence systems.

The original law established requirements involving reasonable care, risk management, impact assessments, developer documentation, consumer disclosures, and other protections related to consequential decisions.

However, Colorado subsequently changed that framework.

In May 2026, lawmakers enacted SB 26-189, which repeals and reenacts the original provisions with a different regulatory structure.

The replacement legislation is known as the Automated Decision-Making Technology Act. Its substantive requirements are scheduled to begin January 1, 2027.

The distinction matters because organizations researching the Colorado AI Act may still encounter compliance guides describing requirements from SB 24-205 as though they remain the future standard.

For forward-looking compliance planning, organizations should evaluate SB 26-189 rather than relying exclusively on the original SB 24-205 framework.

BigID’s Global AI Regulation Tracker provides a broader view of AI legislation across jurisdictions.

What Changed Under Colorado SB 26-189?

The new law shifts the regulatory focus from the original high-risk AI framework toward automated decision-making technology used to materially influence consequential decisions.

That changes how organizations should evaluate scope, technical documentation, consumer protections, and operational readiness.

When Does the Colorado AI Act Take Effect?

The replacement Automated Decision-Making Technology Act is scheduled to take effect January 1, 2027.

Colorado’s original SB 24-205 framework had previously been delayed, including through SB 25B-004, before lawmakers adopted the replacement legislation in 2026.

As of October 2026, the Colorado Attorney General is also working through rulemaking related to automated decision-making technology.

Organizations should monitor the final rules because they may clarify how certain disclosure and other statutory requirements must be implemented.

The practical priority is to identify covered decision-making workflows and determine what evidence, documentation, and consumer-facing processes will be needed.

Which AI Systems Fall Under Colorado’s New Law?

SB 26-189 defines automated decision-making technology, or ADMT, broadly enough to include technology that processes personal data and uses computation to generate predictions, recommendations, classifications, rankings, scores, or other information used to make, guide, or assist decisions concerning individuals.

However, the law’s core developer and deployer obligations focus on covered ADMT used to materially influence consequential decisions.

Consequential decisions include decisions involving access to, eligibility for, or compensation related to:

• Employment
• Education
• Housing
• Financial and lending services
• Insurance
• Healthcare services
• Essential government services and public benefits

Not every AI feature or automated workflow necessarily falls within the same requirements. Organizations need to examine the technology’s role, the decision involved, and applicable statutory definitions and exemptions.

For example, a system that helps summarize internal meeting notes presents a different regulatory question from a system that ranks job applicants or materially influences loan eligibility.

The important question is not simply whether an organization uses AI. It’s whether automated technology materially influences a covered decision about an individual.

What Must Developers and Deployers Do?

Colorado distinguishes between organizations that develop covered automated decision-making technology and organizations that deploy it.

A company may occupy either role or both, depending on how it develops, modifies, provides, or uses the technology.

Five Compliance Gaps Organizations Often Miss

Most organizations already have some combination of AI policies, vendor reviews, data inventories, and security controls.

The problem is that those processes don’t always connect to the decisions AI helps make.

That disconnect can become particularly important under Colorado’s new framework.

How a Hiring Algorithm Exposes the Gap

Consider an employer using an automated system to rank job applicants.

The vendor has completed security reviews. The application appears in the organization’s AI inventory. Hiring managers understand that the system produces candidate scores.

But an applicant receives an adverse decision and requests information about how automated technology influenced the outcome.

Now several questions become urgent:

• Did the technology materially influence the employment decision?
• Which personal data contributed to the recommendation or score?
• Was the applicant given the applicable notice?
• Can the organization explain the technology’s role in the decision?
• Can inaccurate personal data be identified and corrected?
• Who can conduct a meaningful human review?
• What documentation supports the organization’s response?

The organization may have approved the technology without establishing a complete process for answering those questions.

That doesn’t automatically mean the organization violated the law. But it reveals the difference between managing an AI application and governing the decisions it influences.

Approval establishes that a system can be used. Governance needs to explain how it is used and what happens when someone challenges the outcome.

What Consumer Rights Does Colorado Establish?

SB 26-189 introduces consumer protections connected to covered automated decision-making technology.

For deployers, these protections include applicable notices when covered technology is used to materially influence consequential decisions.

When a covered automated decision results in an adverse outcome, the law also requires a plain-language description of the technology’s role within 30 days, subject to the statute and implementing rules.

Consumers also have rights involving requests for personal data, correction of factually inaccurate information, and meaningful human review and reconsideration following certain adverse outcomes.

These requirements raise practical questions about how organizations manage personal information throughout automated decision-making processes.

For example, correcting inaccurate data is more difficult when teams cannot identify where the information originated, which systems processed it, or how it influenced a particular workflow.

Similarly, meaningful human review becomes harder when decision owners lack access to relevant documentation and data context.

Consumer rights are operational requirements. Organizations need processes that can support them, not simply policies acknowledging that they exist.

What Are the Enforcement Risks?

The Colorado Attorney General is responsible for enforcing the Automated Decision-Making Technology Act through the Colorado Consumer Protection Act.

Violations are treated as deceptive trade practices under the applicable statutory framework.

Before initiating an enforcement action prior to January 1, 2030, the Attorney General must provide a 60-day notice and opportunity to cure an alleged violation when a cure is considered possible.

The law does not establish a new private right of action. However, it also addresses how responsibility may be allocated between developers and deployers in civil actions alleging unlawful discrimination under existing law.

For organizations, this reinforces the value of maintaining records that demonstrate which systems were used, what controls applied, and how relevant concerns were addressed.

How Should Organizations Prepare for January 2027?

Rather than rebuilding an AI governance program around another standalone checklist, organizations can start by connecting existing technology, data, and compliance processes to consequential decisions.

How BigID Helps Operationalize AI Governance

Colorado’s evolving requirements highlight a broader enterprise challenge: governance teams need to understand automated technology in the context of the data it uses and the business decisions it supports.

BigID helps organizations build that foundation by connecting AI discovery, sensitive data intelligence, identity and access context, lineage, and risk.

• AI discovery: Identify AI assets, models, applications, agents, and shadow AI across enterprise environments.
• Sensitive data discovery: Find and classify personal and regulated information that may be used by automated systems.
• Data lineage: Understand where relevant information originates and how it moves through connected environments.
• AI access governance: Investigate access relationships involving people, service accounts, applications, and AI identities.
• AI risk management: Connect sensitivity, access, business context, and policy to identify and prioritize potential exposure.
• Governance evidence: Support assessments, ownership, oversight, and documentation needed for regulatory readiness.

These capabilities can help security, privacy, data, and AI governance teams investigate relevant data risks and support the controls surrounding automated decision-making.

BigID does not independently determine whether a decision complies with Colorado law or replace the human review processes required of covered organizations. Its value is helping teams understand and govern the enterprise data and access relationships underneath their AI programs.

Why Colorado AI Compliance Shouldn’t Be a Silo

Colorado is part of a broader regulatory shift toward greater accountability for AI and automated decision-making.

Organizations operating across multiple jurisdictions may face different requirements involving disclosures, consequential decisions, risk management, human oversight, data protection, and regulatory evidence.

Maintaining separate inventories and governance processes for each law can create duplication and inconsistent visibility.

A more sustainable approach is to establish a shared understanding of AI systems, personal data, identities, business purpose, decision workflows, and risk, then map jurisdiction-specific obligations to that foundation.

BigID’s Global AI Regulation Tracker helps organizations explore the changing AI regulatory landscape across U.S. states and international jurisdictions.

Colorado AI Act: Frequently Asked Questions

Is the original Colorado AI Act still the current compliance framework?

Colorado enacted SB 26-189 in May 2026, repealing and reenacting the original SB 24-205 provisions with a replacement Automated Decision-Making Technology Act. Organizations preparing for future obligations should review the new legislation and implementing rules rather than relying only on older SB 24-205 guidance.

When does Colorado’s new AI law take effect?

The substantive requirements of Colorado’s Automated Decision-Making Technology Act are scheduled to take effect January 1, 2027. The Colorado Attorney General is responsible for implementing rulemaking under the replacement framework.

What is automated decision-making technology under Colorado law?

SB 26-189 defines automated decision-making technology as technology that processes personal data and uses computation to generate information such as predictions, recommendations, rankings, classifications, or scores used to make, guide, or assist decisions concerning individuals. Core obligations focus on covered technology that materially influences consequential decisions.

Which decisions are considered consequential?

Consequential decisions include decisions involving access to, eligibility for, or compensation related to employment, education, housing, financial and lending services, insurance, healthcare services, and essential government services or public benefits.

Does Colorado require every company using AI to conduct an impact assessment?

The replacement law does not simply carry forward the original SB 24-205 impact-assessment framework as a universal requirement for every organization using AI. Organizations should evaluate the specific duties under SB 26-189, their developer or deployer role, applicable exemptions, and implementing rules. Risk assessments can remain valuable governance practices even when not expressly required for a particular use.

What rights do consumers have under the new Colorado law?

For covered automated decision-making technology, the law establishes applicable notice and explanation requirements, rights involving requests for personal data and correction of factually inaccurate data, and meaningful human review and reconsideration following certain adverse consequential decisions.

What records must developers and deployers maintain?

SB 26-189 requires developers and deployers to retain records necessary to demonstrate compliance with applicable requirements for at least three years. Organizations should determine which technical documentation, notices, requests, decisions, and other evidence are relevant to their obligations.

How does BigID support Colorado AI compliance readiness?

BigID helps organizations discover AI assets, identify and classify sensitive data, understand lineage and access relationships, assess data-related AI risk, and support governance documentation. These capabilities help teams operationalize AI security and governance, but they do not independently establish legal compliance.

Sources and Further Reading

• Colorado General Assembly: SB 26-189 Automated Decision-Making Technology
• Colorado General Assembly: SB 24-205 Consumer Protections for Artificial Intelligence
• Colorado Attorney General: Automated Decision-Making Technology Rulemaking
• BigID Global AI Regulation Tracker

This article provides general educational information and does not constitute legal advice. Organizations should consult qualified counsel regarding the applicability of Colorado law to their activities. Regulatory requirements and implementing rules may change.

Author

Lonnie Ross

Digital Experience Marketing Lead

Lonnie is the Digital Experience Marketing Lead at BigID, bringing over a decade of SEO and digital marketing expertise across B2C and B2B businesses in SaaS and eCommerce. Having worked both in tech and on the agency side, Lonnie combines a strong foundation in search strategy, UX, and content development with a passion for the evolving landscape of data protection. From aligning content with search intent to sharpening brand voice, Lonnie ensures that organizations not only stand out in a competitive SaaS market but also build trust through thought leadership on critical issues like compliance, data risk, and responsible innovation.