Colorado was the first US state to enact a comprehensive AI consumer protection law — the Colorado Artificial Intelligence Act (SB 24-205), signed by Governor Jared Polis in May 2024 — but that original deployer-developer regime was repealed and replaced before it ever took effect. SB 26-189, signed May 14, 2026 and effective January 1, 2027, dropped the risk-management program, annual impact assessments, and duty of care, narrowing Colorado's AI law to a transparency and disclosure regime for automated decision systems used in consequential decisions about Colorado consumers (employment, education, financial services, healthcare, housing, insurance, legal services, or government services).
Colorado's regulatory posture in 2026 shifted decisively toward disclosure rather than prescriptive risk management. The amended law no longer imposes the impact-assessment, reasonable-care, or algorithmic-discrimination-notification obligations that defined SB 24-205; instead it focuses on telling consumers when an automated decision system materially informs a consequential decision. Enforcement still sits with the Colorado Attorney General under the Colorado Consumer Protection Act, and there is no private right of action. Organizations that operationalized NIST AI RMF or ISO/IEC 42001 for the original act keep a strong governance posture, but the binding Colorado obligation as of the 2027 effective date is transparency, not a documented risk-management program.
Sector-specific frameworks layer on top of state AI laws and frequently impose stricter or earlier-binding obligations. These are the sectors most exposed in Colorado.
Healthcare
Section 1557 nondiscrimination overlay applies on top of the Act when AI influences clinical decisions or coverage determinations for Colorado patients.
Employment
EEOC algorithmic discrimination guidance and ADA accommodations overlay employment-AI obligations. Colorado deployers should integrate the amended law's disclosure obligation with existing federal hiring-AI documentation.
Financial services
SR 11-7 model risk management is the practical anchor for banks; insurance carriers fall under Colorado Division of Insurance Regulation 10-1-1 (the 2023 AI insurance rule that pre-dates the Act).
Insurance
Colorado already had the country's first state insurance AI rule (Reg 10-1-1, 2023). The Act layers on top, not in place of, that rule.
Practical operational checklist for organizations subject to Colorado AI laws. Items are ordered by typical sequence of implementation, not by importance — most steps depend on the inventory work in the first item.
EFROS operates the AI governance program against Colorado's amended AI law (SB 26-189 — transparency/disclosure, effective 2027) for clients running automated decision systems that touch Colorado consumers — automated-decision-system inventory, consumer disclosure language and delivery, vendor BAA matrices for AI subprocessors, and a NIST AI RMF / ISO/IEC 42001 governance baseline for procurement and multi-state exposure. We are US-anchored and do not retrofit EU AI Act frameworks onto US deployments.
Disclaimer: this profile is a research dataset, not legal advice. Compliance determinations for Colorado businesses require analysis of specific facts and should be made in consultation with qualified legal counsel licensed in Colorado.