Colorado Comprehensive AI Accountability Law Takes Effect June 30

SB 24-205 was supposed to be the nation's toughest AI law when it hit businesses on June 30. Instead, a constitutional lawsuit from Elon Musk's xAI, a DOJ intervention, and a 57-6 House vote have turned it into something barely recognizable.

---

Thirty-eight days before Colorado's sweeping artificial intelligence accountability law was scheduled to take effect, Governor Jared Polis signed a bill repealing and replacing it — leaving the most comprehensive state AI statute in American history as little more than a cautionary tale about the difficulty of regulating a technology that moves faster than any legislature can draft.

The original law, Senate Bill 24-205, was signed in May 2024. It was a first-of-its-kind statute in the United States: a risk-based framework that would have required developers and deployers of "high-risk" AI systems to use reasonable care to prevent algorithmic discrimination, conduct annual impact assessments, maintain documented risk management programs, and report discovered discrimination directly to the Colorado Attorney General. The trigger for those obligations was broad — any AI system that contributed significantly to decisions about employment, education, housing, healthcare, or financial and legal services qualified as high-risk. The law was set to take effect February 1, 2026. Then it was pushed to June 30. Then, on May 14, 2026, it was replaced entirely.

Two Years, One Repeal

The law that replaced SB 24-205 — Senate Bill 189, the Automated Decision-Making Technology (ADMT) Act — strips out virtually everything that made the original framework distinctive. Gone is the duty of care aimed at preventing algorithmic discrimination. Gone are the mandatory annual risk management programs aligned to industry standards like NIST AI RMF. Gone is the requirement to report discovered discrimination risks to the Attorney General. In their place is a narrower, disclosure-based framework focused on transparency: developers must hand deployers technical documentation describing intended uses, training data categories, and known limitations; deployers must give consumers clear notice when covered ADMT influences a consequential decision; and consumers gain the right to request human review of adverse outcomes and to correct inaccurate personal data.

The replacement bill passed by overwhelming bipartisan margins — 34-1 in the Senate, 57-6 in the House — and goes into effect January 1, 2027. Its enforcement mechanism remains with the Colorado Attorney General, who can pursue violations as deceptive trade practices under the Colorado Consumer Protection Act. A 60-day notice-and-cure period applies before the AG can initiate an action. There is no private right of action under either the old law or the new one.

"SB 189 removes many of the hallmarks of the Colorado AI Act — such as a duty of care, risk management programs, and impact assessments — in favor of a disclosure-based framework with limited rights in narrow circumstances," attorneys at Davis Wright Tremaine wrote in a client analysis published shortly after the bill's passage.

The Lawsuit That Accelerated Everything

The legislative reversal did not happen in a vacuum. It was preceded by a federal lawsuit and a politically significant intervention that put extraordinary pressure on Colorado lawmakers to act.

In early April 2026, xAI — the AI company founded by Elon Musk — filed suit in the U.S. District Court for the District of Colorado challenging SB 24-205's constitutionality on four grounds. The company argued that designing an AI model constitutes protected speech under the First Amendment, that the law's undefined terms ("algorithmic discrimination," "reasonable care," "high-risk artificial intelligence system") were unconstitutionally vague, that the law's Equal Protection carveout exempting diversity-promoting AI outputs amounted to "codified discrimination," and that the statute's application to any AI system touching a single Colorado resident ran afoul of the dormant Commerce Clause.

The case took a striking turn on April 24, when the U.S. Department of Justice moved to intervene on xAI's side — the first time the federal government had sought to join a lawsuit challenging a state AI law. Three days later, a federal magistrate judge stayed enforcement of the law, and Colorado Attorney General Phil Weiser agreed to halt enforcement pending the litigation's resolution. The stay formalized what was already a dead letter: a law suspended by a court and facing imminent repeal by the legislature that passed it.

"The U.S. Department of Justice has intervened in the xAI lawsuit challenging Colorado's 'algorithmic discrimination' law," the DOJ's Office of Public Affairs confirmed in a press release, noting that the department alleged SB 24-205 violated the Equal Protection Clause by compelling AI developers to discriminate based on protected characteristics.

Governor Polis and the Policy Work Group

The legislative pivot was not simply a reaction to the lawsuit. Governor Polis had been skeptical of the original law's breadth almost from the moment it passed. He signed SB 24-205 in 2024 while simultaneously urging the legislature to revise it before it took effect — an unusual posture for a bill signing. In late 2025, he convened the Colorado AI Policy Work Group to assess the law's flaws and recommend alternatives. The Work Group released a new framework on March 17, 2026. SB 189 followed closely behind, mirroring the Work Group's recommendations.

The criticisms that drove the revision were consistent across industry and academia: the original law's definition of "high-risk" was too broad, capturing routine software that touched any employment or financial decision; the impact assessment requirements were poorly defined and potentially duplicative of federal compliance work; and the law created substantial first-mover liability risk for Colorado-based AI developers relative to competitors in states with no such requirements. Opponents argued that SB 24-205 would push AI development out of Colorado without meaningfully protecting consumers.

What Remains — and What It Means

The practical effect of the transition from SB 24-205 to SB 189 is significant. Under the original law, a company deploying an AI hiring tool in Colorado would have needed a documented risk management program, an annual algorithmic impact assessment, a consumer notice-and-appeal process, and an obligation to self-report discovered bias to the state. Under SB 189's framework, that same company must provide technical documentation to any deployers downstream, give consumers a notice at the point of interaction with the AI, and allow consumers to request human review if the system produces an adverse outcome. The record-retention requirement — at least three years for compliance documentation — survives in the new law.

Whether SB 189 represents a meaningful consumer protection or a significant step back from accountability depends heavily on the rulemaking the Attorney General will undertake before January 1, 2027. The law grants the AG broad authority to define covered ADMT categories and set notice standards, meaning the effective scope of Colorado's AI rules will be shaped in the coming months by administrative process rather than legislative text.

For businesses that spent the better part of two years preparing SB 24-205 compliance programs — commissioning impact assessments, mapping AI systems against the high-risk taxonomy, building consumer appeal workflows — the repeal is a significant pivot. The compliance investment does not transfer cleanly to SB 189's transparency framework, though some documentation practices and consumer-facing infrastructure may prove reusable.

What to Watch Next

Colorado is not done with AI regulation; it has simply reset the clock. Attorney General Weiser will begin SB 189 rulemaking over the summer, and the shape of those rules will determine whether the new law has teeth or is little more than a disclosure checkbox. The xAI lawsuit, meanwhile, remains technically active: xAI agreed to submit a motion for preliminary injunction or an amended complaint within 28 days of Colorado adopting new legislation — meaning the constitutional questions raised about state AI laws are not resolved, only deferred. And with the DOJ's intervention setting a precedent for federal involvement in state AI regulation, Colorado's drama is unlikely to be the last of its kind as more states move toward AI accountability frameworks of their own.

The June 30 deadline that once hung over thousands of Colorado businesses will pass without incident. What takes its place — a transparency-first regime with a January 2027 effective date — is a quieter law, narrower in reach and gentler in obligation. Whether that makes it better policy, or simply more survivable politics, is a debate Colorado will be having for years.

---

Sources: Colorado General Assembly (leg.colorado.gov), Troutman Privacy Blog (troutmanprivacy.com), Wilson Sonsini (wsgr.com), Norton Rose Fulbright (nortonrosefulbright.com), Davis Wright Tremaine (dwt.com), U.S. Department of Justice (justice.gov), Rocky Mountain Voice (rockymountainvoice.com), IAPP (iapp.org), Morrison Foerster (mofo.com)