Colorado's AI Law Keeps Changing Dates. Here's What Actually Applies

If you run a small business and you half-remember hearing that Colorado passed a strict AI law, and then half-remember hearing it got delayed, and now aren't sure if it's dead, on hold, or quietly coming for you in a few months — you have followed this story exactly as closely as it deserved. It has been delayed once by a special session, paused by a federal court, and then rewritten from the ground up. Three different things, each reported at the time as "the Colorado AI law changed," and each one different from the last.

That history has split small businesses into two camps, and both are wrong. One camp saw the original 2024 law — impact assessments, algorithmic discrimination duties, an attorney general disclosure regime — and built a compliance program for a statute that no longer exists in that form. The other camp watched the delays stack up, decided the whole thing was legislative theater, and stopped paying attention. The actual position in September 2026 is calmer than the first camp fears and firmer than the second camp assumes.

01How we got four effective dates from one law

Colorado passed the original Colorado AI Act, SB 24-205, in 2024. It was ambitious: developers and deployers of "high-risk" AI systems would owe duties around risk management, discrimination prevention, and detailed impact assessments, with an effective date of 1 February 2026.

That date never arrived intact. In August 2025, Governor Polis signed SB 25B-004 after a special legislative session failed to agree on substantive amendments — the entire output of that session was a find-and-replace, pushing the date to 30 June 2026. Then, in April 2026, xAI sued Colorado in federal court, arguing the law was unconstitutionally vague and invited arbitrary enforcement; the Department of Justice intervened in support. A federal magistrate judge issued a stipulated order pausing enforcement while the legislature reconsidered the law's scope.

The legislature took that opening and did something bigger than another postponement: it repealed SB 205 outright and reenacted a substantially different law, SB 26-189, signed 14 May 2026. That is the version that matters now, and its effective date is 1 January 2027.

Compiled from law-firm reporting and Colorado legislative records current as of this article's publication. xAI's litigation is ongoing against both the original and reenacted versions of the law, so this date could move again before January 2027 — treat it as the current best estimate, not a certainty.

02What SB 189 actually requires, in plain terms

SB 189 replaces the old "high-risk AI system" framework with something narrower called covered "automated decision-making technology," or ADMT — systems that use computation or machine learning to materially influence a "consequential decision." Consequential decisions are the ones with real stakes: employment, education, housing or other property transactions, financial services and lending, insurance, healthcare, and access to government services.

The law keeps the developer/deployer split from the original act, but shrinks what each owes:

• Developers — the companies that build, sell, license, or substantially modify covered ADMT — must give deployers technical documentation describing intended uses, training data categories, and known limitations, and must notify deployers of material updates.
• Deployers — the businesses that actually use covered ADMT to make or influence a consequential decision — must give consumers clear, conspicuous notice before the technology is used, disclose adverse-outcome decisions in plain language within 30 days, offer a path to correct inaccurate personal data, and provide meaningful human review of adverse decisions on request.

Gone, compared with the original 2024 law: mandatory risk-management programs, annual impact assessments, the affirmative duty to use "reasonable care" to prevent algorithmic discrimination, and detailed attorney-general disclosure filings. What replaced them is smaller and closer to a notice-and-consumer-rights law than a full AI governance mandate.

03Are you a "deployer"? Probably closer than you think

"Deployer" is not a technical term reserved for AI companies. Under this framework it means any business doing business in Colorado that uses a covered ADMT to make, or materially influence, a consequential decision about a person. You do not have to build the AI. You just have to use it for one of the listed purposes.

Run through the ordinary small-business version of this list, not the dramatic one:

• An applicant-tracking or resume-screening tool that scores or ranks job candidates — employment.
• A tenant-screening or credit-scoring tool used in a leasing decision — housing.
• An underwriting or pricing tool that sets loan or insurance terms — financial services or insurance.
• A clinical-decision-support tool that influences a diagnosis or treatment recommendation — healthcare.

If none of that describes what you run, you may not be a deployer under this law at all — a chatbot that answers product questions or a tool that drafts marketing copy is not, on its own, making a consequential decision in the statute's sense. But the moment a vendor adds an AI-scored ranking feature to your hiring or leasing software, you can become a deployer without changing anything about how you use the product. That shift happens on the vendor's release notes, not on your calendar, which is exactly the trap: nobody sends you a notice that your obligations changed.

04The small-business exemption question we can't fully answer

The original SB 24-205 carved out businesses with fewer than roughly 50 full-time employees, conditioned on not training the AI system on their own data and passing along the developer's impact assessment to consumers. That exemption is one of the most-cited reasons small businesses assumed this law was someone else's problem.

Whether SB 189 preserves an equivalent carve-out, and at what employee count, is reported inconsistently even among firms that track this bill for a living — we saw both a 50-employee threshold and a 40-employee threshold cited for the reenacted law in different September 2026 summaries, with no single source resolving the discrepancy. We are not going to pretend to a precision the public record doesn't currently have. If your employee count is anywhere near that boundary, this is a five-minute question for counsel, not something to infer from a blog post — yours or ours.

What we can say with more confidence: exemptions in laws like this one are almost always conditional, not absolute. Even under the old 50-employee threshold, you lost the exemption the moment you trained the system on your own data. A small business fine-tuning a hiring tool on its own applicant history is doing exactly the thing that voids that kind of carve-out. Don't treat "we're small" as the end of the analysis.

05Enforcement, and why "paused" doesn't mean "gone"

Two separate things are true at once, and conflating them is where most of the confusion in this story comes from.

First: enforcement of the original SB 205 is currently stayed by a federal court order, the product of xAI's lawsuit and the DOJ's intervention. Second: the Colorado legislature responded to that lawsuit not by backing down but by passing a new law anyway, and the Attorney General's office is actively building the enforcement machinery for it — proposed ADMT rules were filed 11 August 2026, with a rulemaking hearing on 26 October 2026, timed to have final rules ready alongside the 1 January 2027 statutory effective date.

xAI has signaled it intends to challenge SB 189 as well, and under a stipulated agreement it will hold any comprehensive injunction motion until 28 days after the rulemaking is finalized. That means a realistic read is: nothing is enforceable today, something becomes enforceable around January 2027 unless a court intervenes again, and practical enforcement action is unlikely to start before early-to-mid 2027 even if the date holds. When it does land, enforcement runs exclusively through the Colorado Attorney General under the state's consumer protection act, with no private right of action for consumers, and a 60-day cure period for first violations that itself expires in January 2030.

06What to do now, regardless of the exact date

The date will probably move again — it has moved three times already. That is a reason to build something durable, not a reason to do nothing.

• Inventory where AI touches a hiring, lending, leasing, insurance, or healthcare decision. This is the same exercise the shadow-AI inventory already asks for; run it with an eye specifically toward consequential decisions this time.
• Ask any vendor selling into those categories one direct question: does this product's AI feature make or materially influence a decision about employment, housing, credit, insurance, healthcare, or a government service? Get the answer in writing, alongside the documentation SB 189 will require developers to hand deployers anyway.
• Confirm your actual employee-count exposure with counsel rather than a secondhand summary — that includes this article. The public reporting on SB 189's small-business threshold is not consistent enough to rely on.
• Build the notice-and-human-review habit before it's mandatory. Telling someone an automated tool was involved in a decision and giving them a path to a human review isn't just a Colorado requirement — it's close to what most emerging state AI laws converge on, and cheap to do early.
• Don't confuse "paused" with "repealed." A federal stay on the old law did not kill Colorado's appetite for regulating this; it produced a second, still-live law with active rulemaking behind it. Treat the 1 January 2027 date as real until you have a specific reason not to.
• Check this against the wider map, not just Colorado. If you operate outside Colorado too, or expect to, the state-by-state rundown and the EU AI Act piece cover the same "who actually counts as regulated" question for other jurisdictions.

07The honest summary

Colorado has not backed off AI regulation; it has rewritten it, twice, under real legal pressure, and is currently building the rulebook for a January 2027 start. The version worth worrying about today is smaller than the 2024 original — no mandatory impact assessments, no broad discrimination-prevention duty — but it still reaches ordinary small-business uses of AI in hiring, lending, leasing, insurance, and healthcare, under a "deployer" label that doesn't require you to have built anything.

The businesses that panicked over the 2024 version were preparing for a law that no longer exists. The ones that tuned out after the delays are underestimating a law that a state attorney general is actively writing enforcement rules for right now. Neither extreme is the right amount of attention. The right amount is: know whether you're a deployer, get the employee-count exemption question answered by someone who can actually answer it, and build the notice-and-review habit before a court or a legislature forces the issue on a shorter timeline than January 2027.

08Common questions

---

Law checked 18 September 2026, against Colorado legislative records and 2026 law-firm reporting including Akin Gump, Hunton Andrews Kurth, Crowell & Moring, Davis Wright Tremaine, Holland & Knight, McDermott Will & Schulte, Norton Rose Fulbright, and Seyfarth Shaw coverage of SB 24-205, SB 25B-004, SB 26-189, and the xAI v. Colorado litigation. This is not legal advice. The employee-count exemption threshold under SB 189 was reported inconsistently across sources as of this date and should be confirmed directly with counsel; the 1 January 2027 effective date is current but has moved three times since 2024 and remains subject to pending litigation. Related: The State AI Law Map, The EU AI Act, August 2026, and AI in Hiring.

Hero image from Unsplash, used under the Unsplash License.