Colorado's new AI law, explained for small businesses

If you run a business in Denver, Boulder or Arvada and you've started using AI (a chatbot on your site, an AI screening tool for job applicants, automated lead scoring), you probably heard in 2024 that Colorado passed the country's first broad AI law. You may also have heard it kept getting delayed. Here's where things actually stand.

What happened to the Colorado AI Act?

The original law, SB 24-205, was scheduled to take effect February 1, 2026, and was then pushed to June 30, 2026. Before that date arrived, the legislature went further: Governor Polis signed SB 26-189 on May 14, 2026, which repeals the original act's core provisions and replaces them with a new framework.

The practical headline for small businesses: the two most burdensome requirements are gone. The replacement law drops the mandatory risk-management program and the annual impact assessments the original law required.

What the new law covers

SB 26-189 is built around "automated decision-making technology": software, including AI, that processes personal data and is used to materially influence a consequential decision about a person. The law lists decisions about access to or provision of education, employment, property leases or purchases, financial services, insurance, healthcare, or essential government services.

What that means in plain terms:

• Probably not covered: AI that drafts your emails, summarizes meetings, writes product descriptions, sorts your inbox, or answers routine customer questions. These don't make consequential decisions about people.
• Worth a closer look: tools that screen or rank job applicants, score tenants or loan applicants, or help decide who gets approved for a lease, a financial product, insurance, or care.

What businesses using those tools will have to do

Instead of internal risk programs, the new law centers on what the affected person sees:

1. Give notice first: tell people before the technology is used to materially influence a consequential decision about them.
2. Explain adverse outcomes: when a decision goes against someone, give a plain-language description of the decision and the technology's role in it.
3. Allow corrections so people can access and fix inaccurate personal data that fed the decision.
4. Offer meaningful human review and reconsideration of adverse decisions, to the extent commercially reasonable.
5. Keep records for three years.

Only the Colorado Attorney General can enforce the law; there's no private right to sue under it. The AG is required to adopt rules clarifying the adverse-outcome disclosures by January 1, 2027, so some specifics may still be refined. The law has no general small-business exemption.

A 30-minute checklist for Front Range businesses

You don't need a lawyer on retainer to get oriented. Block half an hour and do this:

1. List every AI or automation tool you use. Include the ones built into software you already pay for (your CRM, hiring platform, scheduling or billing system). AI features often ship turned on.
2. Mark any tool that affects a decision about a person. Hiring, pricing, approvals, eligibility, access. Everything else can come off the list.
3. Ask those vendors one question: "How will your product help us meet Colorado SB 26-189's notice, explanation, and human-review requirements by January 1, 2027?" A good vendor will already have an answer.
4. Decide who reviews adverse decisions. A named person, not "the system."
5. Put a date on the calendar for December 2026 to check the Attorney General's rules, which are due by January 1, 2027.

The opportunity inside the regulation

Most small businesses in Colorado will find that the AI they actually use (drafting, summarizing, scheduling, answering common questions) sits outside this law. That's good news: the automations that save the most time are the low-risk ones. The law mainly asks you to be thoughtful about the few places where software decides something important about a person, which is simply good practice.

At Lab 5280 we build AI automation for businesses across Denver, Boulder and Arvada with this line in mind from the start: automate the busywork, and keep a person in the loop wherever a decision affects someone's job, money, or access.

This article is general information, not legal advice. For decisions about your specific situation, talk to a Colorado attorney.