Colorado hit reset on its AI law. Here’s what actually changed.
Colorado just rewrote its AI law. The 2024 version is out. The 2027 version is lighter —> and it’s coming.
If you run a nonprofit, a credit union, a clinic, a school, or a small agency, you probably heard two things about Colorado’s AI law. First, that in 2024 Colorado passed the country’s first broad AI law. Then, that it kept getting delayed. Both are true. And in May, the story changed again.
Here’s the plain version, without the legalese.
What happened
The original law was SB 24-205, signed in 2024. It was ambitious and, frankly, heavy. It was the kind of thing built with large companies and dedicated compliance teams in mind. Its start date slipped from February 2026 to June 30, 2026, and then enforcement was effectively frozen while the courts sorted through challenges.
Rather than let it limp forward, Colorado rewrote it. In May 2026, the legislature passed SB 26-189, which repeals and replaces the 2024 law. Governor Polis signed it on May 14, 2026. The new law takes effect January 1, 2027.
The big change: it got lighter
This is the part most coverage buried. The 2024 law carried a sweeping “high-risk AI system” standard, a legal duty of care against algorithmic discrimination, mandatory risk management, impact assessments, annual reviews, and reporting to the Attorney General. For a 40-person nonprofit, that was a mountain.
SB 26-189 sets most of that aside. It narrows the focus to automated decision-making technology (when AI is used to help make real decisions about people) and it centers on three plain ideas: tell people when you’re using it, explain adverse outcomes, and give people a way to reach a human. That’s a law a small organization can actually comply with.
Why it still matters for you
Because it’s real, it’s dated, and it covers exactly the decisions small organizations make with AI every day: who gets hired, who gets a loan, who gets housing, who gets covered, who gets care, who gets into a program, who gets a public benefit. If AI touches any of those in your world, January 1 is a date worth circling.
What to do now
(it’s not panic — it’s an inventory)
You can’t govern what you can’t see. The single most useful thing you can do this quarter is make a list of every place your organization uses AI to help make a decision about a person. That list is the foundation for everything the new law asks for. Most leaders I talk to have never written it down — and are surprised how much is already in use once they do.
That’s the whole first step. Not a committee, not a consultant. A list.
Over the next few weeks I’ll walk through the rest: whether the law applies to you, the three notices you’ll owe, what “human review” actually means for a small team, and a 90-day checklist. If you want a head start, the free AI Readiness Scorecard shows where you stand in about five minutes — no sign-up.
→ Take the free AI Readiness Scorecard at GOVERNBOX.ai — five minutes, real answers.
This is general information about SB 26-189, not legal advice. Confirm your obligations with counsel. — Jim Tunnessen, Gradient Descent LLC