Colorado just took a sharp turn on AI regulation—and it could reshape the national conversation.

On March 17, 2026, the Colorado AI Policy Work Group, with Governor Jared Polis’s strong backing, proposed a completely new legal framework to replace the Colorado AI Act. The original law, passed in 2024, was the most comprehensive AI legislation in the United States—closer in spirit to the EU AI Act than anything else passed by a state. It required AI developers to conduct impact assessments, implement risk management policies, and report algorithmic discrimination to the state.

The new proposal? Radically simpler.

What changed

The new framework, called the “Concerning the Use of Automated Decision Making Technology in Consequential Decisions” (Proposed ADMT Framework), shifts the focus from AI-specific governance to transparency and consumer rights—the kind of requirements you’d see in a standard data privacy law.

Instead of demanding risk management policies and AI impact assessments, it now asks for:

  • Technical documentation from developers about what their AI does
  • Transparency notices to consumers when AI is used in consequential decisions
  • Adverse outcome notices within 30 days if an AI-made decision negatively affects someone
  • Record-keeping for three years

There’s also a higher bar for what even qualifies as “covered” AI. The original law used a “substantial factor” standard—meaning any AI that could influence a high-risk decision was in scope. The new framework uses “materially influence,” requiring that the AI’s output actually affect the outcome of the decision.

Why this matters

Colorado was the boldest state on AI regulation. Now it’s pulling back. The message seems to be: we still need rules, but let’s not strangle innovation with bureaucracy.

If this passes (it’s set to take effect January 1, 2027), it could become a template for other states. Rather than importing the EU AI Act’s heavy-handed approach, states might opt for lighter-touch frameworks that focus on disclosure and due process rather than preemptive risk management.

The EU watched. Now the US might watch Colorado.