2026-06-30 — views

Colorado's AI Act Was Supposed to Take Effect Today. It Won't Until 2027.

Read this because The first comprehensive US state AI law just got rewritten before it ever took effect. That sequencing — legislate, then repeal under industry pressure before enforcement begins — is the template to watch in other states.

SB 189, signed May 14, gutted the Colorado AI Act and delayed its effective date from June 30, 2026 to Jan 1, 2027, replacing it with a disclosure-only regime.

What is happening

June 30, 2026 was supposed to be the day the Colorado AI Act (SB24-205) — the first comprehensive state-level AI law in the US — took effect, after one prior delay pushed it from its original February 1, 2026 start date. It did not happen. Colorado’s legislature passed SB 189 in a May special session, Governor Polis signed it on May 14, and it repeals and replaces the original Act’s risk-based framework with a narrower, disclosure-focused regime that does not take effect until January 1, 2027.

For any team that spent the first half of 2026 building compliance tooling against the original Act’s requirements, today is the day that work would have shipped — and instead the law it was built for no longer exists in that form.

What SB 189 actually changes

Removed from the original Act	Retained or added under SB 189
Duty of care / algorithmic discrimination standard	Developer disclosures to deployers: intended use, training data categories, limitations
Deployer risk-management program requirement	Pre-use consumer notices for covered automated decisions
Mandatory impact assessments	Post-adverse-outcome notice within 30 days
Colorado Attorney General reporting obligations	Limited consumer rights to access/correct personal data used in the decision
Consumer disclosure of “nonobvious” AI interactions	Right to meaningful human review of adverse decisions; 3-year record retention

The original SB24-205 used a risk-based framework modeled on the EU’s tiered approach: “high-risk” AI systems used in consequential decisions — employment, housing, healthcare, education, credit — triggered affirmative obligations to prevent algorithmic discrimination, including impact assessments and documented risk-management programs, with the state Attorney General as enforcer. SB 189 drops nearly all of that and replaces it with a narrower transparency regime: tell people an automated system was used, give them a path to contest an adverse outcome, keep records. The developer/deployer distinction from the original law survives; the affirmative discrimination-prevention duties largely do not.

Why this matters for builders

If your compliance roadmap had a June 30, 2026 deadline for Colorado AI Act readiness, that deadline is gone — replaced by a January 1, 2027 deadline for a materially lighter set of obligations. Teams that already built impact-assessment pipelines or risk-management documentation for Colorado specifically built ahead of a requirement that no longer exists in that form; that work isn’t wasted if you operate in jurisdictions with similar risk-based frameworks still in force (the EU AI Act’s high-risk tier being the obvious one), but it’s no longer load-bearing for Colorado compliance on its own.

The more durable signal is sequencing, not the specific obligations: a state passed a comprehensive AI law, delayed it once, and then rewrote it down to a disclosure-only regime before a single enforcement action occurred under the original text. Other states drafting AI legislation now have a concrete example of what happens when a risk-based framework meets implementation deadlines and industry pushback at the same time — expect that precedent to be cited in statehouse debates well beyond Colorado.

Practitioner note

Don’t delete compliance work built for the original Colorado AI Act — audit it against SB 189’s narrower requirements instead. The disclosure obligations that survived (developer-to-deployer disclosures, pre-use consumer notice, 30-day adverse-outcome notice, human-review rights, 3-year retention) are real and have a real January 1, 2027 deadline; you likely already have most of the underlying data from impact-assessment work, even though the assessment itself is no longer mandated. If you operate AI systems in consequential-decision domains (hiring, lending, housing, healthcare) across multiple states, track this as the first concrete instance of a state walking back a risk-based AI law — it changes how much weight to put on any single state’s current draft language when planning multi-year compliance architecture.