The 5 W's

A 1-Day Update on SB 26-189: Polis’s Signature Finalizes Repeal, Eliminates Pre-Deployment Testing, and Sets New National Standard for Algorithmic Accountability

Published: May 19, 2026
By: Zeeshan Khan
Reading time: 13 minutes
Category: Technology / Consumer Rights / Law

Note: May 19, 2026 – This is an update to a previous article: Colorado Quietly Repeals Landmark AI Law – Replacing It With Something Weaker

DENVER – May 19, 2026 – One day after the Colorado General Assembly passed Senate Bill 26-189, Governor Jared Polis signed the legislation into law on May 14, 2026, formally repealing the nation’s first comprehensive AI anti-discrimination act (SB 24-205). The new law, which takes effect January 1, 2027, replaces mandatory pre-deployment risk assessments and a duty of “reasonable care” with a narrower disclosure-and-human-review framework.

This signature – which occurred with no public ceremony or press release – finalizes a 12-day legislative rewrite driven by a federal lawsuit from Elon Musk’s xAI and intervention by the Trump Department of Justice. Despite affecting every Coloradan who applies for a job, loan, or apartment, the signing has received almost no national media coverage.

The Essentials: Who, What, When, Where, Why, How

Who: Governor Jared Polis, who signed the bill on May 14; the Colorado General Assembly (Senate Majority Leader Robert Rodriguez, Assistant House Majority Leader Jennifer Bacon); Colorado Attorney General Phil Weiser, who must write implementing rules by January 1, 2027; AI developers and deployers doing business in Colorado; and consumers, employees, and job applicants.

What: Signing of SB 26-189 into law, which officially repeals the Colorado AI Act (SB 24-205) and replaces it with a regulatory framework for “automated decision-making technology” (ADMT) used in “consequential decisions” in employment, education, financial services, insurance, healthcare, residential real estate, and essential government services.

When: The bill was signed on May 14, 2026 – one day after the legislative session ended. It becomes effective on January 1, 2027. The original 2024 law would have taken effect on June 30, 2026.

Where: Governor Polis’s office in Denver. The law applies to any entity “doing business in Colorado” that develops or deploys covered ADMT, affecting companies nationwide that serve Colorado residents.

Why (Immediate Cause): The original 2024 law faced a federal lawsuit from xAI (filed April 9, 2026) and DOJ intervention (April 23, 2026). A federal magistrate stayed enforcement on April 27, 2026. With the legislative session ending May 13, lawmakers rushed SB 189 to passage. Polis’s signature makes the repeal official.

How (Mechanism): SB 189 completely replaces the 2024 Act. It eliminates mandatory risk assessments, risk management programs, and the duty of “reasonable care.” Instead, it requires companies to disclose when AI makes consequential decisions and to provide meaningful human review upon request. No pre-deployment testing for discrimination is required.

Case Background – The Final Step

The Colorado AI Act (SB 24-205), passed in May 2024, was the first state law in the nation designed specifically to regulate algorithmic discrimination. It would have taken effect on June 30, 2026 – just six weeks from now. The law required developers and deployers to conduct risk assessments, implement risk management programs, and use “reasonable care” to avoid algorithmic discrimination.

On April 9, 2026, Elon Musk’s xAI filed a federal lawsuit challenging the law. On April 23, the Trump Department of Justice intervened – the first time the federal government has moved to invalidate a state AI law. On April 27, a federal magistrate granted a joint motion to stay enforcement.

Faced with these pressures and a May 13 legislative deadline, lawmakers introduced SB 189 on May 1. It passed the Senate on May 7, passed the House on May 12-13, and was transmitted to the Governor. Polis signed it on May 14.

The federal court enforcement stay on the 2024 law remains active until 14 days after the court rules on xAI’s preliminary injunction motion. That ruling is still pending. However, because the 2024 law is now repealed effective January 1, 2027, the practical impact of the stay is limited to the period between June 30, 2026 (when the 2024 law would have taken effect) and January 1, 2027 (when SB 189 takes effect).

What the Signed Law Requires (Effective Jan 1, 2027)

Covered ADMT Definition: Technology that “materially influences” a “consequential decision” in employment, education, financial services, insurance, healthcare, residential real estate, and essential government services.

Excluded: Advertising, content moderation, cybersecurity, fraud prevention, routine clerical tasks, and consumer chatbots with acceptable use policies.

Developer Obligations (starting Jan 1, 2027):

Requirement	Detail
Documentation	Provide intended uses, training data categories (to extent known), known limitations and risks, monitoring instructions
Update notices	Notify deployers of material updates or modifications
Record retention	Keep compliance records for at least 3 years

Note: These apply only where the developer marketed or intended the ADMT for use in consequential decisions.

Deployer Obligations (starting Jan 1, 2027):

Requirement	Detail
Pre-decision notice	Clear disclosure that ADMT is or will be used, provided before the consequential decision
Post-adverse outcome disclosure	Within 30 days, provide plain-language description of the decision, ADMT’s role, and consumer rights
Human review on request	Opportunity for “meaningful human review” by trained individual with authority to override
Data correction	Process for correcting factually inaccurate personal data
Record retention	Keep records for at least 3 years after the decision

“Meaningful human review” requires a trained individual who does not simply default to the system’s output.

What Was Removed (Compared to 2024 Law)

2024 Requirement	Status in Signed SB 189
Mandatory risk assessments for developers	Removed
Mandatory risk assessments for deployers	Removed
Risk management program requirements	Removed
Duty of “reasonable care” to avoid discrimination	Removed
Incident reporting requirements	Removed

Enforcement Structure

Element	Detail
Who enforces	Colorado Attorney General only (no private right of action)
Legal mechanism	Deceptive trade practices under Colorado Consumer Protection Act
Cure period	60 days before enforcement, unless violation was knowing or repeated
Rulemaking	AG must adopt rules by Jan 1, 2027 clarifying disclosure requirements
Reporting	AG must report on enforcement actions Jan 2028 – Jan 2030

The cure period expires on Jan 1, 2030 – after that, no cure period.

New Liability and Indemnification Provisions

The signed bill includes liability language not present in the original 2024 law or the initial version of SB 189:

• Developer liability shield: A developer is generally not liable for a deployer’s misuse of ADMT, provided the developer complied with documentation and disclosure obligations.
• Indemnification prohibition: Contracts cannot require one party to indemnify another for the indemnified party’s own discriminatory acts. Each deployer remains responsible for its own compliance.
• No private right of action: Consumers cannot sue companies directly. Only the Attorney General may enforce.

Arguments in Favor of the Signed Law

1. The 2024 Law Was Unworkable

Supporters – including Governor Polis, the Colorado Chamber of Commerce, and the bill’s Democratic sponsors – argued that the original law imposed vague, impossible-to-follow requirements. In his May 2024 signing statement, Polis said the original law would “create a complex compliance regime…[with] significant, affirmative reporting requirements.” After signing SB 189, Polis’s office issued a brief statement saying the new law “provides clarity for innovators while maintaining important consumer protections.”

2. Small Businesses Can Now Comply

Critics of the 2024 law warned that costly mandates would harm small firms. The R Street Institute called the original law a “guilty-until-proven-innocent standard.” Adam Burrows of Range Ventures called SB 189 “a massive improvement.” With the signature, those supporters have achieved their goal.

3. Existing Laws Already Cover Discrimination

Supporters argue that federal and state civil rights laws – including the Civil Rights Act of 1964, the Fair Housing Act, and the Equal Credit Opportunity Act – already prohibit discrimination regardless of whether a human or an AI makes the decision. The new law relies on those existing statutes as a backstop.

4. A National Framework Is Needed

Governor Polis has called for “a cohesive federal approach…applied by the federal government to limit and preempt varied compliance burdens.” SB 189, now law, is positioned as a stopgap while Congress considers national AI legislation.

Arguments Against the Signed Law

1. It Removes Meaningful Protections

The 2024 law’s risk assessment and risk management requirements were designed to prevent discrimination before it happens. SB 189 removes those requirements entirely. Robert Lindgren of Colorado’s AFL-CIO told Denver7 that the bill is “a good first step” but said more is needed: “If we’re looking at a framework that actually protects more of the public, it’s that you test these systems ahead of time to ensure that they do not discriminate.” With Polis’s signature, that framework is now law.

2. No Private Right of Action Means Weak Enforcement

Only the Attorney General can enforce violations. The AG’s office has limited resources. A consumer who is discriminated against by an AI system cannot sue the company directly. During testimony on the bill, critics “suggested that a private right of action would be necessary given the Attorney General’s office’s limited resources.” The signed bill does not include one.

3. The 60-Day Cure Period Lets Violators Off the Hook

If the AG finds a violation, the deployer or developer gets 60 days to “cure” the problem before any enforcement action – unless the violation was knowing or repeated. Critics argue this creates a “get out of jail free” card. Senate Majority Leader Robert Rodriguez wanted the cure period to be shorter. The signed law retains the 60-day period, expiring January 1, 2030.

4. The Bill Was Rushed Through With Little Public Debate

SB 189 was introduced on May 1 and signed on May 14 – a 13-day process from introduction to law for a bill that repeals the nation’s first AI anti-discrimination law. The legislative session was ending, and lawmakers faced pressure from the federal lawsuit and DOJ intervention. There was no opportunity for extended public hearings or amendment.

5. It Prioritizes Innovation Over Civil Rights

Opponents argue that SB 189 represents a choice: protect tech companies from compliance burdens, or protect consumers from algorithmic discrimination. The bill chooses the former. Assistant House Majority Leader Jennifer Bacon, who supported the bill, acknowledged the tension: “Businesses and entities are using technology to determine if we get a job, to determine if we get a loan, to possibly determine what our healthcare diagnosis is. And so…people want to know what happens if they get it wrong, because in real life, if they get it wrong, it hurts people.”

Media Coverage and Public Awareness – One Day Later

As of May 19, 2026, one day after the original article was published and five days after Polis signed the bill, media coverage remains minimal.

• No major national newspaper has published a story about the signing.
• No cable news network has aired a segment.
• No broadcast evening newscast has mentioned the law.
• Legal trade publications – Kelley Drye & Warren LLP, Reed Smith LLP, the National Law Review – have updated their analyses to note the signature.
• Local Colorado outlets – Denver7, Colorado Politics – have published brief notes on the signing, but no in-depth follow-up.

The lack of public awareness is particularly striking given what is at stake. Every time you apply for a job, your resume is likely screened by an AI system. Every time you apply for a credit card or a loan, an algorithm helps decide your fate. Every time you apply for an apartment, AI may be involved in your eviction risk score. Under the 2024 law, companies would have had to test those systems for discrimination before using them. Under the signed law, they mostly have to tell you after the fact – and give you a human to appeal to.

Current Status – As of May 19, 2026

• SB 26-189: Passed both chambers May 12-13, 2026; signed by Governor Polis on May 14, 2026
• Governor’s signature: Completed May 14, 2026
• Effective date: January 1, 2027
• 2024 Colorado AI Act: Repealed as of effective date of SB 189 (January 1, 2027)
• Federal court enforcement stay (2024 law): Active until 14 days after ruling on xAI motion. Ruling still pending.
• AG rulemaking for SB 189: Required by January 1, 2027
• Private right of action: Not included
• Cure period: 60 days (expires January 1, 2030)
• National media coverage: None as of May 19, 2026

Why This Matters to the Average Person

The signing of SB 189 might seem like an obscure administrative step, but it matters for four reasons that affect every American who has ever applied for a job, a loan, an apartment, or medical care.

First, you are already being scored by AI – and you probably don’t know it. If you have applied for a job in the last three years, there is a significant chance your resume was screened by an AI system that decided whether a human would ever see it. Under the 2024 law, companies would have had to test those systems for discrimination before July 2026. Under the signed law, they don’t have to test at all.

Second, prevention is being replaced with reaction. The 2024 law required companies to test AI systems for bias before they caused harm. The signed law requires disclosure and human review after the fact. Once you’ve been denied a loan or passed over for a job, an after-the-fact human review is cold comfort.

Third, enforcement is now in the hands of one person. Only the Colorado Attorney General can enforce violations. The AG’s office has limited resources. You cannot sue a company that discriminates against you with AI. You can only file a complaint and hope the AG decides to investigate.

Fourth, Colorado was just the first – and now the standard. Other states – California, New York, Illinois – were watching Colorado’s experiment. The nation’s first AI anti-discrimination law lasted only two years before being replaced by a weaker alternative. The Trump DOJ’s intervention in the xAI lawsuit signals that the federal government may preempt or invalidate stronger state AI laws altogether. SB 189 may be the ceiling, not the floor – the most protection American consumers can expect from algorithmic discrimination.

The Colorado AI Act was a first-in-the-nation attempt to answer a fundamental question of the AI age: Who watches the watchers? Who ensures that the algorithms scoring our lives are not discriminating against us based on race, gender, age, or disability? The original law had an answer: mandatory testing before deployment. SB 189 has a different answer: disclosure and a human appeal. With Governor Polis’s signature on May 14, 2026, that answer is now law.

Sources

• Colorado General Assembly (May 14, 2026) – Bill signing record for SB 26-189
• Governor Jared Polis (May 14, 2026) – Statement on signing SB 189 (no public ceremony)
• Denver7 (May 11, 2026; updated May 15, 2026) – Local news coverage of bill passage and signature
• Kelley Drye & Warren LLP – Ad Law Access (May 15, 2026) – Analysis of signature and liability provisions
• Reed Smith LLP – Technology Law Dispatch (May 15, 2026) – Updated analysis of SB 189 provisions
• National Law Review (May 1, 2026; updated May 15, 2026) – xAI lawsuit status and enforcement stay
• Colorado Politics (May 4, 2026; May 15, 2026) – Legislative process and signing note