From the journal

Colorado General Assembly passes SB 26-189 rewriting its AI consumer protection law, May 2026

The Colorado General Assembly passed Senate Bill 26-189, repealing and replacing the 2024 consumer artificial intelligence statute. The new text governs covered automated decision-making technology used in employment, housing, lending, insurance, healthcare, education, and essential government services. Obligations begin 1 January 2027 and are enforced by the Colorado Attorney General under the Colorado Consumer Protection Act.

2 min read

The Colorado Senate and House passed Senate Bill 26-189 in May 2026. The bill awaits the Governor's signature. It repeals and reenacts the consumer protections for artificial intelligence first enacted in Senate Bill 24-205.

SB 26-189 governs covered automated decision-making technology defined as a system that processes personal data to materially influence consequential decisions. Covered sectors include employment, education, lending, insurance, healthcare, housing, and essential government services. New Article 30 of Title 6 of the Colorado Revised Statutes sets developer documentation duties, deployer notice and human-review duties, and recordkeeping for at least three years. The Attorney General enforces violations under Section 6-1-105 of the Colorado Consumer Protection Act, treated as deceptive trade practices. The statute creates no private right of action. A sixty-day right to cure applies until 1 January 2030.

Developers must give deployers technical documentation covering intended uses, training data categories, known limitations, and instructions for human review. Deployers must give consumers clear notice at the point of interaction. Consumers can request access, correction, and meaningful human review of adverse outcomes. Lenders, insurers, employers, schools, landlords, and state agencies should map current model inventories against the covered ADMT definition before the 1 January 2027 effective date.

The rewrite drops the original requirements for governance programmes, model risk assessment, algorithmic bias testing, and impact assessments mandated by SB 24-205. The federal X.AI litigation that suspended enforcement of the prior Colorado AI Act continues during the transition. State AI statutes in Texas, California, and Connecticut still apply.

Licentium advises developers and deployers on Colorado ADMT compliance, technical documentation, consumer notice design, human-review workflows, and recordkeeping, and coordinates multistate AI programmes through partner counsel. Contact us if you operate covered ADMT touching Colorado consumers. Work we undertake includes ADMT classification, consumer notice drafting, vendor flow-down clauses, attorney general enforcement readiness, and cross-jurisdiction AI policy mapping.

Source: Colorado General Assembly, Senate Bill 26-189, Automated Decision-Making Technology, https://leg.colorado.gov/bills/sb26-189, confirmed 15 May 2026.

The information provided is not legal, tax, investment, or accounting advice and should not be used as such. It is for discussion purposes only. Seek guidance from your own legal counsel and advisors on any matters. The views presented are those of the author and not any other individual or organization. Some parts of the text may be automatically generated. The author of this material makes no guarantees or warranties about the accuracy or completeness of the information.

AI Regulatory

More from the journal

See all
Illia Prokopiev

MLR Registration and the FCA Cryptoasset Gateway to 25 October 2027

This matter concerns the transition of a United Kingdom cryptoasset business from FCA registration under the Money Laundering Regulations 2017 to Part 4A permission under the Financial Services and Markets Act 2000. The question is whether MLR registration gives conversion, grandfathering, priority, or a right to continue after 25 October 2027, and what an affected firm should do before the gateway closes. This analysis assumes an existing UK-facing cryptoasset business, no relevant Part 4A permission, and an intention to continue after commencement.

Illia Prokopiev

ESMA's 2026 Custody Resilience CSA and the Rules That Actually Bind

ESMA’s 2026 Common Supervisory Action is a coordinated national review of digital operational resilience in crypto-asset custody. It will test whether selected crypto-asset service providers can demonstrate effective controls across six announced workstreams. The legal questions are which requirements are binding, how national competent authorities may assess control effectiveness, and what consequences may follow from a deficiency. This analysis assumes that the firm is permitted under MiCA Article 59 to provide custody and administration within Article 3(1)(17).

Illia Prokopiev

Stablecoin regulation in the US, Hong Kong and Singapore

Stablecoin and digital-token regulation now combines market-entry authorization with continuous financial-crime controls in daily operations. The question is whether the United States’ proposed payment-stablecoin customer identification program, Hong Kong’s narrow first licensing round, and Singapore’s digital payment token (DPT) directory support a bank-like compliance characterization. They do, with material limits. The more accurate proposition is that compliance is moving beyond approval into continuous financial-institution-grade operations.