Denver, Colorado — Governor Jared Polis has officially signed Senate Bill 26-189 into law, marking Colorado’s second and significantly revised attempt at regulating artificial intelligence (AI) and automated decision-making technologies. This legislative pivot replaces the contentious Senate Bill 24-205, which, despite its initial passage, faced immediate and widespread criticism from technology companies, state officials, and legal experts, prompting an urgent reevaluation of its scope and definitions. The new measure aims to establish a more precise and implementable framework for AI governance, focusing on transparency, human oversight, and accountability in "consequential decisions" without stifling technological advancement.
A Swift Legislative Course Correction
The journey to SB 26-189 has been a rapid and reactive one, underscoring the complexities and challenges of regulating rapidly evolving AI technologies. Colorado initially garnered national attention in May when it passed SB 24-205, a groundbreaking bill intended to address potential biases in high-risk AI systems, particularly in areas like employment, housing, and credit. The original law mandated that developers and deployers of "high-risk artificial intelligence systems" take "reasonable steps" to prevent "algorithmic discrimination." However, the very term "algorithmic discrimination" proved to be a critical flashpoint, drawing accusations of being overly vague and difficult to operationalize.
Within weeks of SB 24-205’s passage, a chorus of opposition emerged. Governor Polis himself, along with other state officials, publicly expressed concerns about the law’s potential chilling effect on innovation and competition within Colorado’s burgeoning tech sector. The fear was that the ambiguous language and broad mandates could deter AI companies from operating or investing in the state, thereby undermining Colorado’s ambitions to be a leader in the digital economy.
The most prominent legal challenge came from xAI, the artificial intelligence company founded by Elon Musk. In a lawsuit filed against Colorado’s attorney general, xAI contended that the definition of "algorithmic discrimination" was "unconstitutionally vague," arguing that it failed to provide clear guidance on what constituted a violation, thus infringing upon due process rights. This legal action, coupled with internal state concerns, created immense pressure for a legislative redo. The swift response led to the drafting of SB 26-189, an acknowledgment that the first attempt, while well-intentioned, required significant refinement to be effective and fair.
Key Shifts in SB 26-189: Redefining Scope and Responsibilities
The new legislation, SB 26-189, represents a substantial overhaul, moving away from the problematic terminology of its predecessor and establishing clearer parameters for regulation.
One of the most significant changes is the complete removal of all references to "algorithmic discrimination." This omission directly addresses the core legal and practical objections raised against SB 24-205. Instead, the new law introduces and defines a broad category of "automated decision-making technology" (ADMT). This term encompasses any tool that processes personal data and utilizes computational methods to generate outputs such as "predictions, recommendations, classifications, rankings, scores, or other information used to make, guide, or assist a decision, judgment, or determination" about an individual. This rephrasing aims to provide a more tangible and less subjective basis for regulation, focusing on the function and impact of the technology rather than a potentially nebulous concept of bias.
Crucially, SB 26-189 also delineates specific exclusions from the ADMT definition, providing much-needed clarity for businesses. Technologies are generally excluded if they are not used to make "consequential decisions." The law explicitly defines "consequential decisions" as those that materially influence eligibility for, selection for, denial of, compensation for, or access to employment, financial services, housing, insurance, education, healthcare, or essential government services. This targeted approach avoids regulating "low-stakes or routine decisions" that do not have a significant impact on an individual’s life or opportunities. For instance, the law clarifies that it does not cover instances where an ADMT is merely used to summarize, organize, or present information for human review, provided it does not produce a score, ranking, recommendation, classification, prediction, or other inference that materially influences an outcome or decision. This distinction is vital for companies deploying AI for internal efficiencies or informational purposes, distinguishing it from applications that directly affect individuals’ rights and access to services.
Empowering Individuals and Establishing Enforcement Mechanisms
A cornerstone of SB 26-189 is its emphasis on individual rights and consumer protection in the face of automated decision-making. The law grants individuals who experience adverse outcomes resulting from consequential decisions made by an ADMT several important rights:
- Data Access and Correction: Individuals may request instructions for accessing personal data used in the decision and formally request the correction of any factually inaccurate or materially inaccurate personal data. This provision enhances transparency and data integrity, allowing individuals to challenge the foundational information feeding AI systems.
- Meaningful Human Review and Reconsideration: Perhaps the most significant protection, individuals have the right to formally request an opportunity for "meaningful human review and reconsideration" of a consequential decision. This establishes a critical safeguard, ensuring that automated decisions are not final and can be challenged by human intervention, thereby mitigating the risks of algorithmic errors or biases.
The enforcement framework for SB 26-189 is also carefully structured. Colorado’s attorney general is tasked with issuing detailed regulations to clarify and implement the law’s requirements on or before its effective date in 2027. This staggered approach allows time for comprehensive rulemaking, stakeholder input, and industry adaptation. If the attorney general finds a violation, the organization deploying the ADMT will typically be granted a 60-day period to "cure" the violation. This grace period encourages compliance and allows businesses to rectify issues before facing legal action. However, the law provides an important exception: the attorney general may forgo the cure period if the organization is found to have knowingly or repeatedly violated the law, signaling a tougher stance on willful non-compliance.
Official Reactions and Broader Implications
Governor Polis hailed the passage of SB 26-189 as a testament to collaborative governance and a significant step forward for Colorado. In a press release, he stated that the new law "represented a collaborative effort between consumers and various other stakeholders that would preserve Colorado’s role in the growing AI industry." He further emphasized, "This is a big step in the right direction for Colorado, and a model for the rest of the country. Replacing the old law that hasn’t taken effect yet will boost Colorado innovation and entrepreneurship." These remarks underscore the state’s dual commitment to fostering a vibrant tech ecosystem while proactively addressing the ethical and societal challenges posed by AI.
The enactment of SB 26-189 comes just days after the Colorado legislature passed another significant bill prohibiting employers from discriminating against workers by using AI or similar tools to set individualized wages. This concurrent legislative activity highlights a broader trend in Colorado to address the specific impacts of AI across various sectors, particularly in the realm of employment and worker rights.
For affected employers and technology developers, the new law necessitates immediate strategic adjustments. Legal experts from firms like Fisher Phillips have advised businesses to proactively "map their AI tools" to understand which systems fall under the ADMT definition and to engage with vendors to ensure compliance. They also highlighted the law’s three-year recordkeeping requirement for relevant compliance documents, urging companies to establish robust data governance and documentation practices. Furthermore, the legal community anticipates that while SB 26-189 aims for greater clarity, it may still face future legal challenges as its provisions are tested in practice and as AI technology continues to evolve.
Colorado as a National Bellwether
Colorado’s legislative journey serves as a compelling case study for other states and federal policymakers grappling with AI regulation. The rapid correction from SB 24-205 to SB 26-189 demonstrates the inherent difficulty in crafting effective legislation for such a dynamic and complex technological domain. The shift from a broad, potentially vague concept like "algorithmic discrimination" to more specific definitions of "automated decision-making technology" and "consequential decisions" could provide a template for other jurisdictions seeking to regulate AI without inadvertently stifling innovation.
The emphasis on individual rights—specifically the right to human review and data correction—aligns with growing calls for algorithmic accountability and consumer protection globally. This approach seeks to instill trust in AI systems by providing mechanisms for recourse when automated decisions lead to adverse outcomes. By positioning the attorney general as the primary enforcement body and incorporating a cure period, Colorado also demonstrates an attempt to balance punitive measures with opportunities for compliance.
As the 2027 effective date approaches, the focus will shift to the detailed regulations to be issued by the Colorado Attorney General. These regulations will be critical in translating the statutory language into practical requirements for businesses and clear protections for individuals. The outcome of Colorado’s AI experiment will undoubtedly be closely watched, shaping the ongoing national and international dialogue on how best to govern artificial intelligence in a way that maximizes its benefits while mitigating its risks. Colorado has asserted itself as a pioneer, navigating the intricate balance between fostering technological advancement and safeguarding its citizens in an increasingly automated world.
