Colorado Narrows Its AI Law, but the FTC Says That’s Not Enough: What Should Companies Make of These Changes?

Artificial intelligence (AI) regulation is fragmenting. In recent years, several states, including Utah, Texas, Virginia, and Connecticut, have passed first-of-their-kind AI laws. Some have since narrowed those original laws, while others have blocked or expanded them. In May, Colorado joined the states that have scaled back, dramatically narrowing its approach by replacing its original AI law, SB 24-205, with a lighter disclosure-focused framework, SB 26-189, weeks before that original AI act was set to take effect on June 30, 2026. Adding to the complexity, the Federal Trade Commission (FTC) recently issued a proposed policy statement suggesting that even Colorado’s scaled-back law may be preempted by federal law, creating uncertainty for businesses planning their compliance approach. This Advisory analyzes Colorado’s pivot and offers practical guidance for businesses navigating the new law. Companies using automated tools for high-risk decisions (employment, lending, insurance, healthcare, or education) should assess their compliance obligations under these emerging state laws. Those serving Colorado consumers should prioritize near-term compliance planning, as should any company using such tools in employment decisions, given the overlap with Connecticut and other emerging state laws.

What Did Colorado’s Original AI Statute Require?

In 2024, Colorado enacted comprehensive legislation targeting “high-risk artificial intelligence systems,” defined as “any artificial intelligence system that, when deployed, makes or is a substantial factor in making, a consequential decision.”¹

Specifically, SB 24-205 imposed duties on deployers (companies that use AI systems) and developers (companies that create those AI systems), including a duty to avoid “algorithmic discrimination” and to disclose the use of AI systems to consumers.² To avoid such discrimination, deployers of high-risk AI systems were required to implement a risk management policy to govern deployment of the system and complete a detailed impact assessment.³

SB 24-205 required deployers to notify consumers before a high-risk AI system was used to make a “consequential decision.”⁴ That notice had to include the purpose for using the system, the nature of the decision, and information about the consumer’s right to opt out of profiling.⁵ The law also imposed a post-hoc disclosure requirement: deployers had to explain the decision-making process for any consequential decisions made using high-risk AI systems.⁶

Why Did Colorado Replace the Original AI Statute?

SB 24-205 was originally scheduled to take effect February 1, 2026.⁷ However, the law faced criticism from industry, and efforts to amend it during the 2025 regular session stalled.⁸ Governor Polis called a special legislative session in August 2025 to force a resolution before the February deadline, but similar criticism stalled each of the proposed bills.⁹ Days before the special session closed, Senate Majority Leader Robert Rodriguez proposed a delay, pushing the effective date to June 30, 2026.¹⁰

That failed special session prompted the Colorado AI Policy Work Group (Work Group), a stakeholder body of industry representatives, consumer advocates, hospitals, school districts, and technology companies convened by Governor Polis, to negotiate a full policy framework built around the new June 30 deadline.¹¹

Those negotiations played out against a backdrop of federal pressure, including a December 2025 executive order critical of state algorithmic-discrimination laws and a federal lawsuit challenging SB 24-205 on constitutional grounds.¹² The lawsuit resulted in a stay of enforcement (not on the merits, but because the law was likely to be superseded by the Work Group’s proposed bill), which became the basis for SB 26-189.

Colorado’s shift was part of a broader pattern of state-level AI regulation. California set the early baseline for automated decision-making technology (ADMT)-specific regulation, having adopted detailed rules governing ADMT under the California Consumer Privacy Act in 2025.¹³

However, several states have recently scaled back or blocked AI legislation: Utah amended its Artificial Intelligence Policy Act in 2025 to narrow disclosure requirements and add a safe harbor for companies following recognized compliance frameworks;¹⁴ Texas softened its original AI law by requiring both intent and adverse outcome for discrimination claims;¹⁵ and Virginia’s governor vetoed that state’s AI bill in March 2025, calling it “burdensome” to the industry.¹⁶

Diverging from the trend, Connecticut passed the Connecticut Artificial Intelligence Responsibility and Transparency Act, focusing on regulation of AI use for employment decisions.¹⁷ The act amends the state’s anti-discrimination statute to preclude ADMT use as a defense to employment discrimination claims and make available proactive anti-bias testing as a mitigating factor for courts to consider.¹⁸ It also creates whistleblower protections for employees of frontier developers, regulates AI chatbots, and requires content provenance markers on AI-generated media.¹⁹

How Does the Colorado Revised Act Differ From the Original?

Covered Technologies: SB 26-189 redefines the universe of covered technology. SB 24-205 covered “high-risk artificial intelligence systems,” defined as any AI system that, when deployed, makes or is a substantial factor in making, a consequential decision.²⁰ SB 26-189 instead applies to “covered” ADMT, defined as automated decision-making technology that processes personal data and is used to materially influence a consequential decision.²¹ While “artificial intelligence systems” was defined specifically as “machine-based system[s] that … infer[] from the inputs … receive[d] how to generate outputs,” ADMT is broadly defined as “a technology that processes personal data and uses computation to generate output.”²² Thus, a broader range of technologies is now covered by the law.

However, the universe of covered decisions is narrower: SB 26-189 limits “consequential decisions” to seven “covered domains” (education, employment, residential real estate, financial or lending services, insurance, healthcare, and essential government services), dropping legal services, which SB 24-205 included.²³

Additionally, SB 26-189 exempts ADMT used for low-stakes or routine decisions, advertising and marketing, spreadsheets that require human analysis, procedural tasks, cybersecurity and privacy tasks, administration, fraud prevention, and others.²⁴ These use exemptions are similar to those in California’s 2025 ADMT regulations.²⁵ Still, absent further developments, any company using ADMT in hiring and employment decisions, regardless of industry or service, should consider its plan for compliance with the new law.

Algorithmic Discrimination: Rather than imposing a duty to avoid “algorithmic discrimination,” SB 26-189 instead provides that existing state discrimination laws, such as the Colorado Anti-Discrimination Act, apply to regulated uses of ADMT.²⁶ Deployers are no longer required to implement a detailed risk management policy or complete a lengthy impact assessment.

Developer Obligations: AI developers must provide deployers with (1) the intended and harmful or inappropriate uses of the technology; (2) a description of the categories of data used to train the technology; (3) limitations, risks and circumstances in which deployers should not use the technology; (4) instructions for appropriate use and information necessary for deployers to comply with the law; and (5) notice of updates and modifications.²⁷ This is less extensive than SB 24-205, which additionally required developers to furnish deployers with documentation of known or foreseeable risks of algorithmic discrimination and a summary of the data governance measures used in developing the system.²⁸

Deployer Obligations: Requirements for companies that deploy ADMT focus on anticipating and responding to adverse outcomes that consumers may experience as a result of ADMT decisions.²⁹ Deployers must give consumers notice before using ADMT for consequential decisions.³⁰ If a consumer experiences an adverse outcome from a decision in which ADMT played a role, the deployer must disclose the consumer’s right to request personal data, correct inaccurate data, and obtain human review of the decision.³¹ SB 24-205’s deployer obligations were considerably more involved: deployers had to complete a pre-deployment impact assessment, adopt and maintain a written risk management policy, and, in some cases, complete annual reviews of the system’s performance.³² SB 26-189 eliminates all three requirements, imposing on deployers a more limited, disclosure-driven compliance program built around notice and post-outcome transparency rather than ongoing risk management.

Consumer Rights: A consumer who experiences an adverse outcome as a result of an ADMT-driven consequential decision has the right to request personal data, correct inaccurate data, and obtain human review and reconsideration of the decision.³³ SB 24-205 similarly required deployers to provide consumers an opportunity to correct personal data;³⁴ however, SB 24-205 was broader when it came to consumer access to their personal data. Beyond simply being granted the ability to request “instructions for requesting personal data,”³⁵ SB 24-205 required deployers to automatically “provide to the consumer … [t]he type of data that was processed.”³⁶ These consumer rights are similar to those that California created, but California goes further, requiring businesses to give consumers the ability to opt out of ADMT.³⁷

Liability: SB 26-189 imposes liability on developers or deployers for unlawful discrimination under Colorado’s Anti-Discrimination Act for regulated uses of covered ADMT.³⁸ However, developers cannot be held liable for a deployer’s unintended use of the ADMT that results in a discriminatory decision.³⁹ The statute also allocates fault between developers and deployers based on their relative responsibility for a violation, rather than imposing automatic joint liability, and voids any contract provision that purports to indemnify a party against liability for its own discriminatory use of ADMT.⁴⁰

Litigation and Enforcement: The law does not create a private right of action. Instead, it provides for enforcement by the Attorney General under the Colorado Consumer Protection Act.⁴¹ On this point, SB 26-189 preserves SB 24-205’s approach: both⁴² versions of the law leave enforcement exclusively to the Attorney General.

The law provides for a notice-and-cure period of 60 days, but if a deployer or developer knowingly or repeatedly violates the provisions, the Attorney General is not required to provide notice or time for cure.⁴³

The months leading up to the law taking effect on January 1, 2027 will be instructive. The Attorney General is expected to adopt rules clarifying the requirements and issue guidance about how the law will apply to different sectors and domains.⁴⁴ Deployers will need to monitor the rulemaking to understand their compliance obligations.

How Has the FTC Responded to SB 26-189?

In early July, just over one month after the Revised Act’s passage, the FTC issued a Proposed Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems.⁴⁵ The Proposed Policy Statement warns against a “balkanized or patchwork regulatory approach” and cites Colorado’s original AI statute as an example of state regulators “requiring American companies to embed ideological bias within their AI models.”⁴⁶ While the Proposed Policy Statement acknowledges the changes made in SB 26-189, it states that even “the new version poses many of the same concerns” as Colorado’s original act and may be preempted by Section 5 of the FTC Act.⁴⁷ The Proposed Policy Statement cites SB 26-189’s liability provisions as applying “pressure” on AI developers to “alter” model outputs in ways that may themselves violate Section 5.⁴⁸

The FTC is currently seeking comment on the Proposed Policy Statement until July 31, 2026.⁴⁹

Practical Guidance for Navigating These AI Laws

It will be crucial that companies adopt compliance measures as soon as possible in the covered areas. This is especially important because the 60-day notice-and-cure provision will not apply to developers or deployers who knowingly violate the law or ignore potential violations. Violators risk incurring penalties of up to $20,000 per violation.⁵⁰

Below are a few compliance obligations that businesses should focus on in the near term.

Compliance obligations for deployers:

• Deployers should prepare for compliance with the new consumer rights provisions. Deployers (that is, all businesses using ADMT to provide services in any of the covered domains, as well as any business using ADMT in employment decisions regardless of industry) bear the onus of complying with SB 26-189’s new consumer rights provisions. When a consumer experiences an adverse outcome from an ADMT-driven decision, deployers must have in place processes for handling consumer data access and correction requests.
• Deployers should start with an ADMT inventory and prioritize employment. Before drafting any disclosures, deployers should map every system that touches a covered domain (not just AI marketed as “AI”) since SB 26-189’s technology-neutral definition can sweep in conventional scoring tools and rules-based systems that a narrower, AI-specific definition might have missed. Employment decisions deserve particular attention regardless of industry: it is the one domain where Colorado and Connecticut (among other states) overlap.
• Deployers should build the required notice, disclosure, and human-review workflows. Because SB 26-189 dropped the risk-assessment and audit obligations of Colorado’s original AI law in favor of a disclosure-driven model, the practical work ahead should focus on operational infrastructure: notices to consumers before using ADMT and templates for disclosing adverse-outcome rights. Companies with existing state privacy compliance programs may be able to adapt those frameworks to address some of these requirements, though the human-review requirement and adverse-outcome disclosure triggers are new. Businesses should also identify candidates who will serve as human reviewers of adverse decisions.

Compliance obligations for developers:

• Developers should document intended use, and be prepared to explain any changes to model outputs. Because SB 26-189 shields developers from liability for a deployer’s unintended or out-of-scope use of their technology, a developer’s own documentation of intended and inappropriate uses will be critical in avoiding liability for unintended uses. Given the FTC’s stated concern that developers may be tempted to quietly alter model outputs to avoid liability under laws like SB 26-189, developers should also be able to show that any changes to a model’s outputs were made for disclosed, legitimate reasons, rather than as an undisclosed attempt to route around Colorado’s law in a way that could itself raise Section 5 exposure.

Compliance obligations for both deployers and developers:

• Deployers and developers alike should track the Attorney General’s rulemaking. Much of SB 26-189’s practical scope (what counts as “materially influencing” a decision, what a compliant adverse-outcome disclosure looks like, etc.) is expected to be filled in by rulemaking before the January 1, 2027 effective date. Because the rulemaking will fill in key details, deployers with significant Colorado exposure may benefit from participating in the comment process.

Ultimately, the FTC’s position that SB 26-189 may be preempted by federal law puts Colorado’s AI statute in a state of uncertainty and leaves developers to navigate how to satisfy SB 26-189’s disclosure and liability provisions without running afoul of Section 5. Until that tension resolves (whether through the FTC’s final policy statement, litigation, or further legislative action), developers and deployers servicing Colorado consumers can still expect to be subject to SB 26-189’s requirements starting on January 1, 2027.

* Maria Duque contributed to this Advisory. Maria is a summer associate in Arnold & Porter’s Chicago office.

© Arnold & Porter Kaye Scholer LLP 2026 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.