Colorado Amends AI Regulation Law, Substantially Reducing Employer Obligations

Colorado's governor signed S.B. 26-189 on May 18, 2026, amending the Colorado AI Act to take effect January 1, 2027. The law eliminates impact assessments, risk management policy, and annual reviews requirements for employers. Violations constitute unfair trade practices carrying civil penalties of $20,000 per violation. Only the Colorado attorney general can enforce the Act.

Colorado AI law amendment

• ▪The Colorado AI Act eliminates the requirement from Colorado's previous artificial intelligence law that employers provide notice when interacting with an AI system
• ▪The Colorado General Assembly passed S.B. 26-189 one day before the end of the 2026 legislative session
• ▪The Colorado AI Act eliminates the requirement from Colorado's previous artificial intelligence law that employers implement a risk management policy and program
• ▪The Colorado AI Act (S.B. 26-189) will go into effect on January 1, 2027
• ▪The Colorado AI Act eliminates the requirement from Colorado's previous artificial intelligence law that employers conduct impact assessments
• ▪The Colorado AI Act eliminates the requirement from Colorado's previous artificial intelligence law that employers post or update privacy policies to describe the use of AI tools
• ▪Colorado's governor signed S.B. 26-189 less than two months before the previously enacted Colorado AI law was due to go into effect on June 30, 2026
• ▪The Colorado AI Act (S.B. 26-189) is based closely on the bill proposed by the governor's AI Policy Working Group
• ▪Colorado's governor signed an amendment (S.B. 26-189) to Colorado's artificial intelligence law on May 18, 2026
• ▪The Colorado AI Act eliminates the requirement from Colorado's previous artificial intelligence law that employers report findings of discriminatory outcomes to the Colorado attorney general
• ▪S.B. 26-189 substantially reduces the compliance burden on employers compared to Colorado's previously enacted artificial intelligence law

Employer compliance requirements

• ▪The Colorado AI Act requires employers to retain records about the use of covered automated decision-making technology for three years
• ▪The Colorado attorney general is required to promulgate implementing regulations for the Colorado AI Act by January 1, 2027
• ▪The Colorado AI Act requires employers to implement an adverse action process including notice, a right to correct, and a right to meaningful human review
• ▪Under the Colorado AI Act, a link or post that is reasonably proximate to the interaction or transaction in which a consequential decision may occur is one example of clear and conspicuous notice
• ▪The Colorado AI Act requires employers to provide pre-use notice before using automated decision-making technology to materially influence consequential employment decisions

Covered technology scope

• ▪The Colorado AI Act explicitly excludes calculators, databases, and spreadsheets that require human analysis from the definition of automated decision-making technology
• ▪The Colorado AI Act does not apply to decisions about independent contractors or to applicants and employees who are not residents of Colorado

Adverse action procedures

• ▪Under the Colorado AI Act, within 30 days of making an adverse decision materially influenced by covered automated decision-making technology output, the employer must provide a notice

Enforcement mechanisms

• ▪Violations of the Colorado AI Act constitute unfair and deceptive trade practices, which carry potential civil penalties of up to $20,000 for each violation