Colorado Governor Jared Polis signed SB 26-189 on Thursday, replacing the state's 2024 AI Act with a substantially weaker law that narrows the scope of AI regulation, delays enforcement until January 2027, and removes several requirements the original law imposed on companies deploying artificial intelligence.

The original Colorado AI Act (SB 24-205), signed in 2024 with what Polis called "reservations," was the first comprehensive state-level AI governance statute in the United States. It required developers and deployers of "high-risk artificial intelligence systems" to conduct impact assessments, run annual reviews, and implement risk management programs to prevent algorithmic discrimination. It was supposed to take effect June 30, 2026.

It never did. Elon Musk's xAI filed a First Amendment challenge in April, and the DOJ intervened on xAI's side. A federal magistrate judge froze enforcement on April 27. The legislature had already been rewriting the law before the ink dried on the injunction.

What Changed

The new law replaces the term "high-risk artificial intelligence systems" with "automated decision-making technology" (ADMT) and focuses on decisions that "materially influence" outcomes in covered domains: education, employment, housing, financial services, insurance, healthcare, and essential government services.

The carve-outs are where the industry won. The new law specifically excludes anti-malware tools, calculators, databases, firewalls, spreadsheets that require human analysis and don't use machine learning, and chatbots that aren't configured for consequential decisions and have acceptable use policies prohibiting such use. Consumer-facing natural language tools are exempt if they just summarize, translate, draft, route, or present information for human review.

The original law's annual impact assessment and risk management program requirements are gone. The replacement shifts to notice and transparency obligations: telling consumers when ADMT is being used in decisions that affect them, providing explanations, and enabling human review.

A Two-Year Tug-of-War

The Denver Post called it a "two-year tug-of-war." The Colorado Chamber of Commerce shaped the replacement bill and praised it. Baker Botts, the law firm, noted in its analysis that organizations that built compliance programs for the original law now need to re-evaluate whether those programs align with the new framework before the January 2027 deadline.

The Colorado General Assembly passed SB 26-189 on May 9. Polis signed it Thursday, May 14. The law takes effect January 1, 2027 and applies to decisions made on or after that date. The Attorney General will handle rulemaking.

Why It Matters Beyond Colorado

Colorado's original AI Act was the blueprint that other states were watching. Connecticut passed SB5 with companion chatbot regulations. New York, California, and Illinois have AI bills in various stages. The message from Colorado's retreat is clear: the first version was too aggressive for the industry to accept, and the combination of legal challenge (xAI's First Amendment case), federal intervention (DOJ support), and business lobbying (Colorado Chamber) was enough to force a rewrite before enforcement even started.

The statute explicitly notes that compliance with SB 26-189 does not excuse noncompliance with any other applicable state or federal law. But the practical effect is less regulation, not more. The industry got what it wanted: narrower definitions, broader exemptions, and more time.

First reported by The Denver Post and Baker Botts. Additional analysis from EPIC and the Colorado Chamber of Commerce.