Colorado has significantly narrowed what was poised to become the nation’s first comprehensive artificial intelligence governance law, replacing a sweeping compliance regime with a more targeted framework centered on transparency, consumer rights and disclosure requirements. At the same time, a recent Federal Trade Commission policy proposal has introduced new uncertainty by suggesting that some state AI laws could conflict with federal consumer protection standards.
According to an analysis by McDermott Will & Schulte, the combined developments leave businesses navigating an increasingly complex regulatory landscape even as Colorado eases many of the compliance burdens contained in its original AI statute.
Gov. Jared Polis signed Senate Bill 26-189 in May, repealing and replacing the Colorado Artificial Intelligence Act enacted in 2024 before it ever took effect. The revised law retains oversight of automated decision-making technology (ADMT) used in consequential decisions but abandons many of the original law’s prescriptive risk-management requirements in favor of a disclosure-based approach. The law is scheduled to take effect Jan. 1, 2027, although enforcement remains on hold pending rulemaking by the Colorado attorney general and ongoing constitutional litigation.
One of the most significant takeaways for businesses is that the law reaches far beyond systems commonly described as artificial intelligence.
The statute defines ADMT as technology that processes personal data to generate predictions, scores, rankings or recommendations that help make or influence decisions about individuals. That definition encompasses many automated analytics tools that organizations may not traditionally consider AI.
At the same time, the law specifically excludes routine technologies such as antivirus software, firewalls, databases, conventional spreadsheets that do not use machine learning, tools used only to summarize or organize information for human review, and consumer chatbots that are not marketed or configured to make consequential decisions.
Whether a technology is covered depends largely on how it is used.
A consequential decision under the revised law is one that materially affects a person’s access to employment, housing, education, credit, insurance, healthcare or essential government services, including pricing and other significant terms. By contrast, routine scheduling, administrative workflows, advertising, customer-service triage, cybersecurity, fraud prevention and financial-crime compliance systems generally fall outside the statute’s scope. The analysis concludes that if a system uses personal data to generate recommendations or scores that meaningfully influence major decisions about an individual’s job, housing or access to financial services, it is likely subject to the law.
The revised legislation also substantially reduces compliance obligations.
The original statute would have required written risk-management programs, algorithmic impact assessments and periodic reviews designed to prevent discriminatory outcomes. Those provisions have been eliminated. Instead, organizations must focus on consumer notice, transparency and documentation surrounding the use of covered ADMT.
For deployers, the emphasis shifts toward consumer-facing obligations. Organizations using covered ADMT must notify individuals when they interact with covered systems. If an adverse consequential decision is made, consumers must receive an explanation of the technology’s role in the decision along with an opportunity for meaningful human review. Individuals also gain rights to access and correct personal data used in covered decisions.
Adding another layer of complexity, the FTC recently issued a proposed policy statement expressing concern that certain state AI laws, including Colorado’s, could create deception issues under Section 5 of the FTC Act. While the proposal would not preempt Colorado law or change existing compliance obligations, McDermott says it underscores growing tension between state AI regulation and federal consumer protection policy.
Against that backdrop, the firm recommends companies begin preparing now by inventorying AI and other automated decision-making tools, paying particular attention to employment-related systems, developing required notice and human-review procedures, documenting intended and inappropriate uses of covered technologies, and closely monitoring the Colorado attorney general’s rulemaking process, which is expected to clarify key definitions before the law takes effect.
