From the journal

Colorado Enacts Senate Bill 26-189 Replacing Colorado AI Act with ADMT Law, 14 May 2026

On 14 May 2026, Colorado Governor Jared Polis signed Senate Bill 26-189, repealing the 2024 Colorado AI Act and replacing it with the Colorado Automated Decision-Making Technology in Consequential Decisions Act. The new law takes effect 1 January 2027. It preserves consumer notice requirements but eliminates mandatory risk management program obligations and annual impact assessments.

3 min read

On 14 May 2026, Colorado Governor Jared Polis signed Senate Bill 26-189 into law, repealing Senate Bill 24-205 (the Colorado AI Act) and replacing it with the Colorado Automated Decision-Making Technology in Consequential Decisions Act. The new law takes effect 1 January 2027. Colorado enacted the first broad US state AI law in 2024 targeting automated decision-making; SB 26-189 represents the state legislature's revision of that approach after businesses raised concerns about compliance burden.

Senate Bill 26-189 applies to developers and deployers of covered ADMT, defined as automated decision-making technology used to materially influence a consequential decision. Consequential decisions include those affecting employment, housing, credit, education, access to healthcare, and access to essential services. Effective 1 January 2027, developers of covered ADMT must provide deployers with technical documentation specifying intended uses, categories of training data, known limitations, and instructions for appropriate human review. Deployers must give consumers clear and conspicuous notice at the point of interaction with a covered ADMT.

AI developers selling automated decision-making tools to Colorado-based employers, lenders, insurers, housing providers, and healthcare entities are within scope regardless of where the developer is incorporated. Deployers in those sectors must implement the consumer notice mechanism and confirm that developer documentation obligations have been fulfilled before deploying a covered system. Deployers retain responsibility for ensuring that human review processes are in place where required under the Act.

Senate Bill 26-189 eliminates three obligations from SB 24-205: the requirement for a risk management program aligned to the NIST AI RMF or ISO 42001; the requirement for annual impact assessments within 90 days of deployment; and the duty to self-report algorithmic discrimination harms to the Attorney General. The Colorado Attorney General has stated he will not enforce SB 24-205 or SB 26-189 until after the rulemaking process concludes. No rulemaking timeline has been announced. The precise scope of consequential decision and the threshold for a system to materially influence such a decision are expected to be addressed in rulemaking.

Licentium advises AI developers and deployers on US state-level AI regulatory compliance, including obligations under SB 26-189 and equivalent laws in Texas, Connecticut, and other jurisdictions. We assist with consequential decision mapping, developer and deployer obligation analysis, and consumer notice implementation. Work we undertake includes AI regulatory compliance assessments, US state AI law comparison analysis, automated decision-making governance advice, and rulemaking response preparation.

Source: Colorado General Assembly, Senate Bill 26-189, Automated Decision-Making Technology in Consequential Decisions Act, signed 14 May 2026

AI Regulatory

More from the journal

See all

Colorado Enacts SB 26-189 Replacing Prior AI Consumer Rules with Automated Decision-Making Technology Obligations, 2026

Colorado SB 26-189, the Automated Decision-Making Technology Act, repeals and replaces the consumer AI protections in SB 24-205, establishing new obligations for developers and deployers of covered automated decision-making technology in consequential decisions. Developer obligations take effect 1 January 2027. Violations constitute deceptive trade practices under the Colorado Consumer Protection Act, enforceable by the Attorney General.

UK Designates 18 Cryptocurrency Exchanges Under Russia Sanctions Regulations, 26 May 2026

On 26 May 2026, the UK designated 18 cryptocurrency exchanges under The Russia (Sanctions) (EU Exit) Regulations 2019, including Huobi Global S.A., operator of HTX, and three Georgian Russia-focused exchanges. OFSI confirmed HTX is subject to UK financial sanctions by reason of Huobi's ownership. The action marks the first time the UK has directly sanctioned cryptocurrency exchanges in connection with Russian sanctions evasion.

European Commission Opens Consultation on Draft Guidelines for High-Risk AI System Classification Under Article 6, June 2026

The European Commission has published draft guidelines clarifying when an AI system qualifies as high-risk under Article 6 of Regulation (EU) 2024/1689 (AI Act). A targeted consultation is open until 23 June 2026. The guidelines are not legally binding but reflect the Commission's interpretation and will guide market surveillance authorities and AI providers in applying the high-risk classification rules.

Ready to launch without the regulatory guesswork?

Book a 30-minute consultation. We'll map your AI or licensing path and tell you exactly what's required, in plain language.