With comprehensive federal AI legislation absent in the US (see our explainer on the 2025 federal policy shift), state legislatures have moved to fill the gap, and Colorado's experience shows just how difficult that's proven even for a state that moved early and decisively. Its original AI law never took effect in its originally passed form at all.
What Colorado originally passed
Colorado's SB24-205, the Consumer Protections for Artificial Intelligence Act, was enacted on May 17, 2024 as the first comprehensive state-level AI law of its kind, aimed at protecting consumers from algorithmic discrimination in "high-risk" AI systems. Those making or influencing consequential decisions in housing, lending, employment, education, or healthcare. The bill imposed a formal duty of care on developers and deployers of these systems, required detailed algorithmic impact assessments, and established a rebuttable presumption of legal compliance for companies following recognized risk-management frameworks like the NIST AI Risk Management Framework, a structural approach closely comparable to the EU AI Act's risk-tier model, covered in our explainer.
Why it kept getting delayed
The law's effective date proved to be a moving target almost immediately. Originally set to require compliance starting February 1, 2026, Colorado's legislature passed a special-session bill delaying that to June 30, 2026, a real acknowledgment that businesses and regulators weren't ready to implement the law's compliance infrastructure on the original timeline.
What happened next: a full replacement, not another delay
Rather than delaying a third time, Colorado replaced SB24-205 entirely: Senate Bill 26-189 was signed on May 14, 2026, and its provisions now go into effect January 1, 2027. Meaning the original 2024 law's specific requirements never actually became binding in their originally passed form. This is a genuinely unusual outcome for a piece of legislation this closely watched, and it's a useful data point for any company that had been building compliance programs around the original bill's specific language.
Why this saga matters beyond Colorado
Colorado's experience is a real, concrete illustration of a broader dynamic we cover in our comparison of how US states are diverging on AI governance: first-mover state AI legislation faces genuine implementation difficulty that a bill's initial passage doesn't resolve. A law can be well-intentioned and still require substantial revision once the practical mechanics of algorithmic impact assessments, duty-of-care standards, and compliance-presumption frameworks meet the reality of how AI systems are actually built and deployed across a huge range of company sizes and technical maturity levels.
What this means for companies tracking state AI law
The practical lesson isn't "state AI law doesn't matter because it keeps changing". It's closer to the opposite: companies operating AI systems that touch Colorado consumers need to track this kind of legislative revision actively rather than assuming a signed bill's original text is the final word. This connects to the broader compliance discipline we recommend in our AI regulation landscape guide. Treating state-level AI compliance as a standing function that requires ongoing monitoring, not a one-time review against a law's original passage.
Where this leaves the broader state-by-state pattern
Colorado's rewrite doesn't slow the broader trend of state-level AI lawmaking. If anything, it demonstrates states are willing to substantially revise their approach based on real implementation feedback rather than either abandoning regulation or forcing through an unworkable original version. For companies, that means the compliance target in any given state may keep moving for longer than a single bill-signing announcement suggests.