Colorado's AI Act Was Stayed and Rewritten. What SB 26-189 Means for Vendors

As of 11 October 2026, no Colorado AI act obligation applies to your product. The 2024 law was never enforced. A federal magistrate judge suspended it on 27 April 2026 at the request of both sides, and on 14 May the legislature repealed it. The replacement, SB 26-189, starts on 1 January 2027, and a stayed lawsuit still sits underneath that date. This post follows the docket and the bill text, and says what they mean for a B2B vendor with Colorado customers.

The short answer

The Colorado AI Act is not in effect. The 2024 version, SB 24-205, was stayed by a federal court on 27 April 2026 and repealed on 14 May 2026. Its replacement, SB 26-189, takes effect on 1 January 2027 under Attorney General enforcement only. xAI's constitutional challenge is paused until the Attorney General adopts final rules.

What a vendor must comply with today under Colorado's AI law

Nothing. Most summaries bury that finding.

SB 24-205 was signed in May 2024 with a 1 February 2026 start date. A special session in August 2025 pushed that to 30 June 2026. Before that date arrived, the law was suspended and then repealed. No developer or deployer was ever subject to it.

SB 26-189, the replacement, became law on 14 May 2026. Its substantive duties, according to the General Assembly's summary of the enacted bill, start on 1 January 2027. The Attorney General must also adopt rules by that date. Between now and then your exposure under this statute is zero, and your preparation window is 81 days.

This reading covers the AI act alone. Colorado's privacy act, its anti-discrimination act and the conversational AI law signed in July 2026 run on their own clocks.

Why "stayed" is the wrong word

Headlines in April said a judge blocked the law. The order was a minute order granting a joint motion that both parties asked for. The court did not find the law likely unconstitutional, because nobody asked it to.

A contested injunction tells you something about the merits. A stipulated pause tells you only that the Attorney General preferred not to litigate a statute the legislature was two weeks from replacing.

How the 2024 act was stopped: the docket in four entries

The case is X.AI LLC v. Weiser, in the US District Court for the District of Colorado. Moore & Van Allen gives the full number as 1:26-cv-01515-DDD-CYC.

9 April 2026: xAI files

xAI sued Attorney General Philip Weiser in his official capacity for declaratory and injunctive relief. According to Baker Botts' summary of the complaint, it pleaded 4 theories: First Amendment compelled speech, the Dormant Commerce Clause, due process vagueness, and equal protection.

SB 24-205 defined algorithmic discrimination but exempted differential treatment meant to expand applicant pools for diversity or to redress historical discrimination. xAI argued that carve-out treated some disparate impacts as lawful and others as not.

24 April 2026: the Justice Department moves to intervene

The Justice Department's press release says it intervened on a single claim, the Equal Protection Clause. Its objection was the same carve-out. The release called it "an explicit carveout for discriminatory algorithms designed to advance 'diversity' or 'redress historic discrimination.'"

Law firms call it the first federal intervention against a state AI statute. The release itself does not mention the December 2025 executive order on state AI laws, though the complaint and most commentary tie the two together.

24 April 2026: the joint motion

The same day, xAI and the Attorney General filed a joint motion to suspend enforcement. Colorado Politics reported the terms: Weiser would not begin enforcement for alleged violations of the 2024 law within 14 days of a ruling on xAI's preliminary injunction motion. In turn, xAI would file that motion within 28 days after final rulemaking under SB 24-205 or any legislation replacing or amending it.

27 April 2026: the minute order

Magistrate Judge Cyrus Y. Chung granted the motion. HR Dive's account adds one detail the others omit: xAI's 28-day deadline covers a preliminary injunction motion or an amended complaint. That matters, because the law xAI sued over no longer exists, and an amended complaint against SB 26-189 is the likely next filing.

What SB 26-189 keeps and what it drops

SB 26-189 was introduced on 1 May 2026 and signed on 14 May, 13 days later. Senate Business, Labor and Technology 5-0. Senate Appropriations 7-0. Senate floor 34-1. House Judiciary 11-0. House Appropriations 10-1. House floor 57-6. The Senate then concurred with House amendments 34-1.

A bill that clears 7 votes with 8 total no votes is not getting repealed in 2027.

The 2024 duties that are gone

The 2024 act built on a duty of reasonable care to avoid algorithmic discrimination. Around that duty sat annual impact assessments, a risk management programme, and a requirement to notify the Attorney General of discovered discrimination. Norton Rose Fulbright's summary confirms all of that is removed. The phrase "artificial intelligence" does not appear in the new law at all.

The 2027 duties that remain

The new law regulates automated decision-making technology, or ADMT, when it materially influences a consequential decision. The domains are education, employment, housing, financial or lending services, insurance, health care, and essential government services. Each duty is detailed in the analysis of the FTC's Section 5 theory against the Colorado law, so here is the compressed version.

Developers give deployers documentation: intended uses, training data categories, known limitations, and instructions for human review. Deployers give consumers notice before use and a plain-language explanation within 30 days of an adverse outcome. Consumers can access and correct their data and request meaningful human review. Both sides keep records for at least 3 years.

Enforcement is narrower than it looks

The Attorney General alone enforces, under the Colorado Consumer Protection Act, with a violation treated as a deceptive trade practice. The National Law Review summary puts the ceiling at $20,000 per violation. Before 1 January 2030 the Attorney General must offer 60 days to cure where cure is possible. There is no private right of action.

The one clause that survived with teeth is fault allocation. Where a discrimination claim is brought under existing law, SB 26-189 sets how fault is split between developer and deployer and voids indemnities for a party's own violations. How that interacts with vendor liability caps is worked through in the piece on AI agent liability caps and remedies.

The Colorado AI law status tracker, dated

Rows citing "as reported" rest on press and law-firm accounts of the 27 April order. See the limitations section.

The rulemaking calendar that sets the real deadline

The Attorney General filed proposed rules with the Secretary of State on 11 August 2026. They implement SB 26-189 and the separate conversational AI law, HB 26-1263, under the citation 4 CCR 904-6. The Available Law summary of the notice of hearing gives the hearing as 26 October 2026 at 10:00 AM at the Ralph L. Carr Judicial Center in Denver, with a remote option.

One regulatory tracker describes interim cutoffs on 4 September and 5 October with a revised draft by 23 September. We found it on one page only, so treat it as unconfirmed. The two dates every source agrees on are 11 August and 26 October.

What the proposed rules add to the statute

Moore & Van Allen's reading of the draft is the most detailed we found. The draft defines "materially influence" as a two-part test: the output is a non-de-minimis factor and it influences the outcome, including by ranking, scoring or constraining it. The firm notes the rules provide no numeric threshold and no safe harbour, which stakeholders had asked for.

The draft also creates a role the statute does not name. A "midstream developer" integrates someone else's ADMT into a product and must obtain upstream documentation and pass it downstream. If you build on a foundation model and sell a scoring feature, that is you.

Consumer rights get clocks. Per the same summary, a deployer must give rights-request instructions within 24 hours and answer access or correction requests within 45 days. It must acknowledge a human review request within 10 days and complete the review within 45 days. Where that reviewer sits in your workflow is the subject of the guide to human-in-the-loop architecture.

The deadline the statute cannot move

The Attorney General must adopt rules by 1 January 2027. The hearing is 26 October. That leaves 66 days to revise, adopt and publish, and state rulemaking carries its own notice periods. Tight, not impossible.

If final rules slip past 1 January, the statute's duties still start on 1 January. Whether the stipulated order also pauses enforcement of SB 26-189 before a ruling is a question the published reports do not settle, and the limitations section takes it up.

Three scenarios for 1 January 2027

A founder deciding how much to spend on Colorado compliance this quarter needs the branches, not the headline.

I would build for scenario A and keep the receipts for scenario C. The documentation SB 26-189 requires is close to what a serious vendor already ships, and none of it is wasted if the court later narrows the law. The same documents satisfy obligations elsewhere. Build them once, against the California AI laws that bind software vendors and the EU AI Act transparency checklist, rather than three times.

Where this tracker is weakest

A status tracker that does not state its own blind spots is a press release. Here are ours.

We read reports of the order, not the order

The 27 April minute order is ECF 24 on the docket, and the court records host blocked our automated access. Every term we quote comes from Colorado Politics, HR Dive, McDermott Will & Schulte and Moore & Van Allen. They agree on the 28-day and 14-day terms. They differ on wording: one says the Attorney General will not "initiate enforcement," another adds "or investigate." Where they differ, we have used the narrower reading.

We could not confirm the docket after early September. One compliance guide states that no new filing appeared from xAI or the Justice Department as of 7 September 2026. We could not verify it. The trigger for a new filing has not occurred, which makes silence the expected state, but expected is not confirmed.

The scope of the stay against the new law is unresolved

This is the hinge. The reported non-enforcement commitment refers to the 2024 law. The reported motion deadline refers to rulemaking under the 2024 law or its replacement. Read together, those clauses could mean the Attorney General is free to enforce SB 26-189 on 1 January regardless of the case. They could also mean the parties intended the pause to carry over. The bill's fiscal note describes the order as covering SB 24-205 "or any legislation amending" it, which supports the carry-over reading, but a fiscal note is not a court.

A vendor should not plan on the stay protecting it from SB 26-189. The cost of being wrong in that direction is a cure notice. The cost of being wrong the other way is a year of unnecessary spend.

The rules may change before adoption. Everything attributed to the proposed rules above comes from the 11 August draft. The 26 October hearing exists to change it. The midstream developer role, the 45-day clocks and the two-part materiality test are all candidates for revision.

What to build before January if you sell into Colorado

The statute and the draft rules together describe 5 deliverables. None needs a lawyer to start, and all are cheaper to build now than to retrofit under a 60-day cure notice.

1. An inventory of consequential-decision features. List every feature that produces a score, rank, recommendation or classification about a person, and tag the ones touching the 7 domains. Employment is where most B2B exposure sits. If any feature scores candidates or employees, read the analysis of where the legal line sits on AI employee monitoring.

2. Developer documentation a deployer can act on. Intended uses, inappropriate uses, training data categories, known limitations, and human-review instructions. Version it, date it, and send update notices when the model changes. The draft rules say withheld information must be backed by identified legal authority, so "proprietary" is not a reason on its own.

3. Exports that support a 30-day explanation. Your deployer customers must explain the decision, the ADMT's role, the principal reasons, and relevant scores within 30 days of an adverse outcome. They need a per-decision record they can export, which is the artefact described in the agent audit log specification.

4. A human review path that is not the original decision maker. The draft rules want a reviewer outside the reporting chain where feasible, trained, with authority to override, and not assisted by ADMT during the review. Design the queue now. Pricing it into the contract is covered in the CFO's list of AI contract clauses.

5. A records policy of at least 3 years. Decide what counts as a record, where it lives, and who can produce it in 60 days. That last constraint is the cure window, and it decides whether a violation costs you nothing or $20,000 per instance.

Frequently asked questions

Where to start

If you have an hour, pull the docket. Search the District of Colorado for 1:26-cv-01515 and read ECF 24 yourself, because every date in this post after 27 April hangs on its wording. Then check whether anything has been filed since. If the docket is quiet, this tracker is current.

If you have a week, write the developer documentation. Four headings, one page each, versioned. It is the deliverable the statute names first, and the one your deployer customers will ask for in December. It costs nothing to have ready if the court later says you did not need it.

Related reading