Glossary · United States
Colorado AI Act
Also known as: Colorado Artificial Intelligence Act, SB 24-205, SB 26-189, CAIA
The Colorado AI Act (SB 24-205, 2024) was the first comprehensive US state law on high-risk AI systems. It never took effect: in May 2026 Colorado repealed and replaced it with SB 26-189, a narrower law on automated decision-making technology in consequential decisions that requires notice, explanation of adverse outcomes and human review from January 1, 2027.
- AI regulation
- USA
In one sentence
Colorado’s AI Act (SB 24-205) was replaced in May 2026 by SB 26-189, a narrower law on automated decisions effective January 2027.
Example
From 2027, a lender in Colorado that uses an automated system to reject a loan application must explain the adverse decision within 30 days and offer human review.
How it applies
- SB 24-205 (2024): Required developers and deployers of high-risk AI systems used in consequential decisions — employment, education, housing, credit, health care, insurance, legal and essential government services — to use reasonable care against algorithmic discrimination, with risk management programs and impact assessments. Its start was postponed to June 30, 2026. In April 2026, a federal court stayed its enforcement in a lawsuit brought by xAI and supported by the US Department of Justice.
- SB 26-189 (2026): Signed on May 14, 2026, it repeals and replaces SB 24-205. It covers automated decision-making technology that materially influences consequential decisions and requires notice that AI is used, an explanation of adverse outcomes within 30 days, correction of inaccurate personal data and meaningful human review. Risk management programs, impact assessments and the duty of care were dropped. It takes effect on January 1, 2027 and is enforced by the Attorney General only.
- Technical documentation: Under the new law, the key documents are consumer-facing: notices, explanations of adverse decisions and descriptions of the human review process — plain-language writing rather than technical files.
Colorado AI Act vs. the EU AI Act
SB 24-205 was the closest US counterpart to the AI Act's high-risk rules. Its replacement resembles the AI Act's deployer duties to inform people subject to decisions — and the GDPR's rules on automated decisions — more than its provider requirements.