Category: Regulation | Reading time: 4 min
Never In Force
Colorado SB 24-205, signed in May 2024, was the first comprehensive state AI law in the United States. It established a risk based framework governing AI in consequential decisions affecting employment, housing, health care and education, modelled in part on the EU AI Act.
It never took effect.
The original date of 1 February 2026 was pushed to 30 June 2026 by SB 25B-004, signed 28 August 2025 after a special legislative session failed to reach a compromise on amendments. On 27 April 2026, a federal magistrate judge stayed enforcement after the Attorney General stipulated to the stay, citing the pending legislative rewrite.
On 14 May 2026, Governor Polis signed SB 26-189, which repeals and replaces the framework entirely. The new law takes effect 1 January 2027.
What Was Removed
The duty of care aimed at preventing algorithmic discrimination is gone.
So is the high risk AI classification, the requirement for deployers to maintain risk management programmes, the annual impact assessment obligation, and certain reporting duties to the Colorado Attorney General.
Those four elements were the substance of the original law and the reason it drew comparison to the EU AI Act.
What Replaced It
SB 26-189 regulates automated decision making technology that materially influences consequential decisions. The duties are narrower and structured around transparency rather than risk management.
Deployers must notify consumers when covered ADMT influences a consequential decision. Adverse outcomes must be explained within 30 days. Meaningful human review must be available. Developers must maintain documentation.
The framework moved from preventing a harm to disclosing a process.
Why It Collapsed
Governor Polis signed the original bill in 2024 with publicly stated reservations and explicitly invited the legislature to refine it before it applied. That invitation produced two years of reconsideration.
An AI Policy Working Group convened by the Governor ran roughly six months of stakeholder consultation before publishing a proposed framework in March 2026. The replacement bill was introduced and signed within two weeks.
A federal executive order on national AI policy framework, issued in December 2025, created additional pressure, and the Department of Justice intervened in litigation challenging the original Act.
What This Means For Planning
Two years of compliance preparation were built against a statute that never applied.
Organisations that treated SB 24-205 as settled and built impact assessment programmes to satisfy it now hold artefacts with no regulatory home in Colorado, though the underlying work transfers to other regimes.
The more durable lesson is about which obligations survive legislative reconsideration. Duty of care provisions and mandatory risk assessments were removed. Notice, explanation and human review survived, and are also present in the EU AI Act Article 50 transparency regime that took effect this month.
Transparency obligations are proving more politically durable than risk management mandates. That pattern is worth planning around.