Colorado’s AI Act is dead. SB 189, signed by Governor Polis on May 15, replaces the two-year-old law with a leaner framework: the Colorado ADM Act, focused on disclosure rather than algorithmic discrimination controls.
The original 2024 law was heavy: annual impact assessments, risk management programs, AG notification whenever AI caused discrimination, and public disclosure of high-risk system details. Compliance was expensive, exactly the overhead Polis cited when he called it a threat to startup competitiveness. All of that is out. What’s in: developers must give deployers a statement on the system’s intended use, known limitations, and monitoring guidance. Deployers must disclose to consumers that automated decision-making is in play before a consequential decision, and if that decision goes against the consumer, they’re owed an explanation, the right to correct their data, and a shot at meaningful human review.
Here’s the catch: the old law had a compliance safe harbor. Check the boxes on risk management and impact assessments and you built a rebuttable presumption of compliance. CADMA removes that. Discrimination claims now run through existing anti-discrimination law, decided through enforcement or litigation, case by case. Startups may prefer ambiguity to expensive compliance frameworks; the first consent order will test that instinct.
Scope narrows in one critical spot: employment coverage drops to hiring decisions only. Your ATS, resume screener, and video interview tool are all in scope. Performance management AI isn’t.
Enforcement goes live January 1, 2027, through the Colorado AG. Sixty days to cure any violation before penalties attach. Start your disclosure drafts now.
Nathan Zakhary