Colorado Replaces AI Act Before It Takes Effect — ADMT Act (SB 26-189) Effective January 1, 2027; Drops Duty of Care, Impact Assessments, and NIST/ISO Safe Harbor

Colorado Governor Jared Polis signed SB 26-189 on May 14, 2026, repealing and replacing the state's pioneering Colorado Artificial Intelligence Act (SB 24-205) — the first comprehensive state AI law in the US — before it ever applied. The original CAIA, which was set to take effect June 30, 2026, had been simultaneously in force, unenforced (paused by a federal court order on April 27, 2026), and scheduled for replacement. The replacement law — the Automated Decision-Making Technology Act (ADMTA) — takes effect January 1, 2027 and narrows the regulatory scope significantly: it eliminates the original law's duty-of-care standard, mandatory annual algorithmic impact assessments, and the affirmative defense (rebuttable presumption of reasonable care) for organizations aligned with the NIST AI Risk Management Framework or ISO/IEC 42001 — the single largest driver of voluntary US AI governance framework adoption. What remains: notice requirements before deploying covered automated decision-making technology (ADMT) that processes personal data to make consequential decisions affecting employment, housing, credit, education, or healthcare; an adverse-outcome process with correction rights and meaningful human review; and three-year record retention; enforced by the state attorney general (no private right of action); 60-day right to cure (sunset after three years). For law firms advising clients on US AI compliance, the Colorado repeal is the most important state-law AI event of 2026: it signals that the US state law trajectory is moving away from a comprehensive high-risk-AI framework and toward narrow disclosure and operational requirements — and it eliminates the clear commercial incentive for NIST AI RMF or ISO 42001 adoption that the original CAIA provided.