Governance, risk & compliance

Colorado Automated Decision-Making Technology Act (SB 26-189, replacing SB 24-205) SB 26-189 signed 14 May 2026; effective 1 Jan 2027

Colorado replaced its first artificial intelligence statute before it took effect.

SB 24-205 (the Colorado AI Act of 2024) had its start date moved from 1 February 2026 to 30 June 2026 and was then repealed and reenacted by SB 26-189, the Automated Decision-Making Technology Act, which law firm alerts report was signed on 14 May 2026 and takes effect on 1 January 2027. The new law drops the duty of reasonable care to prevent algorithmic discrimination, the deployer risk management program, the annual impact assessment and the self-report to the Attorney General.

It keeps two roles. A developer builds, sells, licenses or substantially modifies a covered automated decision-making technology and must give deployers documentation (intended and known harmful uses, categories of training data, known limitations, and instructions for human review) and tell them about material updates.

A deployer uses it to materially influence a consequential decision about a Colorado resident in education, employment, housing, financial services, insurance, health care or essential government services, and must give notice before use, explain an adverse outcome within 30 days, and offer access, correction and human review. Both roles keep records for three years.

The Attorney General alone enforces the law as a deceptive trade practice, with no private right of action and a 60-day cure period that ends on 1 January 2030, and must adopt rules before 1 January 2027. Proposed rules were filed on 11 August 2026, interim draft rules were released on 6 October 2026 and a hearing is set for 26 October 2026, so the rule references in this framework are to drafts that may change.

A federal case, X. AI LLC v.

Weiser (D. Colo.

, No. 1:26-cv-01515), was filed on 9 April 2026 and the United States intervened on 24 April 2026; a stipulated order of 27 April 2026 is reported to bar enforcement of SB 24-205 or its replacement until 14 days after a ruling on a planned preliminary injunction motion, and no ruling had been reported when this pack was written.

The text of SB 26-189 itself could not be read (the General Assembly website blocks automated reading), so the duties here come from law firm alerts and from the Attorney General's interim draft rules, whose rule numbers are cited as printed. The sister Chatbot Safety Act (HB 26-1263) is covered in US_STATE_AI.

Choose the DEVELOPER tier if you build, sell, license or substantially modify the technology, the DEPLOYER tier if you use it in decisions about people, or both. General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Colorado Automated Decision-Making Technology Act (SB 26-189, replacing SB 24-205) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Colorado Automated Decision-Making Technology Act (SB 26-189, replacing SB 24-205) compliance

Most of Colorado Automated Decision-Making Technology Act (SB 26-189, replacing SB 24-205) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Colorado Automated Decision-Making Technology Act (SB 26-189, replacing SB 24-205), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Colorado Automated Decision-Making Technology Act (SB 26-189, replacing SB 24-205) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Colorado Automated Decision-Making Technology Act (SB 26-189, replacing SB 24-205) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.