Question 1

Is the Colorado AI Act still in effect?

Accepted Answer

No. Colorado repealed the AI Act (SB 24-205) on May 14, 2026 — before it ever took effect — and replaced it with the ADMT in Consequential Decisions Act (SB 26-189). The January 1, 2027 date carried over, so a lot of published guidance still cites the right deadline while describing the wrong law. If your compliance plan was built around "high-risk AI systems" and annual impact assessments, it was built against a statute that no longer exists.

Question 2

What replaced the Colorado AI Act?

Accepted Answer

SB 26-189, the ADMT in Consequential Decisions Act. It drops the high-risk classification scheme, mandatory risk-management programs, annual impact assessments, and the duty of reasonable care. In their place it regulates automated decision-making technology that materially influences a consequential decision, with four duties: notice before the decision, a plain-language explanation of adverse decisions within 30 days, meaningful human review where technically feasible, and three-year records retention. The Attorney General enforces it; there is no private right of action. A second bill, HB 26-1263, separately covers consumer-facing conversational AI.

Question 3

Are AI impact assessments still required in Colorado?

Accepted Answer

No — Colorado dropped that requirement when it repealed SB 24-205, and we won't tell you otherwise. But they are still required elsewhere: California's CCPA ADMT regulations mandate documented risk assessments by the same January 1, 2027 date, and the EU AI Act has its own regime. They're also still the first artifact boards, insurers, and enterprise procurement teams ask to see. GOVERNBOX includes impact assessments as best practice and as compliance for the jurisdictions that do require them — never as a Colorado legal duty.

Question 4

Does California have an AI deadline on January 1, 2027 too?

Accepted Answer

Yes. California's CCPA regulations on automated decisionmaking technology require compliance by January 1, 2027 — the same date as Colorado's ADMT Act. They cover ADMT used for "significant decisions" about California residents (including employees, applicants, and contractors) across lending, housing, education, employment, and healthcare, and require pre-use notices, opt-out and access rights, and documented risk assessments. If you operate in both states, that's one program and one deadline, not two.

Question 5

Is there a free AI policy template for nonprofits?

Accepted Answer

Our AI Readiness Scorecard is free with no sign-up, and the 15-day free trial takes no credit card. A nonprofit's actual sector-aware policy — tailored to your programs and grounded in a cited control library rather than a generic fill-in-the-blank template — is included starting on the Starter plan, with a 20% nonprofit discount on every plan.

Question 6

What does nonprofit AI governance actually involve?

Accepted Answer

At minimum: an inventory of every AI tool in use (including "shadow AI" staff have adopted on their own), a written AI use policy, a risk register, a way to prove human oversight of automated decisions, and a plan for when something goes wrong. Boards increasingly expect all five, whether or not a specific law requires them yet.

Question 7

Does Colorado's AI law apply to small businesses?

Accepted Answer

Colorado's current AI framework (SB 26-189 and HB 26-1263) applies based on what your organization does with AI — whether you deploy automated decision-making technology that materially influences a consequential decision about a consumer — not on your headcount or revenue. Small businesses and nonprofits using AI for hiring, lending, housing, or similar decisions can be in scope. There is no blanket small-business exemption. The Attorney General's implementing rules are still being finalized.

Question 8

Does a small business need an AI acceptable use policy?

Accepted Answer

Yes, in practice, even where no law mandates one yet. An acceptable-use policy is what tells staff what they can and can't paste into a public AI tool, protecting you from data leaks and IP exposure long before any compliance deadline — and it's one of the fastest documents to put in place.

Question 9

What should a board AI oversight checklist include?

Accepted Answer

The five questions every board should be able to answer on demand: who owns each AI system, what data it uses, how it was tested, how it's monitored in production, and what the plan is if it fails. Our Board Report is built around exactly these five questions, refreshed every quarter.

Question 10

How do we start Colorado AI law compliance?

Accepted Answer

Start with an inventory of every AI system your organization uses, then identify which ones are automated decision-making technology materially influencing a consequential decision. From there, work the four duties directly: a pre-use consumer notice, a plain-language adverse-decision explanation you can produce within 30 days, a human-review path with someone empowered to change the outcome, and records you can hold for three years. Our Colorado Compliance Crosswalk maps your existing policies against each requirement and flags exactly what's missing.

Question 11

What is required for SB 26-189 compliance?

Accepted Answer

SB 26-189 (Deployer Interactivity and Consumer Notifications, Consumer Appeal and Human Oversight, Developer Documentation and Transparency, Incident Reporting, and Records Retention) requires deployers to notify consumers before and after a covered automated decision, provide a path to human review and appeal, and keep compliance records for at least three years — alongside developer-side documentation and disclosure duties. Our library maps each requirement to a specific statutory citation, not a vague summary.

Question 12

What AI law compliance applies to small business generally?

Accepted Answer

Beyond Colorado, small businesses using AI for consequential decisions increasingly face a patchwork of state AI laws, plus sector rules (like HIPAA for healthcare) and the EU AI Act if you serve EU residents. The safest approach is one governance program — inventory, risk register, policies, training, incident log — that maps to whichever specific laws apply to you, rather than a one-off document per law.

Colorado repealed its AI Act. What replaced it starts January 1, 2027.

Two questions decide it

Six duties, in plain words

Use reasonable care

Have a risk management program

Do an impact assessment

Tell people AI was involved

Give people a way to appeal

Report discrimination you find

The Colorado crosswalk, line by line

What people ask about the repeal

Find out if this applies to you