A 96-Hour Update on SB 26-189: Notice Published in Colorado Register, Key Definitions and Requirements to Be Clarified Before Jan 1, 2027 Effective Date
Published: May 26, 2026
By: Zeeshan Khan
Reading time: 15 minutes
Category: Technology / Consumer Rights / Law
Note: May 26, 2026 – This is an update to the May 22, 2026 article: Colorado AI Law Enforcement On Hold – AG Won’t Act Until Rulemaking Ends as New Liability Details Emerge
DENVER – May 26, 2026 – Four days after legal analyses confirmed that Colorado Attorney General Phil Weiser would not enforce the state’s new AI anti-discrimination law until after rulemaking concluded, the Attorney General’s office has formally initiated that process. A notice of intent to commence rulemaking for Senate Bill 26-189 was published in the Colorado Register and on the Secretary of State’s website on May 25, 2026.
The May 22 article correctly noted that rulemaking had not yet begun and that this would be the next critical milestone. The formal initiation of rulemaking now moves the law one step closer to eventual enforcement, though the Attorney General’s commitment not to enforce until after rulemaking concludes remains in effect. The substantive obligations of SB 26-189 still take effect on January 1, 2027, but the rulemaking process will define key terms and requirements essential to compliance planning.
This development represents the first official step in implementing the nation’s most closely watched AI anti-discrimination legislation. The new law, which replaces mandatory pre-deployment risk assessments with a narrower disclosure-and-human-review framework, applies to any entity “doing business in Colorado” that develops or deploys covered automated decision-making technology (ADMT). With a federal lawsuit from Elon Musk’s xAI still pending, the compliance timeline remains subject to further developments.
The Essentials: Who, What, When, Where, Why, How (Last 96 Hours)
Who: Colorado Attorney General Phil Weiser, who has now formally initiated rulemaking and remains committed to not enforcing the law until after the process concludes; Colorado Governor Jared Polis, who signed the bill on May 14; AI developers and deployers doing business in Colorado; HIPAA-covered entities and business associates, who are explicitly exempted; and consumers, employees, and job applicants affected by algorithmic decisions.
What: Two major developments since May 22, 2026:
- The Attorney General has formally initiated the rulemaking process for SB 26-189, with a notice published in the Colorado Register on May 25, 2026
- The Attorney General’s commitment not to enforce the law until after rulemaking concludes remains in effect, creating a continued enforcement pause
When:
- May 25, 2026 – Attorney General’s office publishes formal notice of intent to commence rulemaking in the Colorado Register and on the Secretary of State’s website
- May 22, 2026 – Previous article published, noting rulemaking had not yet begun
- May 14, 2026 – Governor Polis signs SB 26-189 into law
- January 1, 2027 – Law’s substantive obligations take effect (unchanged)
Where: The rulemaking process is conducted by the Colorado Attorney General’s office in Denver. The law applies to any entity “doing business in Colorado” that develops or deploys covered ADMT, affecting companies nationwide that serve Colorado residents.
Why (Immediate Cause): The Attorney General is required to adopt rules by January 1, 2027, to implement the law. The formal initiation of rulemaking begins that process, providing a timeline for stakeholder input and regulatory clarity.
How (Mechanism): The Attorney General has broad rulemaking authority under the new law. The rulemaking process will establish specific regulatory requirements and interpretations, including for “meaningful human review,” adverse outcome notices, record retention, and the scope of covered ADMT.
Specific Updates in the Last 96 Hours (May 22–26, 2026)
1. Attorney General Formally Initiates Rulemaking (May 25)
On May 25, 2026, the Colorado Attorney General’s office published a formal notice of its intent to commence the rulemaking process to implement SB 26-189. The notice was published in the Colorado Register and on the Secretary of State’s website.
What the Notice Contains: The notice confirms the Attorney General’s intent to adopt rules to implement the new AI law. It initiates the formal process required under Colorado’s Administrative Procedure Act, including public notice, comment periods, and potential public hearings.
Statutory Deadline: The Attorney General must adopt rules by January 1, 2027. The formal initiation of rulemaking on May 25, 2026, provides approximately seven months for the process to be completed.
What This Means for Businesses: The rulemaking process will define key terms and requirements that are not fully specified in the statute, including the scope of “meaningful human review,” the content and format of adverse outcome notices, and the specific records that must be retained. Businesses should actively monitor the proceedings and consider submitting comments.
2. Enforcement Remains on Hold – Pending Rulemaking Completion
The Attorney General’s commitment not to enforce the law until after the rulemaking process concludes remains in effect. This enforcement pause, first reported in the May 22 article, is unchanged.
Current Enforcement Status:
| Element | Status |
|---|---|
| Enforcement | ON HOLD – AG will not enforce until after rulemaking concludes |
| Rulemaking | FORMALLY INITIATED – Notice published May 25 |
| Effective date | January 1, 2027 (unchanged) |
| Compliance requirement | Businesses should prepare for Jan 1, 2027, but enforcement is paused pending rulemaking |
Practical Implications: The enforcement pause creates a continued safe harbor for businesses. However, with rulemaking now initiated, the compliance clock is moving closer to eventual enforcement. Businesses cannot rely on indefinite delay.
Attorney General’s Stated Position (Unchanged): Colorado Attorney General Phil Weiser has stated he does not intend to enforce SB 24-205 or any legislation replacing or amending it—including SB 26-189—until after the rulemaking process has concluded.
3. Rulemaking Will Address Key Undefined Terms
The statute leaves several critical terms and requirements to be defined through rulemaking. The formal initiation of rulemaking means these definitions will now be developed.
Key Areas to Be Addressed in Rulemaking:
| Area | Current Status in Law | What Rulemaking Will Clarify |
|---|---|---|
| Meaningful human review | Defined broadly: trained individual with authority to override, cannot default to output, must consider evidence | Specific training requirements, documentation standards, deliberation thresholds, what constitutes “considering relevant evidence” |
| Adverse outcome notices | Required within 30 days; specific content “to be determined by Attorney General rules” | Mandatory content, format, delivery methods, timing exceptions |
| Covered ADMT scope | Defined as technology that “materially influences” consequential decisions | Threshold for “materially influences,” specific examples, boundaries, exemptions |
| Record retention | 3-year requirement | Format, accessibility, specific data elements to retain, security requirements |
| Cure period | 60 days; AG may skip for knowing/repeated violations | Criteria for determining “knowing or repeated” violations |
Significance: These rulemakings will determine the practical compliance burden for businesses. A narrow interpretation of “meaningful human review” could reduce compliance costs; a broad interpretation could increase them.
4. Health Care Exemption and Liability Framework: Unchanged from May 22
The health care exemption and liability framework described in the May 22 article remain unchanged. The rulemaking process may provide additional clarification, but the statutory provisions are already in effect.
Health Care Exemption (Confirmed): HIPAA covered entities and business associates are exempted from most developer and deployer obligations unless they are using ADMT to make employment-related consequential decisions.
Liability Framework (Confirmed): A comparative fault framework allocates responsibility between developers and deployers. Contracts cannot require one party to indemnify another for the indemnified party’s own discriminatory acts. Any contractual provision that would shield a developer or deployer from liability for its own discriminatory acts is void.
“Meaningful Human Review” Definition (Confirmed): The statutory definition remains: a trained individual with authority to approve, modify, or override the decision, who considers relevant evidence and cannot simply default to the system’s output.
5. xAI Lawsuit Remains Pending
The federal lawsuit from Elon Musk’s xAI, which challenges the original 2024 AI law, remains pending. The court’s stay remains active until 14 days after a ruling on xAI’s preliminary injunction motion.
Current Status:
| Element | Status |
|---|---|
| xAI lawsuit | PENDING |
| Preliminary injunction motion | PENDING – no ruling as of May 26 |
| Court’s stay | ACTIVE – until 14 days after ruling on injunction motion |
| Potential impact on SB 189 | Unknown – could invalidate or modify the law |
Connection to Rulemaking: The pending lawsuit could affect the rulemaking process. If the court invalidates the law or grants a broad injunction, the rulemaking may need to be adjusted or suspended. Businesses should monitor both the rulemaking and the litigation.
Comparison: Before and After the May 26 Update
| Issue | As of May 22 Article | As of May 26, 2026 (Current) |
|---|---|---|
| Rulemaking status | Not yet initiated | FORMALLY INITIATED – Notice published May 25 |
| Enforcement | On hold until after rulemaking | ON HOLD – unchanged |
| Effective date | January 1, 2027 | January 1, 2027 (unchanged) |
| Health care exemption | Confirmed | CONFIRMED – unchanged |
| Liability framework | Clarified | CLARIFIED – unchanged |
| “Meaningful human review” | Defined | DEFINED – unchanged |
| xAI lawsuit | Pending | PENDING – unchanged |
| Cure period | 60 days | 60 days (unchanged) |
| Private right of action | Not included | Not included (unchanged) |
What Rulemaking Will Likely Address
The Attorney General’s rulemaking authority under SB 26-189 is broad. The following areas are most likely to be addressed through the rulemaking process.
1. Defining “Meaningful Human Review” in Practice
The statute provides a definition but leaves many practical questions unanswered. Rulemaking will likely specify:
- What constitutes adequate training for reviewers
- How much deliberation is required
- What documentation must be kept of the review process
- Whether automated or semi-automated review processes qualify
- Standards for “considering relevant evidence”
2. Specifying Adverse Outcome Notice Content
The statute requires notice within 30 days of an adverse outcome but leaves the specific content to Attorney General rules. Rulemaking will likely specify:
- Required information about the ADMT used
- Explanation of how the technology reached the outcome
- Information about the right to request human review
- Format and delivery methods (email, postal mail, electronic portal)
- Timing exceptions for good cause
3. Clarifying “Materially Influences” Threshold
The statute applies to ADMT that “materially influences” consequential decisions. Rulemaking will likely specify:
- Quantitative or qualitative thresholds for “materially influences”
- Examples of decisions that are covered and not covered
- Exemptions for low-risk or de minimis uses
- Treatment of human-in-the-loop systems
4. Establishing Record Retention Standards
The statute requires a 3-year record retention period but does not specify format or content. Rulemaking will likely specify:
- Required data elements to be retained
- Format (original format vs. normalized format)
- Accessibility standards
- Security and confidentiality requirements
- Destruction protocols after retention period expires
5. Defining “Knowing or Repeated” Violations for Cure Period
The Attorney General may skip the 60-day cure period for “knowing or repeated” violations. Rulemaking will likely specify:
- Definition of “knowing” – actual knowledge vs. constructive knowledge
- Definition of “repeated” – number of violations, time period
- Factors aggravating or mitigating application of the cure period
What Has Not Changed (Beyond the Rulemaking Initiation)
The following elements of the new law remain unchanged from the May 22 article:
| Element | Status |
|---|---|
| Mandatory risk assessments | REMOVED (compared to 2024 law) |
| Risk management programs | REMOVED |
| Duty of “reasonable care” | REMOVED |
| Incident reporting | REMOVED |
| Pre-decision notice | Required (effective Jan 1, 2027) |
| Post-adverse outcome disclosure (within 30 days) | Required |
| Human review on request | Required |
| Data correction process | Required |
| Record retention (3 years) | Required |
| Private right of action | NOT included |
| AG enforcement only | Yes |
| Health care exemption | Confirmed |
| Developer liability shield | Confirmed |
| Indemnification prohibition | Confirmed |
Arguments For and Against (Updated for May 26)
In Favor of the Rulemaking Initiation
1. Provides Regulatory Clarity
The rulemaking process will define key terms that are currently ambiguous. This clarity will help businesses understand their compliance obligations and reduce legal uncertainty.
2. Allows Stakeholder Input
The formal rulemaking process includes public notice and comment periods, allowing businesses, consumer advocates, and other stakeholders to provide input on the implementing regulations.
3. Moves Toward Enforcement
With rulemaking initiated, the law is one step closer to eventual enforcement. Consumers who are discriminated against by AI systems will eventually have recourse through the Attorney General’s office.
4. Consistent with AG’s Commitment
The Attorney General stated he would not enforce until after rulemaking concludes. Initiating rulemaking is the necessary first step to eventually reaching that point.
Against the Rulemaking Initiation
1. Enforcement Remains Delayed
While rulemaking has begun, enforcement remains on hold until it concludes. Consumers discriminated against by AI systems still have no immediate recourse.
2. Rulemaking Could Be Lengthy
The rulemaking process, including public notice, comment periods, potential hearings, and final rule adoption, could take many months. The Attorney General must complete rules by January 1, 2027, but there is no guarantee of completion by that date.
3. xAI Lawsuit Could Invalidate the Law
The pending xAI lawsuit could invalidate or significantly modify the law before rulemaking is complete. If the court rules against the law, the rulemaking may be rendered moot.
4. Key Definitions Remain Uncertain
While rulemaking has begun, the key definitions that businesses need for compliance planning are not yet final. Businesses must prepare for the January 1, 2027 effective date without knowing the final regulatory requirements.
Remaining Concerns (Updated for May 26)
| Concern | Status |
|---|---|
| Enforcement on hold | AG discretion – could change after rulemaking |
| Rulemaking timeline | Must be completed by Jan 1, 2027 – no guarantee |
| xAI lawsuit pending | Could invalidate or modify the law |
| Private right of action | Not included (unchanged) |
| Cure period (60 days) | May allow violators to avoid penalties |
| AG resources for enforcement | Limited – uncertain capacity |
| Consumer awareness | Minimal – most Coloradans unaware of changes |
| Key definitions not yet final | Awaiting rulemaking |
Current Status (As of May 26, 2026)
| Element | Status |
|---|---|
| SB 26-189 signature | COMPLETED (May 14, 2026) |
| Effective date | January 1, 2027 |
| Enforcement | ON HOLD – AG will not enforce until after rulemaking |
| Rulemaking | FORMALLY INITIATED – Notice published May 25, 2026 |
| xAI lawsuit | PENDING – stay remains active |
| Health care exemption | CONFIRMED – HIPAA entities exempted |
| Liability framework | CLARIFIED – comparative fault, no indemnification for own acts |
| “Meaningful human review” | DEFINED – high bar, no defaulting to output |
| Private right of action | NOT INCLUDED |
| Cure period | 60 days (expires Jan 1, 2030) |
| National media coverage | Limited – primarily legal trade publications |
What to Watch For
| Event | Expected Timing | Significance |
|---|---|---|
| Public notice of proposed rules | Unknown – likely in coming months | Will reveal AG’s interpretation of key terms |
| Public comment period | Typically 30-60 days | Allows stakeholder input |
| xAI preliminary injunction ruling | Unknown – pending | Could invalidate or modify the law |
| Final rule adoption | By Jan 1, 2027 (statutory deadline) | Will establish binding regulatory requirements |
| Enforcement begins | After rulemaking concludes | No firm date – could be well after Jan 1, 2027 |
| Federal preemption | Unknown | DOJ intervention signals possible federal action |
| Other state responses | Unknown | Colorado’s law may influence California, New York, Illinois |
Why This Matters to the Average Person (Updated for May 26)
The formal initiation of rulemaking might seem like a technical administrative step, but it matters for several reasons that affect every American who has ever applied for a job, a loan, an apartment, or medical care.
First, the law is moving forward. The May 22 article noted that rulemaking had not yet begun. Now it has. The law is one step closer to eventual enforcement. The question is no longer if rulemaking will happen, but when it will be completed and what the final rules will say.
Second, key definitions are still uncertain. The rulemaking process will define what “meaningful human review” actually means in practice, what information must be included in adverse outcome notices, and what records must be retained. These definitions will determine the practical compliance burden for businesses and the practical protections for consumers.
Third, enforcement remains on hold. The Attorney General’s commitment not to enforce until after rulemaking concludes remains in effect. Consumers discriminated against by AI systems still have no immediate recourse. But the clock is now ticking toward eventual enforcement.
Fourth, the xAI lawsuit could change everything. The pending federal lawsuit could invalidate or significantly modify the law before rulemaking is complete. Businesses and consumers should monitor both the rulemaking and the litigation.
The bottom line: The Colorado AI law is moving forward with formal rulemaking now initiated. The Attorney General remains committed to not enforcing until after rulemaking concludes. Key definitions and requirements will be established through the rulemaking process, which businesses should actively monitor. The pending xAI lawsuit could affect or invalidate the law. The next critical milestones are the public notice of proposed rules and the ruling on xAI’s preliminary injunction motion.
Sources
- Colorado Attorney General’s Office (May 25, 2026) – Formal notice of intent to commence rulemaking for SB 26-189, published in Colorado Register and on Secretary of State website
- Colorado Attorney General Phil Weiser – Statement on enforcement of SB 24-205 and SB 26-189 (as cited in legal analyses, May 2026)
- Kelley Drye & Warren LLP – Ad Law Access (May 15-22, 2026) – Analysis of signature, enforcement pause, liability provisions, and health care exemption
- Reed Smith LLP – Technology Law Dispatch (May 15-22, 2026) – Updated analysis of SB 189 provisions, “meaningful human review” definition
- National Law Review (May 1-22, 2026) – xAI lawsuit status and enforcement stay
- Colorado General Assembly (May 14, 2026) – Bill signing record for SB 26-189
- Previous article: Colorado AI Law Enforcement On Hold – AG Won’t Act Until Rulemaking Ends as New Liability Details Emerge (The 5 Ws, May 22, 2026) – Baseline information on enforcement pause, health care exemption, liability framework, and “meaningful human review” definition
The 5 W's 
Leave a comment