Colorado SB 26-189 AI Law Analysis | ATLAS — AGORÀ

On May 14, 2026, Colorado Governor Jared Polis signed Senate Bill 26-189 into law (Colorado General Assembly, 2026). The legislation replaced SB 24-205, the Colorado Artificial Intelligence Act, passed in May 2024 and set to take effect February 1, 2026. The replacement occurred before the original law took effect, making Colorado the first US state to both enact and then substantively revise a broad-scope AI accountability statute.

What changed between SB 24-205 and SB 26-189

SB 24-205 imposed a risk-based compliance framework on developers and deployers of high-risk AI systems. The obligations included: impact assessments prior to deployment, alignment with recognized standards such as NIST AI RMF or ISO/IEC 42001, documentation of training data and model limitations, and disclosure to consumers in consequential decisions.

SB 26-189 retains the notice-and-transparency provisions, the obligation to disclose when AI is used in consequential decisions, and removes the risk assessment, standard alignment, and documentation requirements. The accountability framework has contracted from a risk management model to a disclosure model.

The governance signal: US AI regulation is structurally fragmented

For General Counsel and Chief Compliance Officers managing multi-jurisdictional AI exposure, the revision introduces a specific challenge: the compliance posture calibrated for SB 24-205 is now overcalibrated for Colorado, and the federal picture remains unsettled. Organizations that built NIST AI RMF alignment into their AI governance programs retain that infrastructure, the strategic decision is whether to apply it selectively or maintain it as a uniform standard in anticipation of federal movement.

The Colorado revision is a data point in a broader pattern. The US has produced no federal AI framework with binding obligations on private sector actors. At state level, Colorado was the most advanced jurisdiction. Its mid-course revision toward a lighter-touch disclosure model signals that the political equilibrium for comprehensive AI accountability legislation has shifted, at least for this legislative cycle.

Three decisions for the board

1. Audit your Colorado AI inventory. SB 26-189 retains disclosure obligations for consequential decisions, employment, credit, housing, education, healthcare. Organizations deploying AI in these contexts in Colorado remain subject to notice requirements. The audit remains required; the scope has changed.

2. Reassess your NIST AI RMF alignment investment. Organizations that built risk assessment capabilities in response to SB 24-205 retain those capabilities with the mandatory Colorado obligation removed. The governing question: will federal-level requirements arrive, and on what timeline? NIST RMF alignment remains relevant to federal contracting and anticipated federal frameworks, the investment is a strategic asset, with Colorado now as an optional application context.

3. Map your multi-state exposure systematically. Texas, Illinois, and New York have active AI regulatory proposals. Other states are considering frameworks structurally closer to the original SB 24-205 than to SB 26-189. A continuous monitoring function, rather than a point-in-time assessment, is the governance structure the current regulatory landscape requires.

Regulatory horizon

SB 26-189 is in effect as of May 14, 2026. Federal AI legislation proposals remain in committee. The EU AI Act, applicable to organizations operating in the European Economic Area, maintains its risk-based accountability framework with phased obligations through August 2027.

→ For the EU risk-based governance model and what it requires of enterprise: EU AI Act Omnibus: What Changed for Enterprise.

This deskEnterprise & Governance | Sources: Colorado SB 26-189 (signed May 14, 2026), Colorado General Assembly 75th Session. Compared with: SB 24-205, 74th Session (2024).