Colorado Just Walked Back Its AI Act. Here’s What That Signals.

On May 12, 2026, Colorado lawmakers passed SB 189, repealing and replacing the Colorado Artificial Intelligence Act before its February 2026 effective date. The original Act would have imposed a duty of care on developers and deployers of high-risk AI systems, required risk management programs, and mandated algorithmic impact assessments. The replacement framework is materially lighter — primarily disclosure-based, with limited individual rights.

What changed

• Out: Duty of care, mandatory risk-management programs, algorithmic impact assessments, broad consumer rights to challenge adverse AI-driven decisions.
• In: Disclosure requirements (notify consumers when AI is being used in significant decisions), limited rights of correction, and reduced enforcement scope.
• Unchanged: The underlying state interest in regulating AI in consumer-impacting domains. SB 189 walks back implementation, not intent.

Why this matters beyond Colorado

Colorado was the first state to enact a comprehensive AI accountability law modeled on the EU AI Act. Its retreat signals two things to other state legislatures considering similar bills (Virginia, Connecticut, Illinois, and a half-dozen others have drafts in committee):

• Implementing risk-management frameworks at the state level is politically and operationally difficult before federal direction is clear.
• Industry pushback on prescriptive duty-of-care frameworks has been effective. Expect the next wave of state AI bills to lean toward disclosure regimes rather than risk-management mandates.

What this means for your business

If you were building a Colorado AI Act compliance program targeting the February 2026 deadline, that program does not become obsolete. The investment in identifying which of your AI systems make significant decisions, documenting their training and inputs, and assessing their adverse-impact risk remains valuable — both for California’s ADMT regime (which is live) and for the EU AI Act (which applies to anyone with EU customers). Colorado’s retreat is a reprieve from one specific deadline, not from AI governance generally.

The Carlson Firm advises clients to maintain their AI inventory and risk-assessment work regardless of Colorado’s SB 189. If anything, the patchwork of state AI rules is about to get more complex, not less.