Colorado's New AI Laws Take Effect in 2027 — What They Actually Mean for Your Business (Even If You're Not in Colorado)
Two rewritten Colorado laws are moving through final rulemaking this month. Here's what changed, who's covered, and what to check before January 1, 2027.
If your business uses any kind of AI — a chatbot on your website, an automated screening step for applications, a tool that flags or ranks people in some way — Colorado just gave you a preview of where AI regulation is heading. And because both laws apply to any business “doing business in Colorado,” not just companies based there, this isn't a regional story. If you sell online, serve clients remotely, or have even one customer in Colorado, it's worth five minutes.
What happened
In May 2026, Colorado significantly rewrote its original AI law through Senate Bill 26-189, trading a broad “high-risk AI system” framework for a narrower one built around automated decision-making technology, or ADMT. Alongside it, House Bill 26-1263 (referred to in coverage as the Chatbot Safety Act) set new rules specifically for conversational AI and chatbots.
Both laws take effect January 1, 2027, but the rulemaking that will spell out exactly how they're enforced is happening right now. Colorado's attorney general filed proposed implementing rules on August 11, 2026, with a revised draft expected September 23 and a public comment period running through October 26.
In other words: the shape of these laws is still being finalized, but the core obligations are locked in. This is a good moment to understand them before the details get buried under 2027 deadline pressure.
What SB 26-189 actually covers
The rewritten law narrows its focus to AI that “materially influences” a consequential decision in one of seven areas: employment, housing, credit, insurance, health care, education, and essential government services. Decisions like scheduling, customer service triage, advertising, product recommendations, and search are explicitly excluded.
So if you're using AI to help decide who gets hired, who qualifies for a payment plan, or who gets approved for a wholesale or partner application, this is squarely aimed at you. If you're using AI purely to answer customer questions or recommend products, this particular law likely isn't.
For the businesses it does cover, the obligations that survived the rewrite are:
- Give clear, upfront notice before using ADMT in a covered decision, including how someone can ask for more information.
- Within 30 days of an adverse decision, explain in plain language what role the AI played and offer a way to request human review, “to the extent commercially reasonable.”
- Correct inaccurate personal data on request.
- Keep records demonstrating compliance for three years.
Several of the original law's heavier requirements — mandatory impact assessments, risk-management programs, annual reviews, and reporting discriminatory outcomes to the attorney general — were dropped in the rewrite. This is a materially lighter law than the one Colorado originally passed, but it isn't nothing.
What HB 26-1263 covers — and why it reaches further
This is the one more small businesses will actually run into. HB 26-1263 applies to any company that develops, operates, or white-labels a conversational AI service or chatbot — including a small business that's simply added a chat widget to its website. Unlike SB 26-189, it isn't limited to high-stakes decisions.
The core requirements, per legal analyses of the bill:
- The chatbot must “persistently, repetitively, or responsively” disclose that users are talking to software, not a person.
- It can't represent itself as a licensed professional — healthcare, legal, mental health, or dietary.
- It must include age-verification measures and protections against manipulative design aimed at minors.
- It must detect and appropriately respond to signs of self-harm or suicidal ideation by directing users to crisis resources.
- Covered operators must file an annual compliance report with Colorado's Department of Law starting July 1, 2027.
Violations are treated as deceptive trade practices under Colorado's Consumer Protection Act, which carries real per-violation civil penalties — sources disagree on the exact figure, so we're not citing one here, but it's not a token fine.
Why this matters beyond Colorado
Neither law includes a small-business size or revenue exemption in the analyses available so far — the obligation is based on whether you're doing business with people in Colorado, not on your headcount. For anyone selling or operating online, that's a much lower bar than it sounds.
It's also not an isolated move. In the same window, California passed its own set of AI bills before its August 31 deadline — including one that bars employers from relying solely on automated systems for discipline or termination decisions without human review. Different states, same direction: AI used in decisions about real people is getting specific disclosure and human-review requirements, not just general “be responsible” language.
What to do next
None of this requires an overhaul by tomorrow — the effective date is over a year out, and the rules are still being finalized. But it's a reasonable prompt to take stock now, while the fix is still simple:
- List where AI actually touches a decision about a real person in your business — hiring, applications, approvals, pricing exceptions — versus where it's just answering questions or making suggestions. Those get treated very differently under these laws.
- If you use any customer-facing chatbot, check that it clearly identifies itself as AI, not a human, somewhere a user will actually see it.
- For anything closer to a real decision (not just conversation), write down — in plain language — what the tool does, and how someone could ask a human to look at the outcome. That documentation is the difference between “we have a system” and “we have a tool we bolted on.”
This is also the moment where a lot of AI use in small businesses shows its seams: tools added one at a time, with no one able to say clearly how they work or who's responsible for the outcome. If that sounds familiar, Scalable Studio System's Brand AI Audit is built to close exactly that gap — a done-for-you review of how AI is actually being used across your business, so you have clear, documented answers instead of guesswork.
This article is a business-operations explainer, not legal advice. If AI plays a role in decisions covered by these laws, talk to an attorney about your specific compliance obligations before January 1, 2027.