AI Governance & Compliance for Colorado Businesses

A shifting regulatory picture

Colorado's SB 26-189 takes effect January 1, 2027. It imposes compliance obligations on businesses that use automated decision-making tools in ways that affect identifiable individuals. At the federal level, Congress has introduced the Great American AI Act, which would preempt state AI laws including Colorado's. Whether it passes, and how broadly it preempts, remains open.

The result is that businesses face real compliance questions without a settled answer on which set of rules will ultimately govern. Businesses that understand their exposure now will be better positioned regardless of which framework governs.

What the Colorado law does

SB 26-189 covers businesses that use automated decision-making tools in ways that affect identifiable individuals. The covered categories include employment, housing, lending, insurance, and health care. They sound specific. In practice, they are broader than most business owners expect, and whether a particular tool or workflow triggers the law is not always obvious.

Three questions worth answering now

Are you a covered business? If so, what does the law require of you? And do you have the policies and procedures in place to meet it?

The compliance obligation runs to the business using the tool, not just the company that built it. If you are using an off-the-shelf AI product (a hiring platform, a CRM with scoring features, an insurance underwriting tool) and your use of it influences decisions about identifiable individuals in a covered category, the obligation is yours regardless of where the software came from.

Those questions are easier to work through before a deadline than after one.