Colorado's AI Act (SB 24-205, signed May 17, 2024) never took effect: its start date was pushed from February 1, 2026 to June 30, 2026 by SB 25B-004, and on May 14, 2026 Governor Polis signed SB 26-189, which repeals and reenacts it as the Automated Decision-Making Technology (ADMT) Act, effective January 1, 2027. The new law drops the duty of care, impact assessments, and risk-management program in favor of developer documentation, consumer notice, 30-day adverse-outcome explanations, data correction, and human review — and it strikes the old safe harbor for banks and credit unions supervised under equivalent federal guidance. Lenders instead get a narrower overlap: an ECOA/Reg B (and, where applicable, FCRA) adverse action notice satisfies the ADMT Act's notice and disclosure duties for the same decision. The Colorado Attorney General has exclusive enforcement authority (deceptive trade practice, up to $20,000 per violation, 60-day cure) and published proposed implementing rules on August 11, 2026 with a hearing and comment deadline of October 26, 2026.
| Full name | Colorado Artificial Intelligence Act (SB 24-205), repealed and reenacted as the Automated Decision-Making Technology Act (SB 26-189) — enforced by the Colorado Attorney General |
| Role | First US state-level AI law reaching lending and financial-services decisions |
| Force on banks | Binding law |
| Applies to | Developers and deployers of automated decision-making technology that materially influences consequential decisions for Colorado consumers — including credit, lending, insurance, and other financial-services decisions — with no carve-out for banks or credit unions |
| Key document | SB 26-189, the Automated Decision-Making Technology Act (signed May 14, 2026; effective Jan 1, 2027) |
| Latest move | Colorado AG published proposed ADMT and Conversational AI Service rules on Aug 11, 2026; comments and hearing close Oct 26, 2026 |
| Documents tracked | 5 · all documents → |
SB 24-205 was the first comprehensive US state AI statute. It imposed a duty of reasonable care to avoid algorithmic discrimination on developers and deployers of 'high-risk' AI systems used in consequential decisions — expressly including financial or lending services — backed by impact assessments, risk-management programs, consumer notices, and an affirmative defense for firms following the NIST AI RMF. Banks and credit unions were deemed in full compliance if a state or federal prudential regulator examined them under published guidance or regulations at least as stringent as the Act (C.R.S. 6-1-1705). Industry pushback, a failed August 2025 special session, a December 2025 White House executive order singling the law out, and a Department of Justice-backed federal lawsuit (xAI v. Colorado) drove two rewrites: SB 25B-004 delayed the start to June 30, 2026, and SB 26-189 replaced the law outright.
The ADMT Act that takes effect January 1, 2027 is a disclosure-and-recourse regime rather than a governance regime. Covered ADMT is technology that processes personal data to produce recommendations, rankings, or scores that materially influence a consequential decision in education, employment, housing, financial services, insurance, health care, or government services. Developers must give deployers documentation of intended use, training-data categories, limitations, and instructions for meaningful human review; deployers must post clear notice, explain adverse outcomes within 30 days, honor requests to access and correct personal data, and offer commercially reasonable human review by trained staff with override authority. Both must retain compliance records for three years.
For banks the practical shift is that the prudential-regulator safe harbor is gone. Colorado now treats a bank's AI-driven credit denial like any other deployer's adverse outcome, with the ECOA/FCRA adverse action notice serving as the compliance vehicle for the notice and disclosure elements — but not automatically for the data-correction and human-review rights, which the Attorney General's proposed rules define in detail (independent, subject-matter-competent reviewers who may not themselves use ADMT). The rulemaking, filed August 11, 2026, also introduces 'midstream developers' and two alternative tests for when ADMT 'materially influences' a decision.
What has the Colorado AI Act actually published on AI?
| Date | Document | Status |
|---|---|---|
| Aug 11, 2026 | Colorado AG proposed ADMT rules — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) | Comment period open |
| May 29, 2026 | HB 26-1263 — Conversational Artificial Intelligence Service Operator Requirements (Chatbot Safety Act) | Final · applies from Jan 1, 2027 |
| May 14, 2026 | SB 26-189 — Automated Decision-Making Technology Act (repeal and reenactment of the Colorado AI Act) | Final · applies from Jan 1, 2027 |
| Aug 28, 2025 | SB 25B-004 — Artificial Intelligence Consumer Protections — delay of effective date to June 30, 2026 | Superseded |
| May 17, 2024 | SB 24-205 — Consumer Protections for Artificial Intelligence (Colorado Artificial Intelligence Act) | Superseded |
| Date | Type | Document / event |
|---|---|---|
| Aug 11, 2026 | Regulation | Colorado AG proposed ADMT rules — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing). On August 11, 2026 the Colorado Department of Law filed proposed rules implementing the ADMT Act (SB 26-189) and the Chatbot Safety Act (HB 26-1263). source ↗ |
| Jun 30, 2026 | Milestone | Original SB 24-205 effective date passes without the law taking effect. The June 30, 2026 start date set by SB 25B-004 was overtaken by SB 26-189, which repealed and reenacted the statute with a January 1, 2027 effective date. |
| May 29, 2026 | Statute | HB 26-1263 — Conversational Artificial Intelligence Service Operator Requirements (Chatbot Safety Act). HB 26-1263, signed May 29, 2026 and effective January 1, 2027, requires operators of publicly accessible conversational AI services to disclose that users are interacting with AI, maintain protocols for users expressing suicidal ideation, estimate user age and apply safeguards for minors, refrain from presenting AI output as coming from a licensed professional, and report annually to the Colorado Attorney General. source ↗ |
| May 14, 2026 | Statute | SB 26-189 — Automated Decision-Making Technology Act (repeal and reenactment of the Colorado AI Act). SB 26-189, signed May 14, 2026 and effective January 1, 2027, repeals the Colorado AI Act and reenacts it as the Automated Decision-Making Technology Act. source ↗ |
| Apr 27, 2026 | Milestone | AG commits not to enforce until rulemaking concludes; federal court stays xAI challenge. In a joint motion with xAI and the US Department of Justice in the federal suit challenging SB 24-205, the Colorado Attorney General stated it would not enforce SB 24-205 or any replacement law until its interpretive rulemaking is complete; the District of Colorado granted the motion. |
| Aug 28, 2025 | Statute | SB 25B-004 — Artificial Intelligence Consumer Protections — delay of effective date to June 30, 2026. SB 25B-004, signed by Governor Polis on August 28, 2025 at the close of a special legislative session, postponed the effective date of the Colorado AI Act from February 1, 2026 to June 30, 2026 without changing its substance. source ↗ |
| May 17, 2024 | Statute | SB 24-205 — Consumer Protections for Artificial Intelligence (Colorado Artificial Intelligence Act). SB 24-205, signed May 17, 2024, was the first comprehensive US state AI law. source ↗ |
- Final ADMT rules from the Colorado AG after the Oct 26, 2026 hearing — especially which 'materially influences' test survives and how much the ECOA/FCRA notice overlap is extended to human-review and data-correction rights
- Jan 1, 2027: ADMT Act and Chatbot Safety Act (HB 26-1263) take effect; the 60-day cure period sunsets Jan 1, 2030
- Whether the DOJ AI Litigation Task Force or a federal preemption measure targets SB 26-189 as it did SB 24-205
- California CPPA automated decision-making technology regulations — significant-decision obligations (including lending) phase in from Jan 1, 2027 with risk assessments due by April 1, 2027 — and the state's AI transparency statutes in force since Jan 1, 2026
- Texas TRAIGA (HB 149, in force Jan 1, 2026): AG-enforced prohibitions on intentionally discriminatory AI, with a 60-day cure and a regulatory sandbox; Utah's AI Policy Act (SB 149, May 1, 2024) requires generative-AI disclosure on request; Illinois HB 3773 (Jan 1, 2026) makes discriminatory AI in employment a civil-rights violation — relevant to bank HR uses
Is the Colorado AI Act in force in 2026?
No. SB 24-205 was delayed to June 30, 2026 by SB 25B-004 and then repealed and reenacted by SB 26-189 before that date. The replacement ADMT Act takes effect January 1, 2027, and the Colorado Attorney General has said it will not enforce until its rulemaking is complete.
Are banks and credit unions exempt from Colorado's AI law?
Not any more. SB 24-205 deemed banks and credit unions compliant if a prudential regulator examined them under substantially equivalent guidance. SB 26-189 struck that exemption. What remains is a targeted overlap: a lender that gives an ECOA/Regulation B (and, where applicable, FCRA) adverse action notice satisfies the ADMT Act's notice and disclosure duties for that decision.
Who enforces the Colorado ADMT Act and what are the penalties?
The Colorado Attorney General has exclusive enforcement authority; there is no private right of action. Violations are deceptive trade practices under the Colorado Consumer Protection Act, carrying civil penalties of up to $20,000 per violation, with a mandatory 60-day notice-and-cure period until January 1, 2030.
Follow every move these regulators make
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →