For two years, the Colorado AI Act was the US law that AI governance teams planned around. It was the first broad state statute aimed at high-risk AI used in consequential decisions such as hiring, lending and housing. Many companies built programmes around its risk management and impact assessment requirements. In 2026 the ground moved.
This is an architect's summary of public commentary, not legal advice. Confirm current obligations with counsel.
What happened
| When | Event |
|---|---|
| 2024 | SB 24-205 enacted, originally effective February 2026, requiring deployers of high-risk AI to adopt risk management programmes, run impact assessments and notify consumers1 |
| Aug 2025 | A special-session bill delayed the effective date to 30 June 202612 |
| Apr 2026 | A federal court blocked enforcement after a constitutional challenge, with the US Department of Justice intervening in support of the challenge3 |
| May 2026 | SB 26-189 enacted, repealing and reenacting the framework with a narrower, notice-based approach effective 1 January 202734 |
What the new law looks like
Commentary describes SB 26-189 as built around automated decision-making technology used in consequential decisions, including employment decisions about Colorado applicants and employees4. The headline change is what it no longer requires: covered employers no longer need risk management programmes or annual impact assessments. Instead, the law focuses on notice and disclosure, specific consumer rights and record retention, with duties split between developers and deployers45. The Attorney General is to adopt implementing rules before it takes effect, so operational details may still change4.
Regulation can lighten. Customer expectations rarely do. Enterprise buyers will keep asking how your AI makes decisions about people, whatever Colorado requires.
The broader lesson
Colorado's path mirrors what has happened elsewhere. The EU delayed parts of its AI Act through the Digital Omnibus. US federal health IT rules proposed removing AI transparency requirements, as covered in HTI-1 to HTI-5. Requirements are moving in different directions in different places, and quickly.
Building a compliance programme around one statute's exact wording is fragile in that environment. Building core governance capabilities that map to several regimes is robust.
What I'd build regardless
- An inventory of automated decisions about people: which systems influence hiring, credit, pricing, eligibility or access, and how much weight the AI carries.
- Notices generated from the inventory, so disclosures stay accurate as systems change. Notice is the obligation that survived in Colorado, and it is common elsewhere.
- Records that can answer "why": inputs, model versions and outputs for consequential decisions, retained for a defined period, using the logging in LLM observability.
- A route for people to contest decisions and reach a human.
- Testing for bias and quality before release and on a schedule, even where no longer mandated, because it is what customers and courts will ask about. See evaluating AI agents.
- A framework to map against, such as those compared in ISO 42001 and the NIST AI RMF, so new state laws become a mapping exercise rather than a new programme.
For companies selling into the US from the Gulf or Europe
For companies selling from the UAE or Europe into US enterprises, the practical answer is one governance core, evidenced well, then mapped to each market: the EU AI Act, US state laws as they settle, and Gulf rules such as DIFC Regulation 10. That's cheaper than chasing each statute separately, and it survives the next reset.
How I can help
I help AI companies build governance into their products and platforms, so changing laws mean updated mappings, not rebuilt programmes. As a fractional CTO I can own that work. Or analyse your challenge and bring the result to a call.
- 1Colorado delays comprehensive AI law with further changes anticipatedGreenberg Traurig · Sep 2025
- 2
- 3
- 4Inside Colorado's Senate Bill 26-189: impacts and implications for employersEpstein Becker Green · 2026
- 5