From the journal

Colorado General Assembly passes SB 26-189 rewriting its AI consumer protection law, May 2026

The Colorado General Assembly passed Senate Bill 26-189, repealing and replacing the 2024 consumer artificial intelligence statute. The new text governs covered automated decision-making technology used in employment, housing, lending, insurance, healthcare, education, and essential government services. Obligations begin 1 January 2027 and are enforced by the Colorado Attorney General under the Colorado Consumer Protection Act.

2 min read

The Colorado Senate and House passed Senate Bill 26-189 in May 2026. The bill awaits the Governor's signature. It repeals and reenacts the consumer protections for artificial intelligence first enacted in Senate Bill 24-205.

SB 26-189 governs covered automated decision-making technology defined as a system that processes personal data to materially influence consequential decisions. Covered sectors include employment, education, lending, insurance, healthcare, housing, and essential government services. New Article 30 of Title 6 of the Colorado Revised Statutes sets developer documentation duties, deployer notice and human-review duties, and recordkeeping for at least three years. The Attorney General enforces violations under Section 6-1-105 of the Colorado Consumer Protection Act, treated as deceptive trade practices. The statute creates no private right of action. A sixty-day right to cure applies until 1 January 2030.

Developers must give deployers technical documentation covering intended uses, training data categories, known limitations, and instructions for human review. Deployers must give consumers clear notice at the point of interaction. Consumers can request access, correction, and meaningful human review of adverse outcomes. Lenders, insurers, employers, schools, landlords, and state agencies should map current model inventories against the covered ADMT definition before the 1 January 2027 effective date.

The rewrite drops the original requirements for governance programmes, model risk assessment, algorithmic bias testing, and impact assessments mandated by SB 24-205. The federal X.AI litigation that suspended enforcement of the prior Colorado AI Act continues during the transition. State AI statutes in Texas, California, and Connecticut still apply.

Licentium advises developers and deployers on Colorado ADMT compliance, technical documentation, consumer notice design, human-review workflows, and recordkeeping, and coordinates multistate AI programmes through partner counsel. Contact us if you operate covered ADMT touching Colorado consumers. Work we undertake includes ADMT classification, consumer notice drafting, vendor flow-down clauses, attorney general enforcement readiness, and cross-jurisdiction AI policy mapping.

Source: Colorado General Assembly, Senate Bill 26-189, Automated Decision-Making Technology, https://leg.colorado.gov/bills/sb26-189, confirmed 15 May 2026.

The information provided is not legal, tax, investment, or accounting advice and should not be used as such. It is for discussion purposes only. Seek guidance from your own legal counsel and advisors on any matters. The views presented are those of the author and not any other individual or organization. Some parts of the text may be automatically generated. The author of this material makes no guarantees or warranties about the accuracy or completeness of the information.

AI Regulatory

More from the journal

See all

Bank of England Publishes Draft Rules for Systemic Stablecoin Issuers

The Bank of England published a policy statement and draft Code of Practice setting out the regulatory regime for systemic stablecoin issuers in the UK in June 2026. The draft rules introduce a GBP 40 billion temporary issuance guardrail per stablecoin, permit issuers to hold up to 70% of reserves in short-term UK government debt, and require the balance in central bank deposits. The consultation closes 22 September 2026; the Bank intends to finalise the Code of Practice by end of 2026.

Connecticut Enacts AI Responsibility and Transparency Act, Effective October 2026

On 2 June 2026, Connecticut Governor Ned Lamont signed Senate Bill 5 into law as Public Act 26-15, the Connecticut Artificial Intelligence Responsibility and Transparency Act. The law creates disclosure obligations for employers using automated employment decision tools, governance requirements for frontier AI developers, product standards for AI companion systems, and safety obligations for online platforms serving minors. Most provisions take effect 1 October 2026; the Attorney General holds exclusive enforcement authority.

EU AI Act Article 50 Transparency Obligations Apply from 2 August 2026

Four categories of transparency obligations under Article 50 of Regulation (EU) 2024/1689 become binding on AI system providers and deployers across the EU on 2 August 2026. The European Commission published a final Code of Practice on Transparency of AI-Generated Content on 10 June 2026 as a voluntary compliance tool, alongside draft guidelines issued on 8 May 2026 that remain under finalisation. AI systems placed on the EU market before the August deadline have until 2 December 2026 to comply with the machine-readable marking obligation in Article 50(2).