Colorado AI law in flux: Comprehensive replacement bill signed after federal court blocks predecessor’s enforcement

Background: SB 205 and its troubled path to implementation

With SB 205, Colorado became the first state to enact comprehensive legislation regulating “algorithmic discrimination” in high-stakes automated decision-making. The law would have imposed extensive obligations on both developers and deployers of AI systems used in “consequential decisions,” such as those relating to education, employment, financial or lending services, healthcare, housing, and insurance. These obligations included requirements for impact assessments, risk management policies, detailed disclosures to the Colorado Attorney General’s Office, and consumer-facing transparency measures. The law would have also imposed a baseline requirement that any deployer or developer of an AI system intended to interact with consumers disclose that the consumer was interacting with AI regardless of whether a consequential decision was involved. The law faced persistent criticism since enactment from technology companies, business groups, and even some consumer advocates. Last year, the original effective date of February 1, 2026, was pushed back to June 30, 2026, after lawmakers failed to reach agreement on substantive amendments.

The xAI lawsuit and federal court intervention

On April 9, 2026, xAI filed suit in the District Court for the District of Colorado challenging SB 205 on multiple constitutional grounds. The DOJ filed a companion complaint on April 24, 2026, alleging that the law’s disclosure requirements constituted compelled speech, its algorithmic discrimination provisions imposed impermissible race- and sex-conscious obligations on developers and deployers, and its compliance framework was unduly burdensome. The DOJ’s intervention was consistent with the White House’s December 2025 executive order directing the attorney general to challenge state AI laws the administration viewed as inconsistent with its “minimally burdensome” framework.

On April 27, 2026, Magistrate Judge Cyrus Y. Chung granted a stipulated order sought by xAI and Colorado’s attorney general, providing that xAI would wait to file a comprehensive motion for preliminary injunction until the 28-day period following final adoption of rulemaking implementing SB 205 or any legislation (such as SB 189) that replaced it. In turn, the attorney general would not initiate enforcement of SB 205 or investigate alleged violations of the law until 14 days after the court issues a ruling on xAI’s motion for a preliminary injunction.

SB 189: The replacement framework

Introduced on May 1, 2026, SB 189 represents Colorado’s reworking of its AI regulatory framework. SB 189 repeals and reenacts SB 205 with a fundamentally different regulatory approach. Key modifications include:

• Shift from comprehensive assessment to notice-based requirements. SB 189 eliminates requirements for developers and deployers of AI systems to conduct detailed impact assessments and submit disclosures to the attorney general’s office, instead ensuring consumers are informed when AI or automated decision-making technology (ADMT) is used to make a consequential decision.
• Elimination of the algorithmic discrimination framework. Under SB 205, companies had an affirmative obligation to prevent their AI systems from producing discriminatory results. SB 189 imposes a purely notice-and-disclosure regime rather than a substantive anti-discrimination obligation.
• Developer obligations. ADMT developers that used to “materially influence” consequential decisions must still provide deployers with technical documentation describing the system’s intended uses, categories of training data, limitations, and instructions for appropriate use and human review. Developers must also notify deployers of material updates or modifications. However, SB 205’s requirements for evaluation methodology, data governance measures, mitigation strategies, and discrimination-risk disclosures are eliminated.
• Streamlined consumer notice and appeal rights. SB 189 retains SB 205’s core consumer-facing protections, including notice at the point of interaction, post-adverse-outcome explanation, data correction, and human review, but simplifies the deployer’s disclosure obligations. For example, deployers must provide a plain-language description of the ADMT’s role within 30 days of an adverse outcome, rather than the more granular disclosures SB 205 required regarding the degree of AI contribution, principal reasons, and data sources.
• Narrowed scope of AI-interaction disclosure. SB 205 required disclosure whenever a consumer interacted with any AI system, regardless of whether a consequential decision was involved. SB 189 has no equivalent general-purpose disclosure obligation, and its notice requirements apply only to ADMT used in consequential decisions.
• Revised liability framework. SB 189 adopts a fault-allocation liability model between developers and deployers of AI systems based on whether the ADMT was used for its intended purpose and whether the developer provided adequate documentation. The bill prohibits joint and several liability and contractual indemnification provisions that shift liability inconsistent with this allocation.
• Limited notice-and-cure period for violations. SB 189 includes a 60-day notice-and-cure provision, which will sunset after three years from the law’s effective date, requiring the attorney general to provide developers and deployers of AI systems with an opportunity to remedy alleged violations before initiating enforcement.
• Delayed effective date. SB 189 pushes the law’s effective date to January 1, 2027, with the attorney general required to complete implementing rulemaking by that date.

What’s next

The convergence of the federal lawsuit, the court-ordered enforcement delay, and the passing of SB 189 create a window of complicated regulatory risk for businesses operating in Colorado – and the future remains uncertain. Both xAI and the DOJ are expected to challenge SB 189 as well. Developers and deployers of AI systems should consider the following steps:

• Monitor potential amendments closely. Lawmakers had less than two weeks to move SB 189 through both chambers, and stakeholders across the board maintain grievances. Businesses should track what amendments may be adopted and whether concepts from the now-defunct SB 205 reappear.
• Assess compliance posture under a new framework. The shift to a notice-based model substantially reduces the compliance burden, but SB 189 still requires consumer-facing notice mechanisms, adverse-outcome disclosure processes, and human review procedures.
• Track the federal litigation. The constitutional arguments raised by xAI and the DOJ, particularly the First Amendment compelled-speech claims and the Equal Protection challenges, could have significant implications beyond Colorado for other state AI regulatory efforts. If these challenges continue, a ruling striking down portions of SB 189 on constitutional grounds could reshape the permissible scope of state AI regulation nationwide.
• Prepare for a January 2027 compliance deadline. Organizations need to build or adapt notice-and-disclosure systems, consumer appeal mechanisms, and recordkeeping processes by January 1, 2027.

Our team is closely monitoring AI regulation developments. Reach out to one of the authors or your regular firm contact to discuss the potential legal implications of these developments for your business.