What Compliance Teams Should Do Before Colorado AI Act Enforcement Ramps Up
Last verified: 2026-06-02 - primary-source refresh against the official Colorado SB 26-189 bill page.
The Colorado AI Act was enacted in 2024, delayed by SB25B-004 in 2025, and then superseded by SB 26-189 in 2026. The current Colorado General Assembly summary says SB 26-189 repeals and reenacts the prior SB 24-205 provisions as a covered automated decision-making technology (ADMT) framework for consequential decisions, with covered developer documentation duties starting January 1, 2027. Source: Colorado SB 26-189, retrieved 2026-06-02.
What should be in place before January 1, 2027
1. AI system inventory with high-risk classification
For every AI system in use:
- Description of purpose and intended use
- Classification: high-risk (yes/no) per the high-risk definition
- Role: developer, deployer, or both
- Industries / decisions affected
If a system is not high-risk under Colorado law, document why — exclusions in C.R.S. § 6-1-1701(7)(b) apply to anti-fraud, cybersecurity, narrow technical functions, etc.
2. ADMT documentation and evidence for consequential-decision systems
SB 26-189 shifts the current Colorado planning surface toward covered ADMT technical documentation, deployer records, consumer notice, correction, and meaningful human-review workflows. Existing impact-assessment templates can still preserve useful evidence for consequential-decision systems, but this page should not treat annual SB 24-205 impact assessments as the current standalone Colorado duty. Use the Impact Assessment Generator for structured evidence where a system remains high impact.
3. Consumer disclosure mechanism
When covered ADMT is used to materially influence a consequential decision, SB 26-189 requires clear consumer notice at the point of interaction and a plain-language role description after an adverse outcome. Build the disclosure surface into customer-facing flows before a covered ADMT launch or before the January 1, 2027 timeline described by the current bill summary, whichever is later.
4. Right-to-correct and right-to-appeal
Build operational paths for affected consumers to: (a) correct inaccurate personal data, and (b) appeal adverse decisions to a human reviewer where technically feasible.
5. Records and cure-readiness process
SB 26-189 requires developers and deployers to retain records needed to demonstrate compliance for at least three years, and the Attorney General must provide a 60-day notice and opportunity to cure before initiating certain pre-2030 actions when a cure is possible. Build escalation and remediation records before the first covered ADMT incident.
6. Developer-deployer documentation flow
Developers providing covered ADMT to deployers should prepare technical documentation covering intended uses, training-data categories, known limitations, appropriate-use instructions, human-review instructions, and material updates, consistent with the SB 26-189 summary.
Deployers using vendor AI should request this documentation from vendors and add it to procurement checklists for new vendors.
Common pitfalls to avoid
- Generic impact assessments: the assessment must be specific to the system. Boilerplate language is weak evidence of compliance.
- No bias testing: writing about bias without testing for it. Run quantitative tests with documented methodology.
- One-time assessment: the obligation is annual. Set a refresh cadence.
- No consumer-disclosure path: documenting compliance internally without a consumer-facing surface is incomplete.
Adopt a federal framework
Adopting NIST AI RMF or ISO/IEC 42001 substantially supports Colorado AI Act compliance through their MAP / Annex A.5 controls. Treat the framework as the control baseline, with the Colorado-specific obligations layered on top.