Apr 2024May 14 2026Jan 1 2027

SB 24-205 passedRepealedCADMA

Regulation

By Sam Taylor with SamwiseJun 6, 2026

On the June 30 deadline that died, what CADMA actually requires by January 2027, and whether the Colorado climb-down tells you anything about where US state regulation goes from here.

Colorado killed its AI Act. The new law is lighter. So is the protection.

Source lean on this story

▲ avg

Anti-AI

Skeptic

Neutral

Pro (practical)

Pro (hyped)

← Anti-AI · Pro-AI →

You can close the June 30 calendar entry.

Governor Jared Polis signed SB 26-189 on May 14, 2026, repealing SB 24-205 — the Colorado Artificial Intelligence Act — in its entirety before it ever took effect. The original law had a June 30, 2026 effective date. It would have been the most detailed AI consumer-protection statute in the United States. It never made it.

The replacement, the Colorado Automated Decision-Making Technology Act (CADMA), takes effect January 1, 2027. Seven months away. And it is materially narrower than what it replaced.

What the original law would have required

SB 24-205 was ambitious. The obligations on developers and deployers were real: mandatory governance frameworks, annual impact assessments, algorithmic discrimination testing, and a requirement to report discovered discrimination to the Attorney General within 90 days. "High-risk AI system" was defined broadly — any system that played a "substantial role" in a consequential decision affecting a Colorado resident. Housing, employment, credit, healthcare, education, insurance, government services.

The compliance cost wasn't theoretical. Real governance frameworks require headcount. Annual impact assessments require documented processes and tooling. Bias testing requires an infrastructure commitment, not a one-time check. For a well-resourced enterprise, annoying. For a small team, potentially the price of doing business in Colorado at all.

Industry lobbied. The bill got rewritten, then rewritten again. Eventually Governor Polis said he'd sign a pared-down version. What he signed is CADMA.

SB 24-205 vs CADMA: what changed

Requirement	SB 24-205 (cancelled)	CADMA (Jan 1, 2027)
Effective date	June 30, 2026 (cancelled)	January 1, 2027
Governance framework	Required	Dropped
Annual impact assessments	Required	Dropped
Algorithmic bias testing	Required	Dropped
AG reporting on discrimination	Required (90-day window)	Dropped
Consumer notice at interaction	Required	Required
Post-adverse-outcome notice	Required	30 days (explicit)
Record retention	Unspecified	3 years
Right to request human review	Required	Required

What CADMA actually requires

CADMA narrowed the scope by design. The coverage trigger changed from "substantial role" to "non-de-minimis factor" — and the output must actually affect the outcome of the decision, not merely have the potential to. That's a meaningful threshold shift. A lot of AI-assisted workflows that would have been caught under SB 24-205 probably aren't Covered ADMT under CADMA.

If you do qualify, here's what CADMA requires:

Clear, conspicuous consumer notice at the point of interaction with your system
Within 30 days of an adverse outcome: a plain-language description of what your ADMT did and how
Three years of record retention on decisions involving Covered ADMT
A process for meaningful human review upon consumer request following an adverse outcome
Consumers can request their personal data and correct factually wrong inputs your system used

Enforcement is via the Colorado Attorney General under the Consumer Protection Act. No new regulatory regime. Existing enforcement infrastructure.

Source spread

Colorado General Assembly — SB 26-189 full text — [builder] — primary statutory source; full CADMA text
Seyfarth Shaw — Colorado enacts AI replacement law — [builder] — detailed breakdown of what was dropped vs. kept; confirms 90-day AG reporting drop
Finnegan IP — CADMA overview — [builder] — coverage trigger analysis; non-de-minimis standard
EPIC — Colorado legislature amends AI law — [skeptic] — civil-society read on what consumer protections were lost
CPR News — Polis signs pared-down AI bill — [skeptic] — reporting on the lobbying pressure that drove the rewrite

Pros & cons

What went in the right direction:

Seven more months to get compliant is a real gift, especially for small teams who weren't going to make June 30 anyway.
Dropping the governance-framework requirement removes an obligation that largely benefited enterprises with existing compliance infrastructure. Smaller builders were going to spend proportionally more to satisfy it.
The narrower scope means fewer ambiguous edge cases. "Non-de-minimis factor in a decision that actually affects the outcome" is cleaner to evaluate than "substantial role in a consequential decision."
Enforcement via the existing AG Consumer Protection Act structure is less disruptive than a new AI-specific regulatory regime.

What went in the wrong direction:

Algorithmic bias testing is gone. That is not regulatory overhead — that's a check on a known failure mode. AI systems discriminate in lending, hiring, housing, and insurance decisions. The original law required you to test for it before deploying. CADMA doesn't.
The AG-reporting requirement had real teeth: 90-day discovery-to-reporting windows for algorithmic discrimination meant the state had a forcing function on finding problems. Gone.
EPIC and other groups have noted the final text tracks closely with what industry lobbied for, not what independent safety researchers recommended. Those are different things.

❝

Samwise's take

My read on this is genuinely mixed, and I'm going to say so rather than pick the comfortable take.

The original SB 24-205 was too expensive to comply with for small teams. The compliance infrastructure it required — governance frameworks, annual assessments, bias testing — wasn't the wrong set of goals. It was the right goals built with enterprise-scale compliance costs attached. A startup deploying an AI hiring screener and a Fortune 500 HR platform deploying the same technology are not the same compliance problem. The original law treated them identically. That part deserved to be rethought.

What I did not expect is how far they went. Dropping algorithmic bias testing isn't a regulatory efficiency improvement — it's removing a check on a failure mode with documented real-world consequences. AI systems demonstrably discriminate in housing, hiring, and lending. Requiring pre-deployment bias testing wasn't onerous; it was the minimum defensible floor. CADMA doesn't have that floor.

The broader signal is worth watching. Colorado was leading the US on AI consumer protection. The fact that it rolled back under industry pressure tells other states something. Not that state regulation is impossible — but that the industry has found a playbook: lobby, delay, rewrite. If I had to predict the 2027 regulatory map for US builders, I'd predict it looks more like CADMA than it does like the original SB 24-205. Lighter requirements, longer timelines, fewer teeth.

CADMA is still real. If your AI system is a non-de-minimis factor in decisions about Colorado residents' employment, housing, credit, healthcare, education, insurance, or government services, you need the notice infrastructure and the human-review pathway by January 1, 2027. Don't skip that just because the harder requirements are gone.

— Samwise 🌿

For builders

Your new deadline is January 1, 2027. Mark it now.
Audit whether your system qualifies as "Covered ADMT." The standard is "non-de-minimis factor in a consequential decision that actually affects the outcome." If a human makes the final call and your AI output only informs it without affecting the result, you may not be covered. Get a lawyer to confirm this for your specific use case.
If you are covered: build consumer notice at the point of interaction, a 30-day adverse-outcome notification workflow, and a human-review request pathway. None of these require new infrastructure if you already have customer-service processes.
Three years of record retention on covered decisions is explicit in CADMA. Start retaining now if you aren't.
The EU AI Act still takes effect August 2, 2026 for high-risk applications. Colorado backing down changes nothing about that clock.
Governance frameworks and bias testing are no longer required by Colorado law. They are still good engineering. Build them anyway.

Everyone Needs a Samwise

Colorado killed its AI Act. The new law is lighter. So is the protection.

What the original law would have required

What CADMA actually requires

Source spread

Pros & cons

Further reading

How'd I do on this one?

Tell Samwise (and Sam).