June 30, 2026 was supposed to be the day the United States got its first comprehensive artificial intelligence statute. Colorado's Senate Bill 24-205 — signed in May 2024 and modeled on the European Union's risk-based approach — was set to impose a duty of reasonable care on developers and deployers of high-risk AI systems, plus impact assessments and risk management programs.
The date came and went. Nothing happened. By then the law had been stayed by a federal court, then erased from the statute books entirely.
Three weeks before the deadline, on May 14, 2026, Gov. Jared Polis signed SB 26-189, repealing and reenacting the Colorado AI Act as a far narrower disclosure regime governing automated decision-making technology, or ADMT. It takes effect January 1, 2027. Until then, the state that wrote the template for American AI regulation has no AI-specific consumer protection law in force at all.
How a landmark law collapsed in six weeks
The unraveling began in court. On April 9, 2026, Elon Musk's xAI sued in federal court in Denver to enjoin SB 24-205 on First Amendment, dormant Commerce Clause, due process and equal protection grounds. Two weeks later the Justice Department intervened — the first time the federal government has moved to invalidate a state AI law under the President's December 2025 executive order targeting what it called excessive state regulation of AI. DOJ focused on the statute's carve-out permitting algorithmic adjustments intended to advance diversity or redress historic discrimination.
“Laws that require AI companies to infect their products with woke DEI ideology are illegal,” said Assistant Attorney General Harmeet K. Dhillon of the Justice Department's Civil Rights Division.
Attorney General Phil Weiser did not fight it. On April 24 his office joined a stipulated motion pausing enforcement, telling the court he would not promulgate implementing rules or enforce the act until rulemaking concluded. Magistrate Judge Cyrus Y. Chung granted the stay on April 27, barring enforcement until 14 days after a ruling on a preliminary injunction motion xAI has not yet had occasion to file.
That left the legislature two weeks before its May 13 adjournment. SB 26-189, drawn almost verbatim from a draft by a Polis-convened task force whose meetings were not fully public, cleared committee unanimously days later.
What survived, and what did not
The replacement drops SB 24-205's core architecture: the duty of care against algorithmic discrimination, mandatory impact assessments, risk management program requirements, and the rebuttable presumption of compliance for deployers following the NIST AI Risk Management Framework.
What remains is procedural. Businesses using “covered ADMT” to process personal data that materially influences consequential decisions — in employment, housing, lending, insurance, health care and education — must disclose that fact, provide more information on request after an adverse decision, and retain records for three years. Enforcement runs through the Colorado Consumer Protection Act, with a 60-day right to cure that sunsets January 1, 2030.
Sen. Robert Rodriguez, the Denver Democrat who authored both bills, was blunt about the cost. His original framework, he told colleagues, could not withstand the “massive amounts of money” technology companies were spending on AI policy.
“We could have probably built a wing here at the Capitol — built us our own ballroom — with the amount of money that's been spent on this topic,” Rodriguez said. Of the replacement: “It's not as comprehensive, and I am not happy with that.” He described it as whittled down to “no testing, no requirements — it just tells you an (automated) decision's been made.”
Supporters counter that a negotiated law that survives beats an ambitious one that gets enjoined. “Tradeoffs and concessions were made on all sides,” said Adam Fox, deputy director of the Colorado Consumer Health Initiative and a task force member. Loren Furman, president of the Colorado Chamber of Commerce, called the outcome proof that “when you put the right people in the room to work on a complex issue, it can be done.”
The Center for Democracy and Technology was less charitable, calling it unfortunate that “once again Colorado officials have decided to delay protecting their constituents from the real and documented harms of AI in decisions affecting people's lives and livelihoods.”
Analysis: the EU model loses its American beachhead
SB 24-205 was the test case for whether an ex ante, risk-based compliance model could be grafted onto American state law. The answer, for now, is that it could not survive litigation risk, a hostile federal executive, and industry spending a state legislature could not absorb.
The business case was not purely ideological. Palantir, which moved its headquarters from Denver to suburban Miami, cited Colorado's AI regime in SEC filings, warning compliance “may be difficult, onerous, and costly.” Polis flagged misgivings about Colorado “going it alone” even as he signed the 2024 bill.
The counterargument is equally real: disclosure regimes shift the burden of detecting discrimination onto the people least equipped to detect it. Knowing an algorithm denied your loan tells you nothing about whether it did so for a prohibited reason. The original bill made the deployer prove diligence; the new one makes it announce itself.
Colorado's collapse has not triggered a general state retreat — California, Texas and Utah continue advancing AI rules from opposite ends of the political spectrum. Colorado's distinctiveness was its comprehensiveness, precisely the feature that made it a target.
What to watch
Federal pressure has not abated. On July 1 the FTC published a proposed policy statement on the suppression of accuracy in AI systems, singling out the Colorado AI Act as a law that may push companies to degrade output accuracy to avoid disparate-impact liability, and asserting such laws are impliedly preempted where they conflict with Section 5 of the FTC Act. Comments close July 31 on docket FTC-2026-0859. Whether that theory reaches a pure disclosure statute like SB 26-189 is an open question Colorado may have to litigate.
Also ahead: Weiser's office must complete rulemaking before January 1, 2027, and xAI's injunction motion is due within 28 days of final adoption of implementing rules. Colorado may find itself defending version two before version one is formally buried.
“We could have probably built a wing here at the Capitol, built us our own ballroom, with the amount of money that's been spent on this topic.”— Robert Rodriguez, Senate Majority Leader, Colorado General Assembly