Colorado's AI law hits June 30: what the SB 189 replacement means for the 1-50 person operator using AI in hiring or client decisions

Colorado’s AI Act replacement is now signed law, and the deadline arithmetic has changed since this brief first ran. Governor Polis signed SB 189 on 14 May 2026; the signed law’s obligations take effect 1 Jan 2027, not 30 Jun 2026 as originally reported here (Holland & Knight, Seyfarth, and Littler client analyses, May 2026).

The original law, SB 24-205, signed in May 2024, was the first comprehensive state AI law in the US. It required risk-management programmes, annual impact assessments, and a full algorithmic-discrimination-prevention framework for both AI developers and deployers. It was substantive and operationally demanding, particularly for smaller organisations.

Both chambers of the Colorado legislature passed the replacement bill, SB 189, in May 2026. The replacement is a significant scaling-back: it drops the risk-management programme requirements and annual impact assessments, replacing them with a notice-and-transparency framework (Colorado Newsline, New bill would narrow scope of Colorado’s landmark 2024 AI law, 4 May 2026). The signing changed the timeline: the law repeals and re-enacts the original act, and the obligations now start 1 Jan 2027. The only item due before then is Colorado attorney-general rulemaking, also due by 1 Jan 2027.

Scaled back does not mean cleared. If your operation uses AI to make or materially influence a consequential decision about a Colorado resident, you have obligations under SB 189 from 1 Jan 2027 forward, and the rulemaking between now and then will set the small-operator specifics.

What SB 189 replaced and what it kept

The original SB 24-205 framework drew criticism from the US Chamber of Commerce, which argued it would hamper small-business AI adoption and that a gap-filling approach was preferable to the original law’s broad application. SB 189 addressed those concerns by removing the most operationally intensive requirements.

What is gone under SB 189: the full risk-management programme obligation (which required developers and deployers to maintain documented programmes for identifying and mitigating algorithmic discrimination risk), the annual impact assessments, and the extensive audit and documentation trail the original law required.

What remains under SB 189: a notice-and-transparency obligation for deployers of AI systems that make or materially influence consequential decisions about Colorado residents. The consequential decision categories are the same as the original law: employment, housing, credit, insurance, education, healthcare, and access to government services.

For a solo founder or 10-person agency, the practical shift is significant. The original law would have required a formal risk-management programme, which most small operators lacked the capacity to build. The replacement requires notice, disclosure, and documentation of a type that a small operation can implement in a working day. The obligation is real; the compliance cost is proportionate.

Operators within scope

The law applies to deployers of high-risk AI systems. The threshold is function, not firm size. If you use an AI system that materially influences a hiring decision for a Colorado-resident candidate, or that materially influences a credit, insurance, or similar assessment for a Colorado-resident client, you are a deployer within SB 189’s scope regardless of your headcount.

The key phrase is “materially influences.” An AI tool that filters resumes before a human reviews a shortlist materially influences the employment decision: it determines which candidates the human sees. An AI underwriting model that produces a risk score incorporated into a premium or coverage decision materially influences the insurance decision. A general-purpose chatbot that answers service questions without touching employment, credit, or similar categories is outside the law’s scope.

If you run any of the following, check SB 189’s scope against your specific use:

An AI-assisted applicant-screening or resume-scoring tool used with candidates who might be Colorado residents. A Claude, ChatGPT, or similar system that produces candidate summaries or rankings used in hiring decisions. An AI credit or financial risk assessment tool used with Colorado-resident clients. Any automated decisioning system that routes applications, claims, or service requests in the categories SB 189 covers.

The three-step compliance checklist

The SB 189 obligations reduce to three steps for a small operator. None require legal counsel to complete, though you should confirm the final enrolled bill text at leg.colorado.gov/bills/sb24-205 before taking operational action.

Inventory. List every AI tool your operation uses that produces an output that influences a hiring, credit, insurance, education, healthcare, or housing decision for anyone who might be a Colorado resident. If you use a third-party hiring platform with AI scoring, that platform’s AI function counts. You are the deployer; the vendor supplying the tool is the developer. Your notice obligation is to the individual affected, not to the vendor.

Notice. Draft disclosure language for affected individuals. The disclosure should state that an AI system was used in or materially influenced a decision affecting them, and that they may request human review. Plain language works. It does not need to be a legal document. It needs to be delivered before or at the point of the decision, not in buried terms of service.

Documentation. Ensure you can produce, if asked, a basic account of which AI system was used in a given decision, what it produced, and what the human decision-maker did with that output. If you cannot currently reconstruct that chain for a hiring decision made recently, add a documentation step to your current workflow before 1 Jan 2027.

The 1 Jan 2027 date matters even in a scaled-back framework

The US Chamber of Commerce won significant concessions in the move from SB 24-205 to SB 189. The risk-management programme burden is gone. The annual assessment burden is gone. What remains is an obligation that exists at all firm sizes, takes effect on a fixed date, and has a 42-state attorney general coalition that has signalled coordinated AI enforcement pressure for 2026.

A scaled-back law is not an unenforced law. The notice-and-transparency obligations under SB 189 are structurally simpler than what the original law required, but they require a decision to take action before 1 Jan 2027. The documentation step, in particular, needs to be in place before decisions are made, not after complaints arise. The extra runway the signing produced is a reason to build the workflow calmly, not a reason to shelve it.

If your operation uses AI in any of the covered categories and serves Colorado-resident individuals, 1 Jan 2027 is the date, and the attorney-general rulemaking due by the same date is the thing to watch for small-operator specifics.

Claim OPS-071 is registered in the Holding-up ledger. Reviewed 10 Jun 2026 (status Partial — see correction log). Next review: 25 Jul 2026. Sibling: AM-158 (EU AI Act enterprise compliance).