Colorado: the first comprehensive law, repealed before it ever operated
Lesson 2 of 6 in State AI Laws in Depth: Colorado, California, Texas, Illinois, NYC, and Beyond.
On May 17, 2024, Colorado signed SB 24-205 — the first comprehensive AI statute in the United States. It looked like a compact EU AI Act for one state: high-risk AI systems were those making consequential decisions in employment, lending, housing, education, healthcare, insurance, legal services, and essential government services. Developers owed documentation and disclosure duties up the chain; deployers owed a risk-management program expressly benchmarked to the NIST AI RMF or ISO/IEC 42001, annual impact assessments, consumer notices, and reports to the attorney general on discovered discrimination. Both owed a duty of reasonable care to avoid algorithmic discrimination. Enforcement belonged to the AG alone.
It never operated a single day. Implementation fights consumed 2025 — businesses said the duties were unworkable, civil-rights groups said amendments gutted them, and a governor who had signed the bill “with reservations” convened an August 2025 special session that produced SB 25B-004, pushing the effective date from February 1, 2026 to mid-2026. Then came EO 14365 in December 2025 and the threat of DOJ challenges and funding conditions. On May 14, 2026, Colorado enacted SB 26-189, which — effective immediately — repealed SB 24-205 outright and replaced it with something structurally different.
The Colorado saga, 2024–2027
- SB 24-205 signed (May 17, 2024)
First comprehensive US AI law: duty of reasonable care, developer/deployer duties, NIST RMF-benchmarked risk programs. Effective date: Feb 1, 2026.
- 2025 implementation fights
Task-force deadlock, failed amendment bills, business pressure, civil-rights pushback.
- SB 25B-004 delays start (Aug 2025 special session)
Effective date pushed to mid-2026. Sources differ on June 1 vs June 30 — moot after repeal.
- EO 14365 federal pressure (Dec 11, 2025)
DOJ directed to challenge state AI laws; federal funding conditioned on state compliance.
- Fix, delay again, or replace?
- SB 26-189 repeals and replaces (May 14, 2026, effective immediately)
The duty-of-care regime dies without ever operating. An ADMT disclosure framework takes its place.
- ADMT framework phases in — developer documentation duties and AG rules due Jan 1, 2027
SB 26-189 is a disclosure law, not a duty-of-care law. It covers automated decision-making technology (ADMT) used in education, employment, housing, lending, insurance, health care, and government benefits. Its machinery:
- Developers must furnish technical documentation — intended uses, categories of training data, known limitations, instructions for human review, and notices of significant updates — with duties starting January 1, 2027.
- Deployers must give point-of-interaction notice that ADMT is in use, and after an adverse consequential decision, a plain-language explanation within 30 days covering the ADMT’s role and the principal reasons.
- Consumers get rights to access and correct the personal data the ADMT used, and to meaningful human review and reconsideration of adverse decisions.
- Records must be kept for three years. The AG must issue rules by January 1, 2027 and enforces violations as deceptive trade practices under the Colorado Consumer Protection Act, with a 60-day cure period available until January 1, 2030. There is no private right of action, and the act allocates fault between developers and deployers when discrimination claims arise under other laws.
| Obligation | SB 24-205 (never operated) | SB 26-189 (in force) |
|---|---|---|
Duty of reasonable care to avoid algorithmic discrimination | Core of the act — on developers and deployers | Gone. Discrimination claims run under other laws; the act only allocates developer/deployer fault |
Risk-management program (NIST RMF / ISO 42001 benchmark) | Required of deployers | Gone as a mandate — RMF alignment survives only as good practice and evidence |
Impact assessments | Annual, per high-risk system | Gone as a named duty |
Developer documentation to deployers | Required | Survived, reshaped — technical documentation duties from Jan 1, 2027 |
Consumer notice | Pre-decision notice | Survived — point-of-interaction notice |
Adverse-decision explanation + human review | Explanation, correction, appeal rights | Survived, sharpened — 30-day plain-language explanation, data correction, meaningful human review and reconsideration |
AG reporting of discovered discrimination | Required within 90 days | Gone |
Enforcement | AG-only, unfair trade practice | Survived — AG-only, deceptive trade practice, 60-day cure until 2030, no private right of action |
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.