Colorado Repeals Landmark AI Act, Scrapping Mandatory Risk Assessments and Pre-Use Impact Reports

Colorado made history in May 2024 by passing the nation's first comprehensive artificial intelligence regulation, setting a high-water mark for state-level tech governance. But mere weeks before the landmark Colorado Artificial Intelligence Act was set to take effect, the state abruptly dismantled its own creation. On May 14, 2026, Governor Jared Polis signed Senate Bill 26-189, repealing the original framework and replacing it with a significantly lighter-touch regime. The reversal marks a watershed moment in US technology policy, signaling the immense legal and political pressure state legislatures face when attempting to regulate frontier AI systems.[1]

The repealed legislation, known as SB 24-205, was heavily inspired by the European Union's AI Act. It was designed as a proactive, risk-based regime aimed at preventing algorithmic discrimination before it could harm consumers. The law targeted "high-risk" AI systems—defined as any machine-based system that served as a substantial factor in making consequential decisions. These consequential areas included employment, housing, healthcare, insurance, lending, and essential government services, casting a wide net over how businesses integrated machine learning into their daily operations.[7]

Under the original framework, the compliance burden was heavy and front-loaded. Developers and deployers of these high-risk systems were bound by a strict legal duty of care to avoid algorithmic discrimination. To prove they were meeting this standard, companies were required to establish formal risk management programs, conduct rigorous annual impact assessments, and maintain extensive documentation regarding their training data and system architecture. If a system demonstrated a risk of bias, companies were mandated to report those findings directly to the Colorado Attorney General.[3][5]

Almost immediately after its passage, the law faced intense and sustained opposition from the technology sector. Industry groups and AI developers argued that the requirements were technically unworkable and legally ambiguous. Critics warned that the broad definition of "high-risk" would capture routine software functions, stifling innovation and placing a disproportionate, crushing compliance burden on smaller startups that lacked the resources to conduct continuous algorithmic audits.[1][5]

The simmering industry frustration reached a boiling point in April 2026, when x.AI, the artificial intelligence company founded by Elon Musk, filed a federal lawsuit seeking to enjoin the law's enforcement. The lawsuit argued that the Colorado AI Act's sweeping mandates violated constitutional protections and overstepped state authority by attempting to regulate interstate commerce and dictate the fundamental architecture of algorithmic models.[1][5]

The state-level retreat was ultimately forced by an unprecedented federal intervention. In a highly unusual move, the US Department of Justice intervened in the x.AI lawsuit to challenge the Colorado law alongside the private developer. This federal action aligned with a December 2025 executive order from the Trump administration, which established an AI Litigation Task Force specifically charged with identifying and challenging state-level AI regulations that threatened to create a fragmented, state-by-state compliance patchwork.[1][7]

Facing a costly, multi-front legal battle against both a major AI developer and the federal government, Colorado lawmakers opted to surrender the risk-based regime. The Colorado Attorney General agreed to suspend enforcement of the original act pending a legislative rewrite. Within a matter of weeks, the state legislature drafted, passed, and sent the replacement bill, the Automated Decision-Making Technology Act (ADMT Act), to the governor's desk, effectively erasing two years of regulatory groundwork.[1][5]

Taking effect on January 1, 2027, the new ADMT Act fundamentally alters the philosophy of AI regulation in the state. The revised statute abandons the concept of algorithmic discrimination entirely. It strips away the proactive mandates, eliminating the requirements for formal risk management programs, annual impact assessments, and the explicit duty of care. In their place, the law establishes a reactive, disclosure-based model focused on consumer transparency rather than algorithmic auditing.[3]

The scope of the new law is also significantly narrower. It replaces the broad "high-risk AI system" classification with a more targeted focus on "Automated Decision-Making Technology" (ADMT). Under the new definitions, ADMT only falls under regulatory scrutiny if it processes personal data and is used to "materially influence" a consequential decision. This subtle shift in language excludes routine technologies, internal research models, and low-stakes use cases from the compliance perimeter, offering a major concession to enterprise software developers.[2][5]

For consumers, the new framework trades systemic algorithmic safety for individualized transparency rights. Companies deploying ADMT must provide clear, conspicuous disclosures to consumers before the technology is used to make a consequential decision. If the AI system contributes to an "adverse outcome"—such as denying a loan, rejecting a job application, or reducing healthcare benefits—the company must provide a detailed explanation of the decision within 30 days.[3]

Crucially, the ADMT Act grants consumers the right to request a meaningful human review of any adverse outcome materially influenced by AI. Consumers also gain the right to access and correct inaccurate personal data that the automated system relied upon to make its determination. However, unlike earlier drafts of privacy legislation in other states, the Colorado law does not grant consumers a blanket right to opt out of the use of automated decision-making entirely.[2][6]

While developers of foundation models may celebrate the reduced compliance burden, the new law fundamentally shifts legal risk downstream to the companies actively deploying the technology. Under the repealed law, employers and lenders could theoretically rely on system-level compliance and developer-provided impact assessments to shield themselves from liability. Now, the ADMT Act enforces decision-by-decision accountability. Deploying companies must be prepared to consistently explain and defend the specific inputs and constraints that led to every individual AI-assisted rejection.[4][6]

To enforce this new dynamic, the ADMT Act strictly regulates how liability is shared between the creators of AI models and the businesses that use them. The law explicitly voids contractual clauses that attempt to indemnify a party for its own violations. Developers are only held liable to the extent that the ADMT was used exactly as intended, documented, and marketed. If a hospital or bank uses an AI tool in a novel way that the developer did not authorize, the deploying organization bears the full legal responsibility for any resulting harm.[2][3]

Enforcement of the new regime remains exclusively in the hands of the Colorado Attorney General. The legislature explicitly declined to include a private right of action, meaning consumers cannot directly sue companies for violating the ADMT Act. Instead, the Attorney General's office will oversee compliance, offering companies a 60-day notice-and-cure period to rectify transparency failures or documentation errors before imposing financial penalties. This cure period will remain in effect until January 2030, giving the industry a multi-year runway to adapt.[4]

Colorado's rapid reversal effectively ends the prospect of a fragmented, EU-style risk management regime taking root across individual US states. By aligning with California's disclosure-centric approach, Colorado has helped solidify a distinctly American model of AI governance—one that prioritizes post-incident transparency and individual recourse over proactive algorithmic auditing. As the 2027 effective date approaches, companies operating nationwide now have a clearer, albeit less stringent, baseline for integrating automated decision-making into the economy.[7]