Colorado narrows its AI law as the FTC signals a new federal approach

Colorado has significantly narrowed what was set to become the nation’s first comprehensive AI governance law. On May 14, 2026, Governor Jared Polis signed Senate Bill 26-189 (SB 26-189), repealing and replacing the Colorado Artificial Intelligence Act (SB 24-205) before it took effect with a more streamlined framework focused on transparency, consumer rights, and targeted obligations for developers and deployers of automated decision-making technology (ADMT).

Shortly after enactment, the Federal Trade Commission (FTC) issued a proposed policy statement questioning whether state AI laws – including Colorado’s – may conflict with federal law. Although not binding, the proposal underscores the increasingly complex AI regulatory landscape, with FTC comments due July 31, 2026.

This alert summarizes the key changes under SB 26-189 and their practical implications for businesses.

Background: Colorado reconsiders its landmark AI law

When Colorado enacted SB 24-205 in 2024, it became the first state to adopt a comprehensive AI law regulating developers (companies that develop high-risk AI systems) and deployers (companies that use those systems to make consequential decisions, such as those affecting employment, education, housing, credit, insurance, healthcare, and essential government services (consequential decisions). The law imposed substantial obligations – from technical documentation and risk management to impact assessments, consumer notices, and reasonable care – to prevent algorithmic discrimination. Before those requirements took effect, however, concerns about the compliance burden prompted the legislature to repeal and replace the act with SB 26-189.

While SB 26-189 is scheduled to take effect on January 1, 2027, enforcement remains on hold pending completion of the state attorney general’s rulemaking process and resolution of ongoing constitutional litigation.

What changed under SB 26-189?

SB 26-189 retains Colorado’s regulation of ADMT used in consequential decisions but significantly narrows the original law’s compliance framework. Rather than requiring organizations to proactively identify and mitigate AI risks, the revised law shifts toward a more disclosure-driven approach centered on transparency, consumer rights, and targeted obligations for developers and deployers.

What counts as ADMT and a consequential decision?

ADMT is any technology that processes personal data to produce outputs like predictions, scores, rankings, or recommendations used to make or shape a decision about a person, a definition that reaches well beyond systems typically labeled as AI. The law excludes everyday infrastructure (e.g., antivirus software, firewalls, databases, spellcheckers, and ordinary spreadsheets that don’t use machine learning); tools individuals use to summarize, draft, or organize information for human review; and consumer-facing chatbots that aren’t marketed or configured for use in consequential decisions.

A consequential decision is one that meaningfully affects a person’s access to, eligibility for, or compensation in a covered domain, such as employment, housing, lending, insurance, healthcare, education, and essential government services, including through pricing or other material terms. Excluded are routine, low-stakes processes (e.g., scheduling, administrative routing, and customer service triage), advertising and marketing, tools that organize information for human review without swaying the outcome, and technologies used for cybersecurity, fraud prevention, and financial-crime compliance.

If a system uses personal data to generate a score, prediction, or recommendation that meaningfully influences a significant decision about someone’s job, housing, credit, insurance, healthcare, education, or benefits, it’s likely covered. Back-office plumbing and human-review aids are not.

Other significant changes include:

• Elimination of risk-management requirements: The revised law removes the original statute’s most burdensome obligations, including written risk-management policies, impact assessments, and periodic reviews. Instead, the law focuses on consumer notice and transparency surrounding the use of covered ADMT.
• Narrower developer obligations and revised liability framework: Developers must continue providing technical documentation to deployers, but the required disclosures are more limited than under SB 24-205. The law also clarifies that existing Colorado anti-discrimination laws govern discriminatory uses of ADMT, apportions liability based on relative fault, and provides developers with protections where deployers use ADMT outside the developer’s intended or disclosed uses.
• Minimal changes to enforcement: SB 26-189 does not create a private right of action. Enforcement remains with the state attorney general under the Colorado Consumer Protection Act, and, through January 1, 2030, the attorney general generally must provide developers and deployers with 60 days’ notice and an opportunity to cure most alleged violations before initiating an enforcement action.

What does it mean for developers and deployers?

Although SB 26-189 narrows Colorado’s original AI law, companies developing or deploying covered ADMT should continue AI governance efforts focused on transparency, consumer rights, and documentation.

• Developers: Compliance for developers centers on providing deployers with sufficient technical documentation regarding a system’s intended uses, known limitations, appropriate human oversight, and material updates. While the revised law narrows these documentation requirements, they remain an important mechanism for allocating responsibility between developers and deployers and may help limit developer liability where systems are used in unintended ways.
• Deployers: The most significant changes for deployers relate to consumer-facing obligations. Organizations using covered ADMT must provide clear notice when consumers interact with covered systems and, following an adverse consequential decision, provide an explanation of the technology’s role, along with an opportunity for meaningful human review. Consumers also gain rights to access and correct personal data used in covered decisions.

Organizations should assess whether they use covered ADMT in employment or other consequential decisions involving education, housing, lending, insurance, healthcare, or essential government services. Those within the law’s scope should prepare the required notice, documentation, and human-review processes before the January 1, 2027, effective date.

Implementation timeline and ongoing litigation

SB 26-189 takes effect January 1, 2027, although implementation remains in flux pending attorney general rulemaking and ongoing constitutional litigation. The forthcoming regulations are expected to clarify key provisions, including when ADMT materially influences a consequential decision and the required content of consumer disclosures. In a pending federal lawsuit challenging the statute, the state attorney general has agreed not to enforce SB 24-205 or SB 26-189 until after completion of the rulemaking process and resolution of a preliminary injunction motion. Companies should nevertheless continue preparing for compliance while monitoring both developments.

The FTC raises new questions for state AI laws

Just weeks after Colorado enacted SB 26-189, the FTC issued its proposed Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems, expressing concern that certain state AI laws – including Colorado’s – could create deception concerns under Section 5 of the FTC Act. Although the proposal would not preempt Colorado law or alter existing compliance obligations, it highlights the growing tension between state AI regulation and federal consumer protection law. The FTC is accepting public comments through July 31, 2026.

Key takeaways

Despite the narrowing of Colorado’s law and the federal uncertainty overlaying it, the case for continued investment in AI governance remains strong. Companies should consider the following near-term steps:

• Inventory your ADMT. Identify AI and other automated decision-making tools used in covered areas, as the law applies beyond systems traditionally labeled as AI.
• Prioritize employment decision-making. Because the term “consumer” includes employees and applicants, and because employment is where Colorado overlaps with other state regimes, hiring and workforce tools warrant attention regardless of industry.
• Prepare notice and review processes. Develop processes for notifying consumers when covered ADMT is used to make a consequential decision, explaining adverse decisions, and providing meaningful human review where required.
• Document intended and inappropriate uses. For developers in particular, thorough documentation is the key to the statute’s liability shield and to explaining any output changes as legitimate, rather than evasive.
• Monitor state rulemaking efforts. Key terms will be defined by attorney general rules due before January 1, 2027; companies with significant exposure should track the formal proceeding and any further comment opportunities.

Conclusion

SB 26-189 represents a significant shift in Colorado’s AI governance framework with a narrower, disclosure-driven model, but ongoing rulemaking, constitutional litigation, and evolving FTC guidance leave the regulatory landscape unsettled. Companies should continue building practical AI governance programs now, so they are well positioned to adapt as Colorado’s framework – and the broader regulatory environment – continues to evolve.

If you have questions about Colorado’s revised AI law or developing an AI governance strategy, please contact any of the authors or your regular McDermott Will & Schulte lawyer.