What changed in Colorado’s AI law—and which requirements should buyers stop using?

Colorado’s operative planning baseline is the 2026 replacement legislation, not an unchanged implementation of the original 2024 AI Act. SB26-189 repealed and reenacted the earlier provisions; the Attorney General identifies 1 January 2027 as the new law’s effective date. The rulemaking page records a formal hearing on 26 October 2026; the material reviewed does not establish that the implementing rules have been finalised. (coag.gov)

Who is affected?

The enacted legislation addresses developers and deployers of covered automated decision-making technology that materially influences consequential decisions. Those decisions include access, eligibility or compensation concerning employment, education, housing, financial or lending services, insurance, healthcare and essential government services. Specified exemptions require separate assessment. (leg.colorado.gov)

The law includes developer documentation, material-update notifications, consumer notices, correction and human-review rights, and record retention of at least three years. It also provides for a plain-language description following an adverse consequential decision within the specified 30-day period. (leg.colorado.gov)

What should change in the GRC implementation programme?

Recommended action: create a versioned replacement project rather than editing the title of an old “Colorado AI Act” control set.

• Identify records built from the original legislation or earlier implementation dates.
• Classify each use by its actual decision, population, owner and developer/deployer role.
• Link technical documentation to the deployed version—not merely the supplier’s name.
• Connect adverse-outcome handling to notices, correction requests and meaningful human review.
• Preserve the legal rationale for any exemption or exclusion.
• Track draft implementing rules separately from the enacted statute.

Demo scenario: use one technology in both an internal drafting assistant and an employment-screening process. Require the supplier to support different applicability outcomes without duplicating the entire technology record.

For procurement, ask whether notices and review cases can be handled in the existing privacy or case-management system. An enterprise GRC platform should coordinate accountability; it need not become the operational system for every consumer interaction.