Skip to main content
All articles
StrategyOctober 15, 2026·5 min read

The Colorado AI Act Was Replaced. What Small Businesses Must Check by January 1, 2027

The Colorado AI Act was replaced in 2026. What the new law asks of small businesses using AI in hiring, housing or lending, and what to do by January 1, 2027.

In May 2026, Colorado replaced its sweeping 2024 AI Act with a much narrower law starting January 1, 2027; as Morrison Foerster notes, the original will not take effect. Most small businesses probably won't be touched. Some will, and they have about eleven weeks. This is general information, not legal advice.

What Replaced the Colorado AI Act

Senate Bill 26-189, signed May 14, 2026, drops the old law's heaviest demands, like formal written risk reviews of each AI tool (impact assessments). What remains is a disclosure law for software that uses personal data to score, rank or predict things about people.

It applies only when that output materially influences a decision: it is more than a trivial factor and shapes the outcome, for example by ranking, scoring or filtering people. Covered decisions involve jobs, education, Colorado housing, lending and financial services, insurance, health care, or government services and benefits. Marketing, routine scheduling, sorting support requests and plain spreadsheets are excluded.

Does It Apply to You?

Do you do business in Colorado? Hiring, renting or lending there can count.
No. It does not apply to you.
Yes. Continue.
Does any tool score, rank or screen people in hiring, housing, lending or another area above?
No. Out of scope. Drafting a job ad with ChatGPT, or plain factual resume summaries you read yourself, are excluded. Summaries that rate or label candidates ("strong fit") can count.
Yes. Continue.
Does its output reach the decision (someone sees it, or it filters people out first), and did the decision follow it?
No. You may be out of scope if a person decided independently. Write down why.
Yes. You are likely a "deployer" (the business using the tool), and the duties below apply.

The last question follows the Attorney General's October draft rules: influence is assumed when the decider saw the output, or it screened what they saw, and the outcome matched, unless the person decided independently.

Under the draft rules, even if a staffing agency runs the AI and hands you a ranked shortlist, you are the deployer. I found no small-business exemption, but there are sector carve-outs: HIPAA-covered medical and dental practices are mostly exempt outside hiring (they owe patients a general notice), and regulated insurers largely follow insurance rules instead.

What a Deployer Must Do From January 1, 2027

  1. Tell people up front. Where people apply, post a prominent line and link saying you use AI and how to learn more.
  2. Explain bad outcomes within 30 days of the decision. If someone is turned down or offered noticeably worse terms, explain plainly what the AI did, how to ask for details, and their rights.
  3. Let them fix their data. After a bad outcome, on request, explain how to get and correct factually wrong personal data.
  4. Offer a human second look on request after a bad outcome, where "commercially reasonable" (practical for your business), by a trained reviewer who can change the decision, not rubber-stamp the AI.
  5. Keep records for three years after each decision showing you followed these steps, such as notices sent and the tool version used.

Makers of tools sold for these decisions must document intended uses, limits and human review for you; a general-purpose tool you repurposed may come with none.

Who Enforces It

Only the Colorado Attorney General enforces these duties; individuals get no new right to sue. People can still sue for discrimination over AI-influenced decisions, though, and a contract clause making your vendor cover your own discrimination is void.

Violations fall under Colorado's consumer protection law, with penalties of up to $20,000 each, notes the law firm Littler. Until 2030, the Attorney General must give you 60 days to fix a problem it considers fixable, unless the violation was knowing or repeated.

Two Things Still Moving

The rules. The Attorney General must adopt detailed rules explaining the law by January 1, 2027. Drafts came out August 11 and October 6; comments are open through the October 26 public hearing (longer if it continues).

The lawsuit. The AI company xAI sued over the original law in April; the case is paused. The Attorney General's office does not intend to enforce either law until the rules are final. xAI agreed to ask the court to block the law within 28 days after that. Plan as if January 1 is real.

A Separate Chatbot Law

House Bill 26-1263 makes public chatbots built mainly for human-like conversation say they are AI from 2027. Customer service, ordering and internal bots are excluded. Still, cover AI disclosure in your small business AI policy.

Your Five-Step Checklist

  1. List every tool that scores, ranks or screens people.
  2. Ask each vendor for the documentation the law requires.
  3. Draft a two-sentence notice for your application pages.
  4. Name your human reviewer.
  5. Create a records folder and a 30-day reminder for every rejection.

Step one is the hard part, because AI hides inside software you bought for other reasons. If it finds nothing that scores people, you are done. That inventory is where every AI readiness assessment we run begins. Selling into Europe? The EU AI Act is separate and heavier.

The Bottom Line

If a tool scores people, the work is modest. Do it in November, not on December 31.

Sources

  1. Colorado General Assembly, "Senate Bill 26-189" (May 2026). leg.colorado.gov
  2. Colorado General Assembly, "House Bill 26-1263" (May 2026). leg.colorado.gov
  3. Colorado Attorney General, "Colorado Automated Decision-Making Technology & Chatbot Safety Rulemaking" (October 2026). coag.gov
  4. Colorado Department of Law, "Automated Decision-Making Technology & Conversational Artificial Intelligence Service Rules (Interim Draft Redline)" (October 6, 2026). coag.gov
  5. Morrison Foerster, "Colorado Hits Reset on AI Regulation With a New AI Act: What Developers and Deployers Need to Know" (May 15, 2026). mofo.com
  6. Littler, "Colorado Amends its Artificial Intelligence Law, Substantially Reducing Obligations on Employers" (May 2026). littler.com
  7. U.S. District Court (D. Colo.), x.AI LLC v. Weiser, "Joint Motion to Vacate Scheduling Conference and Suspend Case Deadlines and Stipulation to Temporarily Stay Enforcement" (April 24, 2026). courtlistener.com

Not sure whether any of your tools score people?

We will map where AI touches decisions in your business, flag anything Colorado's law covers, and help you set up the notice and review process before January 1.

Find Your Fit Book a Free Call