Colorado Guts Its Landmark AI Act: SB 26-189 Replaces SB 24-205 Before It Bound Anyone

A Landmark Law Dismantled Before It Took Effect

Colorado has gutted the most ambitious AI civil-rights statute in the United States before it ever bound a single company. On May 14, 2026, Governor Jared Polis signed SB 26-189, a replacement for the state's 2024 Consumer Protections for Artificial Intelligence Act, SB 24-205. The original law was the first comprehensive US statute to impose affirmative duties on both the developers and the deployers of high-risk AI systems to guard against algorithmic discrimination in consequential decisions spanning employment, housing, healthcare, lending, insurance, education, and legal services. SB 26-189 keeps the name and a thin layer of consumer-facing notice rights and throws away nearly everything that gave the original law force.

The collapse came fast. SB 24-205 had already seen its effective date pushed from an earlier February target to June 30, 2026. In April, Elon Musk's xAI sued in federal court to block the law on First Amendment, Dormant Commerce Clause, due-process vagueness, and equal-protection grounds. On April 24, the US Department of Justice intervened on xAI's side — the first time the federal government had moved to invalidate a state AI law. Three days later, on April 27, 2026, a federal magistrate judge ordered the Colorado Attorney General not to enforce the law until the office completed its implementing rulemaking, neutralizing the statute on its own terms. By the time SB 26-189 was signed, the original law was already a dead letter.

What Survived and What Was Cut

SB 26-189 is a surgical narrowing rather than a full repeal, which makes the cuts unusually revealing. It preserves the consumer touchpoints: notice that an automated decision-making technology is in use, post-adverse-outcome explanations, correction rights for erroneous data, a form of meaningful human review, and a three-year record-retention obligation. Enforcement stays with the Attorney General under the Colorado Consumer Protection Act, with mandatory rulemaking due by January 1, 2027 — also the replacement's effective date.

What the legislature removed is precisely the load-bearing machinery. The affirmative duty of reasonable care against algorithmic discrimination is gone. The mandatory risk-management programs are gone. The pre-deployment impact assessments and annual reviews are gone. The public-summary obligations are gone. The broad "high-risk AI system" framing narrows to "automated decision-making technology" processing personal data. Two further moves cut in opposite directions: SB 26-189 explicitly forecloses any private right of action, concentrating all enforcement in the Attorney General, yet it also strips certain exemptions the original law had granted to federally regulated entities such as banks — lightening the substantive load while modestly widening nominal coverage.

The redesign converts a substantive civil-rights statute into a notice-and-transparency framework. A consumer who is denied a loan, a job, or an apartment by an automated system still learns that a machine was involved and is entitled to the principal reasons, and can correct bad input data. What disappears is any mechanism to catch systemic, statistical discrimination — the proxy variables, training-data imbalances, and disparate impacts that no individual consumer can detect from their own adverse-decision notice and that the deleted impact-assessment and risk-management duties were specifically designed to surface.

Why the Deployer-Duty Model Broke

The structural reason the original law proved unworkable is that it placed its heaviest obligations on deployers — the downstream businesses that buy and use AI tools — rather than on the relatively small set of developers that build them. In the American economy, that regulated population was not "AI companies"; it was a large majority of mid-size and larger employers, landlords, lenders, insurers, hospitals, and schools, most with no existing AI-governance function. Standing up annual algorithmic-discrimination assessments for every covered system, on a fixed deadline, for organizations that could not even inspect the black-box vendor products they relied on, generated broad cross-sector opposition. The contrast with the EU AI Act is instructive: Brussels concentrated its heaviest duties on high-risk providers and general-purpose model developers, a small and well-resourced population, while Colorado diffused them across an entire economy.

The Federal Pressure Behind the Retreat

The retreat did not happen in a vacuum. The DOJ's intervention was the sharp edge of a broader federal posture hostile to state AI regulation, with the White House having publicly singled out Colorado's framework. The provisions most directly criticized — the discrimination duty, the impact-assessment mandate, the deployer risk-management program — map almost exactly onto what SB 26-189 removed. Colorado thus becomes the first concrete data point in the national preemption debate, and the data favors the skeptics: under federal pressure, the state did not harmonize upward to a robust common standard but downward toward a thinner one, before any federal law required it to. For compliance leaders, the practical reality is that AI-discrimination liability has not vanished — Title VII, the Fair Housing Act, and the Equal Credit Opportunity Act all still apply to AI-driven decisions — but the clear, ex-ante, audit-backed duty has been replaced by open-ended, ex-post, litigation-driven exposure. The companies that built genuine governance functions in anticipation of SB 24-205 should keep them; that evidentiary record is now their best defense under the general law that survived.

A fuller treatment of the statutory mechanics, the compliance economics, and what the episode means for the US state patchwork is available in the companion analysis, The Colorado AI Act Was Gutted Before It Took Effect: What SB 26-189 Reveals.

Sources

• Colorado General Assembly: SB24-205 Consumer Protections for Artificial Intelligence
• Consumer Finance Monitor: Colorado rewrites its landmark AI law — unpacking SB 26-189
• Privacy World: The Colorado AI Act Hits a Wall — Litigation, Legislative Uncertainty, and an Enforcement Standstill
• Seyfarth Shaw: Colorado Enacts Artificial Intelligence Replacement Law