Colorado’s Artificial Intelligence Law Could Be on the Chopping Block

UPDATE 1: In an order issued Monday, April 27, 2026, a Colorado Magistrate Judge ordered the Colorado attorney general (CO AG) not to enforce Colorado’s artificial intelligence law (SB 24-205, the “Act”) until final adoption of the CO AG’s rulemaking implementing the Act. The rulemaking will take months, as the CO AG has not yet formally initiated this rulemaking process. The CO AG has exclusive power to enforce the Act, which is due to go into effect on June 30, 2026.  

The order offers a reprieve for employers, many of whom have hesitated to start the compliance process because the Colorado legislature was generally expected to substantially amend the Act in this legislative session. 

UPDATE 2: On May 1, the Colorado legislature introduced S.B. 26-189, a bill quite similar to the proposal released by the Colorado governor’s AI Policy Working Group in March.  With two weeks left in the Colorado legislative session, the bill potentially could pass the legislature in this session and be enacted into law, thereby amending the existing Colorado artificial intelligence law before it goes into effect on June 30, 2026.  The bill would require the Colorado attorney general to adopt implementing regulations by January 1, 2027.  The Colorado attorney general has stated he will not enforce the Colorado artificial intelligence law until after the implementing regulations are approved.  We therefore do not expect enforcement before 2027, if the bill is enacted.

*  *  *

When he signed Colorado’s artificial intelligence law (SB 24-205, the “Act”) into law, Colorado Governor Jared Polis told the Colorado General Assembly, by letter, that he did so “with reservations.” Polis criticized the Act for “creat[ing] a complex compliance regime,” and expressed “concern[] about [its] impact . . on an industry that is fueling critical technological advancements….” He urged the General Assembly “to amend [the Act] to conform with evidence based findings and recommendations for the regulation of [the AI] industry.” 

The General Assembly tried but failed to heed the governor’s words at a special legislative session in August 2025, when it extended the Act’s effective date from February 1, 2026, to June 30, 2026. With no amendment of the Act yet proposed in the current legislative session, the governor’s AI Policy Working Group has taken the initiative to spur legislative action.

On St. Patrick’s Day, the Working Group released a proposed bill to amend the Act. Although it has not yet been introduced in the legislature, the draft provides an early indication of how the state might ease the Act’s complex requirements. If enacted, the new law would significantly reduce compliance burdens for employers, although certain provisions would be more demanding than those in the existing statute. 

The proposed bill would eliminate many of the Act’s most onerous employer obligations while preserving key transparency requirements. Specifically, the Act would remove the following mandates currently imposed on employers that use artificial intelligence as a substantial factor in employment decisions:

• Reporting findings of discriminatory outcomes to the Colorado attorney general;
• Conducting impact assessments;
• Implementing a risk management policy and program;
• Conducting annual reviews of AI tools;
• Posting or updating privacy policies to describe the use of AI tools;
• Providing notice when interacting with an AI system;
• Complying with correction requests; and
• Affirmatively avoiding algorithmic discrimination (instead relying on a prohibition on violating existing state and federal anti-discrimination laws).

The proposal would retain the requirement that employers give notice before, or at the time, a covered tool is used. It would also continue to require post-adverse action notices. Developers would also need to provide detailed information about AI tools they develop. Employers would still be required to offer an appeals process for adverse decisions, including human review, but only to the extent that human review is commercially reasonable.

The proposed bill would introduce these new obligations: 

• First, employers would be required to retain records of their use of covered tools for three years.
• Second, the bill would substantially expand the definition of covered technology. Under the existing Act, only artificial intelligence systems—computing systems that use an inferential step and are used as a substantial factor in employment and other consequential decisions—are regulated. Under the proposal, any computational process that uses personal information and produces output materially influencing employment or other consequential decisions would fall within the law’s scope. Although the bill includes carveouts for clerical uses of technology, the broadened definition would capture a wide range of automated processes that would not constitute “artificial intelligence” under the prior standard.
• Third, the proposal raises uncertainty about whether it would extend Colorado Privacy Act obligations—currently limited to consumer data—to applicant and employee data.

If introduced, the bill will likely undergo substantial revision before and during the legislative process. Lawmakers may also propose competing bills, as occurred during the August 2025 special legislative session. If the Act were to be replaced by the Working Group’s proposal, the revised law would not take effect until January 1, 2027, giving employers some breathing room to address compliance.