The original law, SB 24-205, was the first comprehensive state AI statute in the country and required risk-management programs, impact assessments, discrimination reporting, and governance protocols for high-risk systems. SB 189 strips away most of those obligations in favor of targeted transparency rules: developers must provide technical documentation to deployers, both parties must retain records for three years, consumers must receive notice when automated decision-making is used, and affected individuals can request data access, correction, and human review after adverse decisions. The legislature has not yet disclosed the full text of enforcement mechanisms or penalties.
Colorado's reversal matters because the state had positioned itself as a regulatory leader on AI governance. The original law faced sustained pressure from industry over compliance costs and scope, leading to one postponement already and a 2026 working group that proposed the narrower framework now enacted. A pending legal challenge by x.AI also influenced the legislative environment. For companies deploying AI in hiring, housing, lending, health care, education, insurance, and government services, the rewrite materially changes compliance obligations and timelines before the law takes effect. Attorneys should monitor whether other states follow Colorado's retreat from comprehensive AI regulation or maintain broader approaches.