On May 14, 2026, Colorado Governor Jared Polis signed SB 189, materially revising the Colorado Artificial Intelligence Act and postponing its effective date from June 30, 2026 to January 1, 2027. The delay gives developers and deployers of AI systems that affect Colorado consumers meaningful additional runway to build compliance programs, evaluate vendor arrangements, and align internal governance with the amended framework. For many organizations that had accelerated implementation efforts to meet the original deadline, the revised timeline offers a valuable opportunity to reassess priorities and sequence remaining work more deliberately.
Beyond the timing shift, SB 189 substantially narrows the substantive obligations imposed on covered entities. Most notably, the amendment eliminates the previously enacted duty of care to protect Colorado consumers from algorithmic discrimination. It also removes the deployer-facing risk management program requirements and the obligation to conduct impact assessments for high-risk AI systems. Together, these changes represent a significant reduction in the compliance burden that had been the centerpiece of the original statute, and they respond to concerns raised by industry stakeholders regarding the operational cost and complexity of the prior regime.
In place of those obligations, SB 189 introduces a more focused set of requirements. Covered entities will be subject to narrower disclosure duties concerning the use of certain AI systems, along with a three-year records retention rule intended to preserve information relevant to potential enforcement inquiries. The amendment also establishes a 60-day pre-enforcement cure period administered by the Colorado Attorney General, allowing entities an opportunity to address alleged violations before formal enforcement action proceeds. This cure mechanism, combined with the Attorney General's continuing role as the primary enforcement authority, provides a defined process that businesses can build into their incident response and compliance escalation procedures.
Organizations that develop or deploy AI systems reaching Colorado consumers should use the extended runway to refine disclosure practices, implement compliant recordkeeping systems, and prepare internal protocols for responding to Attorney General inquiries within the 60-day window. Reviewing existing vendor contracts and governance documentation will also help ensure alignment with the amended statute before it takes effect.
This alert is provided for general informational purposes only, and clients should seek tailored legal advice regarding how the amended Colorado AI Act applies to their specific circumstances.