When does the Colorado AI Act take effect?

The reenacted Colorado AI Act, SB 26-189, takes effect January 1, 2027. It was signed on May 14, 2026 and repeals and replaces the original SB 24-205. The Colorado Attorney General has authority to issue implementing rules and must do so by the same January 1, 2027 date, so some operational detail will arrive through rulemaking before the law becomes enforceable. Deployers should treat 2026 as the preparation window, since the compliance and rulemaking deadlines share the effective date.

Who has to comply with SB 26-189?

The law applies to deployers and developers of automated decision-making technology that processes personal data to materially influence a consequential decision affecting a Colorado resident. Consequential decisions cover access to employment, housing, credit, education, healthcare, insurance, and legal or similarly significant matters. The threshold is the material-influence test: a system that meaningfully shapes one of those outcomes is in scope, while one that does not is outside it. Because the scope is narrower than the original act, documented use-case classification is the first compliance step.

What records does the Colorado AI Act require?

The reenacted law carries a three-year record retention obligation for covered decisions, alongside duties to explain adverse outcomes within roughly 30 days and to support correction and human-review rights. In practice this requires a per-decision record that identifies the affected person, the data that fed the decision, and the outcome, made at the time of the decision and retained for three years. Reconstructed or after-the-fact explanations are weaker evidence than a contemporaneous, identity-bound audit record.

How is SB 26-189 different from the original Colorado AI Act?

SB 26-189 repeals and replaces SB 24-205. The original act relied on broad impact assessments and a general duty of care to prevent algorithmic discrimination. The replacement narrows the target to ADMT that materially influences consequential decisions and shifts the burden toward specific consumer rights: adverse-outcome explanations, data correction, and human review, backed by a three-year retention duty. Enforcement runs through the Attorney General with a 60-day cure period that is unavailable for knowing or repeated violations and that sunsets on January 1, 2030.

Colorado AI Act Compliance: What SB 26-189 Requires of Deployers

On May 14, 2026, Colorado's governor signed SB 26-189, which repeals and replaces the original Colorado AI Act (SB 24-205) and takes effect January 1, 2027. The replacement narrows the law's target and moves the compliance burden from broad governance paperwork toward specific consumer-facing duties. It arrived after a federal court blocked enforcement of the predecessor, and it hands the Colorado Attorney General rulemaking authority to fill in the detail before the effective date.

I want to walk through what the reenacted law actually asks of deployers, how it differs from the version it replaced, and where the records that prove compliance come from.

What SB 26-189 regulates

The reenacted statute focuses on automated decision-making technology, or ADMT, that processes personal data to "materially influence" a "consequential decision." That phrasing is the scope test, and it matters. A consequential decision is one that affects access to employment, housing, credit, education, healthcare, insurance, or a legal or similarly significant matter. If a system materially influences one of those outcomes for a Colorado resident, it is in scope. If it does not, it is not.

Crowell & Moring's analysis describes this as a reset: the original SB 24-205 leaned on impact assessments and a broad duty of care against algorithmic discrimination, and the replacement trades much of that for targeted disclosure, explanation, and correction rights. The narrower scope means the first compliance task is classification. You cannot claim an exemption you have not documented.

What deployers must do

Four obligations sit at the center of the deployer's duty under the reenacted law:

Adverse-outcome explanation. When a covered ADMT is involved in a consequential decision that produces an adverse outcome, the deployer must give the consumer an understandable description of the decision, generally within 30 days.
Correction rights. The consumer may correct personal data that fed the decision.
Human-review rights. The consumer may request meaningful human review of the outcome where feasible.
Record retention. The deployer maintains records related to covered decisions, with a three-year retention obligation carried over from the original act.

The retention duty is the one that reaches into architecture. To explain a specific adverse decision within 30 days, and to defend that explanation for three years, you need a record of what the system did on the request that produced the outcome. That record has to include the identity of the person affected, the data that fed the decision, and the outcome.

Enforcement and the cure period

The Colorado Attorney General enforces the law and must adopt implementing rules by January 1, 2027. Before bringing an action, the AG generally provides notice and a 60-day opportunity to cure, where a cure is possible. That cure window is not available when the AG can show the violation was knowing or repeated, and the cure framework itself sunsets on January 1, 2030. Cooley's write-up for financial institutions notes that regulated entities should not read the cure period as a grace period, since it disappears the moment a violation looks deliberate.

The evidence problem

The obligations describe outputs. The gap most deployers will hit is the input to those outputs: a defensible record of each covered decision. An adverse-outcome explanation produced from memory or reconstructed after a complaint is weak. An explanation drawn from a per-decision record made at the moment of the decision is evidence.

Standard application logs struggle here for the same reasons they struggle under other AI regimes. They often lack the identity of the natural person behind the request, because the system called the model on a shared service credential. They lack the data classification that applied, because the application never evaluated it. They can be modified by the same system that produced the decision. I walked through that failure pattern in the healthcare-specific look at SB 26-189, and the same architecture gap applies across every consequential-decision sector the law covers.

Where Colorado sits in the wider map

Colorado is one regime among several converging on the same requirement. The EU AI Act high-risk classification guidance asks for lifecycle risk management and event logging. Sector rules in finance and healthcare ask for audit trails on AI-assisted decisions. The vocabulary differs across these regimes, and the underlying infrastructure requirement repeats: an identity-bound, per-decision record that reconstructs what an AI system did with a specific request at a specific moment.

DeepInspect

This is the architecture DeepInspect provides for the record side of Colorado compliance. DeepInspect sits at the AI request boundary as a stateless proxy between your users or agents and any LLM. It evaluates each request against the identity the application supplies and per-route, per-role policy, and it records every decision.

For SB 26-189, that record is what an adverse-outcome explanation should draw from. Each per-decision audit entry captures the identity behind the request, the data classification that applied, the policy in effect, the outcome, and a timestamp, and it is signed and tamper-evident. When a consumer requests an explanation or human review, or when the Attorney General asks what the system did, the record exists at the resolution the three-year retention obligation assumes.

If you deploy AI in consequential-decision functions for Colorado residents and your decision records are still application logs, let's talk today.