Colorado AI Act (SB 26-189): Dates and How to Get Ready

01Key dates

1. 2024Colorado enacts SB 24-205, the original Colorado AI Act.
2. May 14, 2026SB 26-189, "Automated Decision-Making Technology", is signed. It repeals and re-enacts the 2024 act.
3. January 1, 2027The duties of developers and deployers start.
4. Until January 1, 2030Before bringing an action, the Attorney General must give the developer or deployer 60 days' notice and an opportunity to cure the alleged violation, where a cure is possible.

If you read about earlier compliance dates for the 2024 act, they no longer apply as written: SB 26-189 replaced that act, and its duties start January 1, 2027.

02Which decisions the law covers

The law is about covered ADMT: automated decision-making technology, including AI, used to materially influence a consequential decision about a person in one of these areas:

• education
• employment
• housing
• financial or lending services
• insurance
• health-care services
• essential government services

The trigger is not using AI in general but using it to materially influence one of these decisions, so the first job is to find out where, if anywhere, that happens in your business.

03Developers and deployers: who does what

In plain terms, a developer makes a covered ADMT and a deployer uses it. Check the bill's own definitions with your attorney.

A company that builds a tool and also uses it in its own decisions may have both sets of duties.

04Enforcement and the cure period

The Attorney General enforces the law. Until January 1, 2030, before bringing an action, the Attorney General must give the developer or deployer 60 days' notice and an opportunity to cure the alleged violation, where a cure is possible.

The cure period is a safety net, not a plan. The records and processes the law asks for take time to set up, and January 1, 2027 is close.

05How to get ready before January 1, 2027

1. Inventory your AI. List every AI tool and feature in use, including those built into software you buy, and mark where any of them influences a decision in the covered areas.
2. Work out your role for each one: developer, deployer or both.
3. Ask vendors for documentation. Developers owe it to deployers, so request it now.
4. Prepare consumer notices, and a process to explain the AI's role within 30 days after an adverse outcome.
5. Set up request handling for data correction and human review: who receives a request, who decides, and how quickly.
6. Keep records for at least 3 years, in a form you can produce when asked.
7. Train the people involved, and review the plan with your attorney.

06How EBOXLAB AI helps

We help you get ready: the inventory of where AI influences consequential decisions, consumer notices, human review and records. Our background is digital forensics, so record-keeping and audit trails are familiar ground, and when we build AI tools ourselves, logging and human review are designed in. We also offer AI consulting and training for teams that covers the law where it applies.

07Questions about the Colorado AI Act