Colorado's AI Law Takes Effect Today, Already Gutted

Colorado's Consumer Protections for Artificial Intelligence Act - Senate Bill 24-205, passed in 2024 and once hailed as the first complete AI consumer protection law in the United States - technically becomes enforceable today. There is nothing to enforce.

In the 14 months between passage and this effective date, Elon Musk's xAI filed a federal lawsuit to block it, the Justice Department intervened on xAI's side, a federal court suspended enforcement, and Governor Jared Polis signed a replacement bill that strips out most of what made SB 24-205 significant. Today is a deadline that the law never survived to meet.

TL;DR

Colorado SB 24-205 - first complete US state AI law - takes effect June 30, but enforcement has been suspended by court order since April 27
xAI filed a federal lawsuit on April 9 alleging First Amendment violations; the Justice Department intervened on April 24 in the first-ever federal challenge to a state AI law
Governor Polis signed replacement bill SB 189 on May 14, removing the duty of care for algorithmic discrimination, mandatory risk assessments, and impact assessment requirements
SB 189 takes effect January 1, 2027, leaving SB 24-205 as dead letter for six months
Labor and civil society groups say the replacement trades consumer protection for corporate disclosure theater

How Industry Dismantled a Landmark Law in 14 Months

April 9: xAI Files Its Challenge

The lawsuit arrived early. On April 9, 2026, xAI - the company behind Grok - filed a complaint in the U.S. District Court for the District of Colorado, naming Colorado Attorney General Philip Weiser as the defendant. The complaint alleged that SB 24-205 violated the First Amendment, the Commerce Clause, the Equal Protection Clause, and was unconstitutionally vague.

The First Amendment argument was the most aggressive. xAI argued that compliance with SB 24-205's algorithmic discrimination provisions would require the company to "redesign, retrain, or constrain the Grok model" - including recalibrating how the model weights training data and adding hard-coded guardrails. Compelling those changes, xAI said, amounted to forced speech.

April 24: The Federal Government Picks a Side

Fifteen days after xAI filed, the Department of Justice moved to intervene in support of xAI's position. It was the first time the federal government had intervened in a lawsuit challenging a state AI law. The DOJ argued that SB 24-205's algorithmic discrimination provisions violated the Equal Protection Clause by requiring companies to prevent different impact based on protected characteristics while simultaneously exempting actions taken to promote diversity.

The intervention was not incidental. President Trump's December 2025 executive order had directed the DOJ to actively oppose state AI laws. Colorado was the first practical test. The message to other state legislatures was clear.

April 27: The Court Suspends Enforcement

Three days after the DOJ intervened, xAI and Attorney General Weiser filed a joint motion to suspend enforcement while the legislature addressed the law. The court granted it the same day. As of April 27, 2026, SB 24-205 had no enforcement mechanism, though its text remained on the books.

May 14: A Gutted Replacement

Governor Polis had already signaled his direction. After convening an AI Policy Working Group in late 2025, his office produced a framework in March 2026 that shifted focus from risk management to transparency and disclosure. A bill followed quickly. Colorado's legislature passed SB 189 on May 12. Polis signed it on May 14.

The new law takes effect January 1, 2027.

Colorado State Capitol building in Denver The Colorado State Capitol in Denver, where SB 24-205 was passed in 2024 and replaced two years later by a narrower disclosure law. Source: commons.wikimedia.org

What Each Law Actually Requires

SB 24-205 built a risk-based framework. Developers of high-risk AI systems faced obligations around bias testing, disclosure to deployers, and reporting discrimination incidents to the attorney general. Deployers - companies that used AI to make decisions about employment, loans, insurance, housing, healthcare, or education - had to adopt written risk management policies, complete impact assessments before deployment, give consumers notice, and maintain processes for appeal and human review.

SB 189 replaces all of that with a disclosure-based framework.

Requirement	SB 24-205	SB 189
Duty of care to prevent algorithmic discrimination	Yes	No
Mandatory risk management program	Yes	No
Annual impact assessments	Yes	No
Reporting discrimination incidents to AG	Yes	No
Pre-use disclosure notice to consumers	Yes	Yes
Post-adverse-decision explanation (30 days)	No	Yes
Consumer right to data correction	Partial	Yes
Consumer right to human review	Yes	Yes (where "commercially reasonable")
Private right of action	Possible	No - AG only
Cure period before enforcement	None stated	60 days

The shift is from affirmative obligation to reactive notice. Under SB 24-205, companies had to show that their AI systems were governed before using them to make consequential decisions. Under SB 189, companies send consumers a notice before the decision and an explanation afterward.

The phrase "commercially reasonable" in the human review provision is worth noting. It doesn't define a floor.

A hiring manager using software with an algorithmic decision display Algorithmic hiring and credit tools are among the automated decision systems affected by both versions of Colorado's AI law. Source: pexels.com

"Asking Their Permission"

Labor groups didn't hide their view of the result. Robert Lindgren of the Colorado AFL-CIO said during the legislative proceedings that the revised bill represented a fundamental shift in who holds accountability.

"We are talking about corporations with more wealth than most nations on Earth, and we're here to ask their permission to hold them accountable to outcomes that upend people's lives."

Lindgren was direct about what disappeared: "Gone are the risk management requirements, impact assessments, annual reviews and discrimination reporting."

Civil-society advocates made similar arguments. The original SB 24-205 framework forced companies to document their AI governance posture and accept that the attorney general could inspect it. The replacement doesn't.

Polis, for his part, was candid. He didn't want to sign a bill the tech industry opposed. He also faced federal pressure: Trump had threatened to withhold funds from states that enforced the kind of algorithmic discrimination provisions SB 24-205 contained. The working group process was structured to produce a compromise the industry would accept - and it did.

A Pattern Worth Watching

Colorado didn't reach this outcome in isolation. The White House has made preempting state AI laws a stated legislative priority. A bipartisan federal bill - the Great American Artificial Intelligence Act - would freeze all state AI regulations for three years if passed. New York's RAISE Act and Connecticut's SB 5 are now navigating their own legislative gauntlets against the same pressures.

Every state law that reaches the enforcement stage invites this response. A lawsuit alleging First Amendment harm, federal intervention citing the same executive order, a working group process that includes the same industry stakeholders who oppose the law, and a replacement that the industry accepts. The pattern repeated quickly in Colorado. It will repeat elsewhere.

Today, June 30, is technically the effective date of SB 24-205. Enforcement has been suspended for two months. A replacement is waiting in January. The law that was supposed to take effect today will never be enforced.

Sources: