Colorado Governor Jared Polis signed SB 26-189 on May 14, 2026, repealing and replacing the state’s first-in-the-nation AI Act less than two years after it was originally enacted — a reversal that significantly narrows how the law applies to hospitals, insurers and other healthcare organizations using AI to make decisions about patients. The rewrite passed with overwhelming bipartisan margins, clearing the House 57-6 and the Senate 34-1, according to coverage from Holland & Knight and Crowell & Moring, a sharp contrast to the contentious, lobbyist-heavy fight that nearly killed the original law just months earlier.
How the Original Law Collapsed
Colorado’s original AI Act, SB 24-205, passed in 2024 as the first broad U.S. law targeting \”high-risk\” AI systems used in consequential decisions spanning hiring, housing, lending, education and healthcare. It was supposed to take effect in February 2025, but business groups — warning of compliance costs and threatening to relocate operations out of state — mounted what Tech Policy Press described as a lobbying blitz involving more than 150 lobbyists during an August 2025 special legislative session. That fight produced only a delay, pushing the effective date to June 30, 2026, rather than the full repeal industry groups wanted. Governor Polis then convened a Colorado AI Policy Work Group to hammer out a permanent replacement, which became SB 26-189.
What Changed for Healthcare Specifically
The original law’s broad, three-part carve-out for healthcare — exempting HIPAA-covered entities, FDA-authorized AI systems, and ONC-certified health IT outright — did not survive the rewrite in its original form, according to analysis from Ropes & Gray and DeepInspect. Instead, SB 26-189 takes a narrower approach: HIPAA-covered entities and their business associates are now generally exempt only for non-employment uses, meaning a hospital still gets covered if it uses AI to make employment decisions about its own staff or to determine financial assistance eligibility for patients. FDA-regulated medical devices and certain pharmaceutical and device R&D activities remain excluded from the law’s scope entirely. The net effect, per legal trackers, is that the law’s reach into healthcare is more surgical than the original — but also leaves fewer blanket protections for health systems to rely on.
What Else Got Stripped Out
Beyond the healthcare-specific changes, SB 26-189 eliminated several of the original law’s most burdensome provisions across all industries: the statutory duty of care to avoid \”algorithmic discrimination,\” mandatory risk-management programs, formal impact assessments, annual internal reviews, and reporting requirements to the Colorado Attorney General’s office are all gone from the new framework, according to Crowell & Moring’s analysis. What remains is a law still built around the concept of algorithmic discrimination — defined as AI-driven differential treatment based on protected characteristics including race, disability, genetic information, reproductive health status and several other categories — but enforced with a lighter administrative touch than the 2024 version envisioned.
Why Colorado Blinked, According to Both Sides
Industry advocates argue the original law’s risk-assessment and reporting mandates would have imposed compliance costs disproportionate to any demonstrated harm, particularly for smaller health systems and startups without dedicated AI governance staff, and credit the rewrite with striking a more workable balance. Consumer and civil-rights advocates see it differently: by removing the statutory duty of care and mandatory impact assessments, they argue Colorado traded away the law’s actual enforcement teeth to secure business buy-in, leaving algorithmic discrimination protections that exist on paper but lack the audit trail regulators would need to catch violations in practice. Both camps agree on one thing — the speed and lopsidedness of the final vote (57-6, 34-1) shows how thoroughly the Polis-convened work group managed to defuse the standoff that had paralyzed the legislature just months earlier.
A Pattern Beyond Colorado
Colorado’s about-face echoes broader turbulence in state AI regulation this year: the McDermott Will & Emery law firm noted that a federal court had blocked enforcement of the original Act’s predecessor provisions before the legislature acted, adding legal uncertainty to the political pressure already building against it. That combination — court challenges plus sustained industry lobbying — has become a template other states eyeing comprehensive AI legislation, including on healthcare-specific algorithmic discrimination, are now studying closely as they weigh whether to follow Colorado’s original ambitious model or its scaled-back replacement.
What’s Next
SB 26-189 takes effect January 1, 2027, giving health systems, insurers and AI vendors roughly a year to map which of their tools fall inside the narrower healthcare carve-outs versus which now face fresh exposure, particularly around employment-related AI use inside hospitals and health plans’ financial-assistance determinations. Legal advisories are already flagging that organizations which assumed blanket HIPAA-based exemption from the original law need to reassess that assumption under the new text. With Colorado’s law essentially rebuilt from the ground up in under two years, expect other states debating AI legislation to treat the state’s experience as a cautionary tale about how quickly political consensus on AI regulation can unravel — and how differently a \”final\” law can look by the time it actually takes effect.
Photo: David Solce / PEXELS via Pexels
