Colorado AI Act Repealed: SB 26-189 (ADMT Act) Deadlines and What Your Business Must Do Before January 1, 2027

The Colorado AI Act Is Gone — Here's What Replaced It

If you spent early 2026 preparing for the Colorado AI Act's June 30, 2026 deadline, here's the news you need: that deadline never arrived. On May 14, 2026, Governor Polis signed SB 26-189 — the Automated Decision-Making Technology (ADMT) Act — which repealed and replaced the Colorado AI Act (SB 24-205) before it ever took effect.

The replacement law is significantly narrower, but it is not a free pass. It takes effect January 1, 2027, it carries penalties up to $20,000 per violation under the Colorado Consumer Protection Act, and — critically for readers of this blog — it eliminated the small-business exemption. Under the old law, deployers with fewer than 50 employees could qualify for reduced obligations. Under SB 26-189, businesses of any size that use automated decision-making technology in consequential decisions must comply.

This guide covers what changed, who's affected, and the concrete steps to take before January 1, 2027. For the broader multi-state picture, see our comprehensive AI compliance guide for small businesses.

A Quick History: How We Got Here

• May 2024: Colorado passes SB 24-205, the first comprehensive state AI law in the US, scheduled to take effect February 1, 2026.
• August 2025: Governor Polis signs SB 25B-004, delaying the effective date to June 30, 2026, amid pressure from businesses and calls for revisions.
• May 14, 2026: SB 26-189 is signed, repealing SB 24-205 entirely — before it ever took effect — and replacing it with the narrower ADMT Act.
• January 1, 2027: The ADMT Act takes effect.

If your compliance documents, policies, or vendor attestations reference SB 24-205, they cite a law that no longer exists. They need updating.

What Changed: SB 24-205 vs. SB 26-189

The old law was a broad risk-management framework. The new law is a notice-and-transparency law. The practical differences:

Gone (no longer required):

• Algorithmic impact assessments before deployment
• Formal risk management policies and programs
• Annual reviews of each high-risk AI system
• Duty to report discovered algorithmic discrimination to the Attorney General
• The developer/deployer dual-obligation framework in its original form

Still required (the new core obligations):

1. Clear notice to individuals when automated decision-making technology is used to make — or materially influence — a consequential decision about them
2. An adverse-action process: individuals affected by an adverse consequential decision must be offered human review and an opportunity to appeal
3. Record retention: records relevant to ADMT-driven consequential decisions must be kept for at least three years

Changed scope:

• The old under-50-employee deployer carve-out is gone — the ADMT Act applies to deployers of any size
• The law exempts independent contractors, out-of-state job applicants, and employees residing outside Colorado
• Coverage turns on whether the technology materially influences a "consequential decision," not on the old "high-risk AI system" definition

What Counts as a "Consequential Decision"?

The ADMT Act covers automated decision-making technology that materially influences decisions with legal or similarly significant effects concerning:

• Education enrollment or opportunities
• Employment or employment opportunities
• Financial or lending services
• Essential government services
• Healthcare services
• Housing
• Insurance
• Legal services

Common small-business examples:

• An AI resume screener that ranks candidates and determines who gets interviews (see legal requirements for AI tools at work)
• A credit or financing approval algorithm
• An insurance pricing or claims tool
• A tenant screening system that recommends approving or rejecting applications

Narrow tools that automate basic tasks without influencing significant decisions — a scheduling assistant, an FAQ chatbot — generally aren't covered.

Penalties and Enforcement

• Who enforces: The Colorado Attorney General has exclusive enforcement authority. There is no private right of action — consumers cannot sue you directly under this law.
• How: Violations are treated as unfair or deceptive trade practices under the Colorado Consumer Protection Act, with civil penalties up to $20,000 per violation. Violations can stack — processing many applications without required notice could count as many violations.
• Cure period: For enforcement actions initiated before January 1, 2030, the Attorney General must give you 60 days' notice and an opportunity to cure the violation, where a cure is possible.

Your Compliance Checklist for January 1, 2027

Step 1: Inventory your automated decision-making tools. List every tool that influences decisions about hiring, promotion, discipline, credit, insurance, housing, healthcare, or the other covered categories. Note the vendor, the decision it touches, and the data it uses.

Step 2: Determine which decisions it materially influences. The trigger is influence over consequential decisions — not whether the tool is labeled "AI." A points-based screening formula can qualify.

Step 3: Draft and deliver notices. Anyone subject to an ADMT-influenced consequential decision needs clear notice. For employment uses, that typically means language in job postings or application flows and in employee-facing policies.

Step 4: Build your adverse-action process. When ADMT materially influences an adverse decision — a rejected application, a denied claim — you must offer human review and a way to appeal. Write down who conducts the review and how requests are handled, and train the people involved.

Step 5: Set up three-year record retention. Keep records relevant to ADMT-influenced consequential decisions — the tool used, the inputs, the outcome, notices provided, and any appeals — for at least three years.

Step 6: Purge stale SB 24-205 references. Update any policies, handbooks, privacy notices, or vendor contracts that cite the repealed law. Citing a repealed statute in a compliance document undermines the document — and your credibility.

Step 7: Check your other states. Illinois HB 3773 (AI in employment decisions) took effect January 1, 2026, NYC Local Law 144 remains in force, and Texas TRAIGA took effect January 1, 2026. Colorado is one piece of a patchwork.

How the ADMT Act Compares to Other Laws

NYC Local Law 144: Requires annual bias audits for automated employment decision tools. Narrower category, heavier testing burden. Colorado's ADMT Act requires notice and human review but no statistical audit.

Illinois HB 3773: In effect since January 1, 2026 — employers must notify employees when AI is used in employment decisions, and AI-driven discrimination is prohibited. Closest sibling to Colorado's employment-side obligations.

California: CCPA/CPRA automated decision-making rules plus AI transparency laws aimed mostly at large model providers.

The federal wildcard: The federal government has signaled interest in preempting state AI laws, including through a December 2025 executive order directing legal challenges to state statutes. Nothing has preempted Colorado's law as of mid-2026, but this landscape is moving — which is exactly why compliance documents need to be regenerated when laws change, not written once and forgotten.

What You Should Do This Week

1. Stop citing SB 24-205. Audit your policies and notices for references to the repealed law.
2. Complete your ADMT inventory. You can't give notice about tools you haven't cataloged.
3. Draft your notices and adverse-action procedure. These are the heart of the new law, and they're achievable for a small business in days, not months.
4. Calendar the deadline. January 1, 2027 — with your documentation done well before.

Compliance Documentation Made Practical

Attestly generates the compliance documents the ADMT Act era actually calls for — AI disclosure policies, employee and client notices, internal policies, and data processing addendums — customized to the current law in every state you operate in. When Colorado rewrote its law, that's exactly the kind of change our documents are regenerated to reflect. Answer a short questionnaire and get state-accurate documents in minutes.

Frequently Asked Questions

Colorado's rewrite is a preview of how fast this landscape moves: the "first comprehensive state AI law" was repealed before it took effect. The businesses that handle this well aren't the ones that guessed right about which law would survive — they're the ones whose compliance documents get updated when the law changes.