For two years, Colorado's Senate Bill 24-205 was the reference point for US state AI regulation. It was the law cited in vendor pitches, quoted in compliance checklists, and used as the template other states were measured against.
It has been repealed.
On 14 May 2026, Colorado's governor signed Senate Bill 26-189, the Automated Decision-Making Technology Act. The General Assembly's own bill record describes it plainly: the act repeals and reenacts the provisions of the 2024 law with new requirements. The official status line reads "Became Law."
This matters beyond Colorado, because a great deal of published guidance — including material written by people who are usually careful — still describes SB 24-205 as the operative law. If your AI compliance plan was built against it, that plan is now aimed at a statute that no longer exists.
Why two different dates are circulating
Search for the effective date and you will find two answers: 12 August 2026 and 1 January 2027. Neither source is wrong. They are describing different things, and the difference decides what you have to do this month.
| Date | What happens |
|---|---|
| 12 August 2026 | The act takes effect. Colorado legislation without a safety clause takes effect 90 days after the General Assembly adjourns, and it adjourned on 13 May 2026. |
| 1 January 2027 | The substantive duties apply — developer technical documentation, consumer notification, and the related obligations on deployers. |
| 1 January 2027 | The Attorney General must have adopted implementing rules by this date. |
| 1 January 2030 | The cure period runs to here — an opportunity to fix a violation before enforcement, and one that expires. |
For planning purposes, 1 January 2027 is the date that matters. An act being "in effect" while its duties have not yet attached is ordinary legislative drafting, not a loophole — it gives the Attorney General a window to write rules and gives regulated organisations a runway.
Be careful with anything that reports only one of these dates. A checklist saying "compliance required 12 August 2026" is overstating your immediate obligation. One saying "the law does not exist until 2027" is understating the position — the act is law from August, and the rulemaking that shapes your obligations begins under it.
What changed in substance
The subject is no longer "artificial intelligence"
The most consequential change is the vocabulary. The 2024 law regulated "artificial intelligence systems." The replacement regulates automated decision-making technology used in consequential decisions.
That is not cosmetic. A scoring rule, a ranking algorithm or a threshold model may be automated decision-making technology whether or not anyone in your organisation calls it AI. Teams that inventoried "our AI systems" may have inventoried the wrong set. If your inventory was assembled by asking which tools use machine learning, it is worth redoing by asking a different question: which systems participate in decisions that materially affect someone?
Duties attach along the supply chain
The structure separates those who build the technology from those who use it, and gives each a different job:
- Developers must provide technical documentation to the organisations deploying their systems. A deployer cannot explain a decision it has no information about, so this is the obligation the rest depends on.
- Deployers carry the consumer-facing duties: notice before a consequential decision is made, and an explanation afterwards when the outcome is adverse.
If you deploy someone else's model, your ability to comply is limited by what your vendor gives you. That makes vendor documentation a contracting question, not just a technical one, and it is the single most useful thing to start on now — well before January 2027.
Enforcement runs through the Attorney General
The Attorney General adopts the implementing rules and enforces the act, with the cure period running through 1 January 2030. There is no private right of action reported in the bill record; that is a meaningful difference from statutes that expose organisations to consumer litigation, and worth confirming in the enrolled text if it bears on your risk assessment.
What to verify before you rely on any of this
This article is written from the Colorado General Assembly's bill record and summary. That is an authoritative source for the status, the dates and the shape of the obligations. It is not a substitute for the enrolled text, and three things in particular should be read there rather than taken from any summary — including this one:
- The definition of "consequential decision". Scope is decided here. Whether your use is covered turns on this definition and nothing else.
- The exemptions and thresholds. Most statutes of this kind carve out small deployers, certain sectors, or specific uses. Whether you are in scope at all may be settled by a paragraph no summary reproduces.
- The precise content of the notice and explanation duties. "Provide an explanation" is a phrase that can mean very different amounts of work.
And watch for the Attorney General's rulemaking through 2026. Until those rules exist, the operational detail of compliance is genuinely not settled, and anyone selling you a finished Colorado compliance package is selling you their guess at it.
A practical sequence between now and January 2027
- Re-inventory against the new definition. Ask which systems take part in consequential decisions, not which ones use machine learning. Expect the list to differ from your AI inventory.
- Find out which of those you built and which you bought. Your obligations split along that line.
- Ask your vendors for the documentation now. If a vendor cannot say what its system does, on what data, with what known limitations, that is a procurement finding today and a compliance failure in January 2027.
- Draft the consumer notice and the adverse-outcome explanation. Writing them reveals quickly whether you can actually explain your own decisions.
- Assign a named owner. Not a committee in the abstract — a person who is answerable for this before the date arrives.
- Track the rulemaking rather than treating the current text as final.
The wider lesson
The repeal of SB 24-205 is a useful reminder about the state of AI regulation generally: it is moving fast enough that "when was this written?" is a more important question about a compliance resource than "who wrote it?"
A well-researched article about the Colorado AI Act published in early 2026 was accurate then and is misleading now, and nothing about the page says so. That is why every guide on this site carries a last-verified date rather than only a publication date, and why we mark superseded material as superseded rather than deleting it.
If you are relying on an AI compliance resource that carries no date, or one whose date is more than a few months old, treat its conclusions as a starting point for verification rather than as an answer.