Colorado Just Killed Its AI Law. On Day One.

2026-06-30 — marketing implementation consulting

You wake up on June 30 with a client presentation scheduled around a law that no longer exists. Colorado's AI Act — the one you mapped, audited, and built implementation plans for — got replaced by something else entirely, and nobody warned you it was coming.

Well. That's not quite right. Governor Jared Polis signed the replacement law back in May. But most of us missed it, or assumed it was one of those legislative tweaks that doesn't actually change anything. It does.

Here's what happened: SB 24-205 was supposed to go live on June 30, 2026. It was built around "high-risk AI systems" — basically anything in marketing automation that made real decisions about real people. Mandatory risk assessments. Documentation of your safeguards against algorithmic bias. A vague but expensive standard called "reasonable care." The whole architecture.

On May 14, Colorado signed SB 189 into law. It repeals the original one completely.

The new law doesn't kick in until January 2027, which sounds like breathing room. It's not. The frameworks are completely different. The compliance roadmap you built in the last 12 months doesn't transfer. It doesn't translate. You have to build a new one.

What Changed, Actually

SB 24-205 was about risk management. You classified your AI systems by how much damage they could do. You ran impact assessments. You documented how you'd prevent discrimination. It was preventive — you had to prove you weren't going to hurt anyone before you deployed anything.

SB 189 is about transparency. Developers and deployers have to disclose how the system works and keep documentation that regulators or customers can look at. No risk classification. No "reasonable care" standard to interpret. No mandatory assessment cycle. Just: tell people what it does, show your work, keep the receipts.

That's narrower.

For marketing technology specifically, this matters. Personalization engines, email segmentation, programmatic ad platforms — all of these lived in an uncomfortable gray zone under the original law. They sat there looking suspicious because they made decisions at scale. Under SB 189, the lines tighten. The technology you were nervous about is actually cleaner to operate now.

But here's the friction: the compliance work is already done. You've run audits. You've reviewed vendor contracts. You've drafted policies. You've built vendor questionnaires. All of it was designed for a risk-management framework that got repealed on its launch day.

Now you have six months to operationalize a completely different regulatory model against the same technology stack.

What Six Months Actually Means

If you move immediately, six months is workable. You sit down with the text of SB 189 — not the analysis, the actual bill text — and you figure out what disclosure and documentation your clients actually need to produce. You talk to their technology vendors about what the vendors need to report. You map the difference between "this system makes decisions" and "this system makes high-risk decisions," which was the old dividing line.

If you spend July and August watching guidance develop and waiting for someone else to figure it out first, you're behind. The Colorado Attorney General will eventually put out guidance, probably. Maybe an industry group drafts templates. Those things help, but they're not urgent. The law is.

What's frustrating is that nobody has to change the underlying technology here. The tools work the same way they did on June 29 and June 30. The risk hasn't changed. What changed is what the government requires you to say about the risk, and how.

Actually, that's backwards. The original law was probably overcautious. It painted a lot of marketing technology as higher-risk than it actually is. SB 189 is probably more realistic about what kinds of algorithmic decisions really need regulatory attention and which ones don't.

The real lesson — and I know this sounds cynical — is that Colorado spent two years building political consensus around a framework that lasted zero days in the field. No enforcement actions. No case law. No real test. They just replaced it because vendors pushed back and lawmakers decided the original version was too broad.

For consultants advising clients on state AI compliance, that pattern is worth holding onto.

The compliance infrastructure you build around SB 189 will be more durable than what came before, more or less, because it's narrower and there's less room for future overreach. But that durability means starting with the law that actually exists on January 1, not the one that got killed before it could take a single breath.