Colorado AI Act

What is the Colorado AI Act?

"Colorado AI Act" is the common name for Senate Bill 24-205, signed on May 17, 2024. It would have required developers and deployers of high-risk AI systems to use reasonable care against algorithmic discrimination, with risk programs, impact assessments and reports to the attorney general. Its duties were due to start on February 1, 2026. A special session bill, SB 25B-004, moved that to June 30, 2026.

Before that date, Colorado passed a law to repeal and replace it. SB 26-189, signed on May 14, 2026, rewrites the same part of the state's consumer protection law as a narrower law on automated decision-making technology (ADMT). The repeal and the new duties take effect on January 1, 2027, and the law applies to consequential decisions made on or after that date. Until then SB 24-205 stays on the books, but the attorney general cannot enforce it (see the status below).

What SB 26-189 requires

The signed act covers ADMT that materially influences a consequential decision: one about a person's access to, eligibility for or pay in education, employment, housing, financial or lending services, insurance, health care, or essential government services. "Consumer" includes employees and Colorado job applicants. Advertising, search, routine scheduling and tools that only summarize or organize information for a human, without scoring or ranking anyone, are left out.

• Developers (companies that build or sell covered tools) must give deployers documentation on intended and harmful uses, training data, known limits and human review, and tell them about material updates.
• Deployers (companies that use the tools) must give a clear notice before using one in a decision and, after an adverse outcome, a plain-language explanation within 30 days.
• People who get an adverse outcome can ask to correct inaccurate personal data and, "to the extent commercially reasonable," for meaningful human review and reconsideration of the decision.
• Both sides keep compliance records for at least three years.

Only the attorney general enforces it, as a deceptive trade practice. There is no new private right of action. Until January 1, 2030, the attorney general must first allow 60 days to cure where a cure is possible, unless a violation was knowing or repeated.

Status as of October 2026

The attorney general must adopt rules on the post-decision notices and human review by January 1, 2027. The Colorado Department of Law filed proposed rules on August 11, 2026, released an interim draft on October 6 and held its rulemaking hearing on October 26, 2026, taking written comments until the end of that day. As of October 31, 2026, its rulemaking page showed no final rules yet.

Separately, xAI sued the attorney general over SB 24-205 in April 2026 (X. AI LLC v. Weiser, in the federal district court for Colorado). On April 27, 2026, on a joint motion by both sides, the court ordered that the attorney general will not start enforcement, including investigations, of SB 24-205 or the law replacing it until 14 days after the court rules on a preliminary injunction motion that xAI is to file within 28 days of the final rules. The legislature's final fiscal note sums this up as no enforcement until rulemaking is complete and the court rules.

What it looks like in a vendor's terms

The new law reads vendor paperwork closely. A developer's duties and its share of discrimination liability depend on how its tool was "intended, documented, marketed, advertised, configured, or contracted" to be used. That makes the acceptable use policy and AI terms part of the picture. A typical clause reads like this:

You may not use the Services to make, or as a substantial factor in making, decisions about a person's employment, credit, housing, insurance, education or access to health care or government services, unless we have agreed to that use in writing.

• "You may not use": a use the vendor did not intend. The law does not hold the vendor liable for that use and, if the vendor gave its documentation, it does not limit your liability as deployer for it.
• "Employment, credit, housing": the list tracks the law's covered areas.
• "Unless we have agreed": a vendor that does sell for these uses takes on the developer duties.

The law also settles some terms for the parties. A tool that talks to people in natural language falls outside the definition if it is not meant for consequential decisions and its acceptable use policy bans using its content in one. And a contract term that purports to indemnify, defend or hold harmless a developer or deployer against discrimination damages caused by its own acts is void, with a narrow exception for uses the developer never intended. Watch indemnification clauses for this.

Vendor policies already draw lines like these. Venpo flagged that Anthropic will let AI approve a claim without a human, but not deny one.

Why it matters to you

A small SaaS company can become a deployer through its own hiring. If an applicant-screening or HR tool scores or ranks Colorado candidates or employees, the notice, explanation and review duties can fall on you, not the vendor. If your own product is sold for one of the covered decisions, you may be a developer, with documentation and update duties to your customers.

If you prepared for SB 24-205, the reasonable-care duty, risk program and impact assessments are gone. The new law is about notice, explanation, correction and review.

What to check

• Your tools in covered areas: anything that scores, ranks or recommends in hiring, pay, lending, insurance, housing, education or health care for people in Colorado. Include them in your AI vendor risk assessment.
• Vendor documentation: whether each developer gives you intended uses, known limits and human review instructions.
• Update notices: how the vendor will tell you about material updates. Public release notes count only if the developer also notifies each deployer directly.
• Acceptable use policy: whether it bans the use you make of the tool.
• Indemnities: how the contract splits discrimination risk, given the limits above.
• The final rules: the attorney general's rules on notices and human review, due by January 1, 2027.

How Venpo helps

Under SB 26-189, a vendor's acceptable use policy and AI terms help decide who answers for a decision. Venpo watches your vendors' AI and acceptable use policies, terms and other public legal pages and emails you a plain-English alert when one changes, such as a new ban on using a tool in hiring decisions. The change history shows what a policy said on the date of a decision.