Colorado Working Group Agree on Fix for Controversial Colorado AI Act

On March 17, 2026, Colorado Governor Jared Polis announced that a working group he assembled of industry and civil rights and privacy experts had reached a unanimous consensus on a plan to rework the controversial Colorado AI Act. The working group, assembled behind closed doors by Gov. Polis last October, worked out of the public eye on areas of disagreement that lingered after the special legislation session he called last August failed to reach agreement on fixes to the embattled Colorado AI Act.

The working group’s solution is a framework that should allow for regulation of AI to protect consumers in the state while not crushing innovation and has the support that the various proposed bills and fixes for the AI Act that have been proposed over time failed to garner.

The new framework still focuses on developers and deployers of AI technology—terminology used in the AI Act referring to entities who develop AI technology and those entities who take the AI technology and actually deploy it in their businesses. Regulations would again focus on the use of AI technology in connection with “consequential decisions.” Consequential decisions would encompass decisions that involve:

• • Educational enrollment or an educational opportunity;
  • Employment or an employment opportunity;
  • The lease or purchase of residential real estate;
  • A financial or lending decision;
  • Insurance decisions involving underwriting, pricing, coverage, or claims adjudication;
  • Provision of healthcare services; or
  • Eligibility and renewal determinations involving essential government services and public benefits.

Under the new framework, where AI technology would be used in connection with consequential decisions (or where it could reasonable be expected to make consequential decisions), AI developers would be required to notify AI deployers of how the AI technology works in connection with those decisions. The AI developers would also need to provide notice of any known risks and circumstances in which the AI technology should not be used.

Further disclosures would be required where AI is used to make an adverse decision. So, for example, where an apartment complex uses AI to screen applicants and rejects an application, that apartment complex would be required to provide a description of the consequential decision and the role the AI technology played in the decision within thirty days. The AI deployer would also have to provide a simple process by which impacted individuals could learn about the types of personal data that were used in making the decision as well as information on how those impacted individuals can request a human-led review or reconsideration.

The framework would also require rules to be adopted by the Colorado AG’s Office by Dec. 31, 2026 which would include rules for making the disclosures necessary after an adverse decision, human-led reconsiderations, and allowing consumers to correct materially inaccurate personal data.

Enforcement would be handled exclusively by the AG’s Office and would allow for civil penalties and injunctions for violations. No private right of action would be allowed. The framework also contemplates a 90-day cure period for deployers and developers to cure any alleged violation without incurring penalties. To address concerns from the special legislative session of last year about developer liability, the framework also allocates fault among developers and deployers based on their relative fault for the violation of the law. It would also allow developers to avoid fault where deployers use AI technology in ways that were not intended, marketed, or contracted for with the developer.

It is expected that the framework will be adopted and the CO AI Act officially amended in accordance with the framework during the currently ongoing Colorado legislative session—though changes are always possible through the legislative process. And, while much remains to be seen in the specifics of the rules to be promulgated by the CO AG’s Office, the new scaled-back framework for the CO AI Act should address many of the concerns about the onerous impact of the prior Act which has plagued that legislation since it was signed into law in 2024.

This publication is intended for general informational purposes only and does not constitute legal advice or a solicitation to provide legal services. The information in this publication is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this information without seeking professional legal counsel. The views and opinions expressed herein represent those of the individual author only and are not necessarily the views of Clark Hill PLC. Although we attempt to ensure that postings on our website are complete, accurate, and up to date, we assume no responsibility for their completeness, accuracy, or timeliness.