For two years, Colorado's AI Act was the law every compliance team pointed to as the future. It would have made businesses that used AI for big decisions about people, like hiring or lending, take "reasonable care" to prevent discrimination and run impact assessments. It never took effect. This spring, a lawsuit backed by the federal government and a quick rewrite by the legislature turned it into something much narrower. The story says a lot about where US AI regulation is heading.
What happened
The federal pressure came first. A December 2025 executive order created a Justice Department AI Litigation Task Force to challenge state AI laws, as several law firms have noted. On April 24, 2026, according to law firm Jenner & Block, the Justice Department joined a lawsuit by the AI company xAI asking a federal court to block Colorado's law. xAI argued the law compelled speech and was too vague. The government argued it violated equal protection, both by pushing developers to adjust outputs by group and by allowing some diversity-related exemptions.
According to an Eckert Seamans legal update, a federal court stayed enforcement on April 27. On May 14, Governor Jared Polis signed SB 26-189, which repeals the original law and replaces it. The new law takes effect January 1, 2027. Eckert Seamans reports that it drops the duty of reasonable care, risk management programs, annual impact assessments and self-reporting to the Attorney General. Enforcement belongs to the Attorney General only, with no private lawsuits, and waits on rules that had not formally begun when the firm wrote. The firm thinks practical enforcement is unlikely before late 2027.
What remains is mostly about transparency. Proskauer's summary for employers says businesses that use "automated decision-making technology" to materially influence consequential decisions, including hiring, selection and pay, must:
- Give clear notice when the technology is used in a decision about a person.
- Explain an adverse decision in plain language within 30 days, including the role the technology played.
- Let people correct inaccurate personal data and ask for meaningful human review, where commercially reasonable.
- Keep records for at least three years.
Why it matters for your business
This is not legal advice, but the direction is clear.
The heaviest version of AI regulation is losing in the US, for now. A federal executive order, a Justice Department lawsuit and a court-ordered pause combined to pare back the strictest state law before it started. Other states considering similar bills will notice.
The light version is spreading. Notice, explanation, correction and human review are not going away. Colorado kept them. The EU requires similar things. They are also simply good practice: if your AI tool rejects a job applicant, you should be able to say why and let a person take a second look.
The federal fight is not settled. An executive order does not cancel state law. Only Congress or the courts can do that, and in Colorado the state rewrote its own law before any final ruling on the merits. Expect more challenges, and expect states to keep passing narrower, targeted rules rather than broad ones.
What we'd do
- Find your decision tools. List every place AI screens résumés, scores applicants, sets prices for individuals or approves credit. That list is your compliance map.
- Write the notice now. A short plain-language line telling people an automated tool is involved costs almost nothing.
- Build the appeal path. Decide who reviews a contested decision and how fast. Thirty days is the Colorado standard; aim faster.
- Keep records. Save what the tool decided, what data it used and who reviewed it. Three years is a reasonable default.
- Ask your HR and lending vendors what they will provide to support notices and explanations by January 2027.
Our view
Supporters of the original law say Colorado gave up real protection against biased algorithms under political pressure, and they have a point. A notice does not stop a biased tool from being used. The other side argues the old law was too vague to follow and would have pushed AI work out of the state. We think the rewrite landed close to the right baseline for small and mid-size businesses: tell people, explain decisions, let a human take a second look. Whatever happens in court or in Congress, a business that does those three things will be on the right side of almost any rule that survives.
Want a system like this in your business?
A discovery conversation is where we map it: what to automate first, where the human checkpoints go, and what it would take.
Book a discovery conversation →