What Colorado Actually Changed
Colorado enacted SB 24-205 in 2024 as the first comprehensive state law targeting high-risk AI systems in consequential decisions. The original law required developers and deployers to maintain documented risk management programs, conduct impact assessments, mitigate algorithmic discrimination, and provide an NIST/ISO affirmative defense pathway. It covered decisions in education, employment, housing, financial services, insurance, healthcare, and government services — and state agencies were deployers within its scope.
Industry pushback delayed the law's implementation date; it was never enforced. On May 14, 2026, Governor Polis signed SB 26-189, which repeals SB 24-205 before it took effect and replaces it with a narrower ADMT framework effective January 1, 2027.
What the new law requires from developers: technical documentation covering the ADMT's intended uses, categories of training data, known limitations, and instructions for appropriate use and human review. Material updates must be disclosed to deployers.
What the new law requires from deployers: a clear and conspicuous pre-use notice to consumers when covered ADMT materially influences a consequential decision. After an adverse outcome, deployers must provide a plain-language explanation within 30 days and offer meaningful human review and reconsideration. Both parties must retain compliance records for at least three years.
What the new law removed: mandatory risk management programs, impact assessments, the NIST/ISO affirmative defense, and the duty of care against algorithmic discrimination. The Colorado Attorney General has exclusive enforcement authority, with a 60-day cure period. The AG must complete rulemaking before January 1, 2027.
The coverage scope is similar to the original: "consequential decisions" include those related to education, employment, housing, financial and lending services, insurance, healthcare, and — directly applicable to state agencies — essential government services and public benefits. Benefits eligibility determinations, Medicaid and SNAP case processing, unemployment claim adjudications, and similar automated or AI-assisted decisions fall within this definition. State agencies deploying covered ADMT in those processes are deployers under Colorado law.
The State AI Law Landscape Has Expanded, Not Contracted
The Colorado change has coincided with federal pressure on state AI laws, and the combination can read as a general retreat from state AI governance. It is not.
As of November 1, 2026, the Kensington State AI Policy Tracker lists enacted laws governing state government AI use, inventories, impact assessments, or AI councils in California, Colorado, Connecticut, Delaware, Florida, Idaho, Illinois, Indiana, Kentucky, Maryland, Montana, New York, Tennessee, Texas, Utah, Vermont, Washington, and West Virginia — eighteen states. A further nineteen jurisdictions including the District of Columbia have AI executive orders covering state agency AI use. The tracker was updated November 1, 2026.
The federal posture has been explicitly preemptive. President Trump's December 11, 2025 executive order "Ensuring a National Policy Framework for Artificial Intelligence" directed the DOJ to challenge state AI laws deemed burdensome and threatened BEAD broadband grant conditions for noncompliant states. A June 2, 2026 executive order (EO 14409) focused on AI security and frontier model benchmarking at the federal level. States retain their own enforcement authority under consumer protection law, and federal preemption of state AI law faces significant constitutional constraints under current doctrine. The practical effect on state agency planning is uncertainty about long-term legal architecture — not resolution.
The point is not that states face a simple compliance picture. They face a complicated one, with requirements multiplying in some jurisdictions while narrowing in others, and federal direction that may or may not survive legal challenge. For a state program director responsible for AI systems that process resident data across multiple programs and functions, the useful question is not "what does the law currently require in our state" but "what governance infrastructure makes us capable of complying with any of these frameworks at the time they apply."
Why the Operational Risk Did Not Narrow With the Law
SB 24-205's risk management requirements rested on a documented practical basis: AI-assisted decisions in benefits, housing, employment, and healthcare produce adverse outcomes that are difficult to identify and correct without systematic documentation. When an automated system misclassifies a benefits applicant, the affected resident typically receives a denial letter, not an explanation of the system's role or a path to meaningful review. The original law was designed to produce the documentation that makes that explanation possible.
SB 26-189 requires the same documentation — indirectly. A deployer that cannot explain an adverse ADMT-driven outcome in plain language within 30 days did not have the underlying documentation in the first place. The 30-day explanation clock assumes an auditable decision process: the system's role in the decision, the inputs it processed, the output it generated, and the human review that occurred or could occur. Without that process, the 30-day explanation is a guess, not a disclosure.
This is where the continuity risk sits for state agencies that built AI governance infrastructure under the original law's more demanding requirements. That infrastructure — system inventories, impact assessment processes, vendor documentation standards, human review protocols, logging at the decision level — is not compliance overhead now that the legal mandate is narrower. It is the precondition for satisfying the narrower mandate. An agency that dismantles its AI governance program because the law simplified will face the same documentation gap when it needs to explain an adverse outcome to a resident — or to the AG during a cure period.
What to Maintain Regardless of the Current Mandate Level
The following practices have operational value independent of the mandate level and are also necessary, directly or structurally, for SB 26-189 disclosure compliance.
AI system inventory. You cannot provide required pre-use consumer notice for covered ADMT without knowing which systems qualify as covered ADMT under SB 26-189's scope — technology that processes personal data, uses computation to generate output, and is used to influence a decision about an individual in a consequential domain. Many state agencies have deployed AI and machine learning systems incrementally across separate programs. The inventory forces the scoping question and makes the coverage analysis possible.
Vendor documentation requirements. SB 26-189 requires developers to provide technical documentation covering training data categories, known limitations, and instructions for appropriate use and human review. If your agency's existing AI vendor contracts do not include those provisions, you have a vendor management problem, not just a governance gap. Procurement officers should add these requirements to new contracts before January 1, 2027; existing contracts should be reviewed for amendment opportunities.
Structured human review process. The human review right under SB 26-189 must be "meaningful" — a term the AG will define through rulemaking before the effective date. A general appeals process that does not distinguish AI-assisted decisions from non-automated ones is unlikely to satisfy that standard. Agencies that have documented AI-specific review procedures are positioned to demonstrate compliance; agencies that will need to construct them under enforcement pressure are not.
Adverse outcome logging. The 30-day clock to provide a plain-language explanation starts at the adverse outcome. Running that clock requires knowing when an adverse outcome occurred, which AI system influenced it, and what inputs and outputs the system produced. That requires logging at the decision level — not aggregate model metrics, but individual decision attribution. Agencies that built this logging for impact assessment purposes under the original law's requirements should retain it.
Decision Sequence for State Program Directors
The practical question is not whether to maintain AI governance infrastructure. It is how to allocate governance investment when the legal minimum has narrowed and budget pressure is real.
For agencies with existing AI risk management programs: audit which elements directly support SB 26-189 compliance — inventory, vendor documentation, human review procedures, decision logging. Retain those elements as core operating infrastructure. Risk management processes that operated as internal documentation exercises without operational use can be consolidated; the disclosure compliance functions cannot.
For agencies building AI governance from scratch: the SB 26-189 floor is actually demanding in its operational requirements. Satisfying the 30-day explanation clock, the human review right, and the pre-use notice provision requires documentation infrastructure that takes time to build. Begin with the inventory, set vendor documentation requirements in new contracts, and establish decision logging before the January 1, 2027 effective date.
For agencies in states other than Colorado: eighteen states have enacted AI laws and nineteen jurisdictions have executive orders. California's 2026 executive order on trusted AI procurement, New York's LOADinG Act, and Maryland's AI Governance Act each create independent requirements. Colorado's ADMT framework is a reasonable structural template for thinking about disclosure, human review, and vendor accountability obligations even where it does not directly apply.
The operational check for any deployed AI system influencing resident-facing decisions: if this system produces an adverse outcome for a resident tomorrow, can your agency explain it in plain language within 30 days, demonstrate what documentation it relied on, and confirm that a human reviewer is available? If the answer is no, that is a governance gap regardless of the current legal requirement in your state.
Sources and further reading
- SB 26-189, Colorado General Assembly, enacted May 14, 2026
- Kensington State AI Policy Tracker, as of November 1, 2026
- CRS In Focus IF13268: EO 14409, Controlling Advanced Artificial Intelligence, July 9, 2026
- VerifyWise: US AI Regulations 2026 — Colorado SB 26-189
Spartan X has supported AI program design for state government agencies — including AI strategic advisory to state leadership on governance architecture and technology deployment — where the practical test of a governance investment is whether it produces the operational capability to explain, review, and correct AI-assisted decisions when they produce adverse outcomes. That question is the same one Colorado's ADMT statute is asking. Agencies that built their governance programs around it are better positioned than those that did not, independent of where the mandate currently sits.
