Colorado has three AI statutes that touch healthcare — one in force now, two arriving January 2027 — and the one that gets the headlines is not the one most practices need to watch. Here is how they fit together.
Facts on this page are maintained against primary sources, reviewed on a recurring schedule, and were last reviewed on September 9, 2026.
The much-discussed 2024 Colorado AI Act was repealed and reenacted before it ever took effect. If your compliance reading dates from 2024–2025, it likely describes obligations that no longer exist in that form. The current framework is SB 26-189, below.
Signed May 14, 2026, SB 26-189 reenacts the Colorado AI Act as an automated-decision-technology (ADMT) disclosure-and-rights framework. Core duties: notify people when they are interacting with AI; disclose an adverse ADMT outcome within 30 days; correct inaccurate personal data; and provide meaningful human review.
The healthcare carve-out — with limits. SB 26-189 largely exempts HIPAA-covered clinical AI use for providers operating from a Colorado location. The exemption has limits: it does not cover employment-related AI decisions, and exempt entities still owe general AI-use notices and financial-assistance disclosures. For most general clinical practices, this law is a monitor-not-trigger item — the substantive healthcare obligations live in the two bills below.
Regulated mental-health professionals may not let AI conduct therapeutic communication with clients or generate treatment plans without their real-time involvement and review. Marketing an AI system as equivalent to licensed psychotherapy is a Colorado Consumer Protection Act violation. For behavioral-health practices — including out-of-state practices doing telehealth with clients located in Colorado — this is the directly applicable law, and it is already in force.
AI and algorithms may not be the sole basis for coverage denials or delays — a licensed professional must review adverse determinations. This law regulates health plans and utilization review rather than clinical practices, but it matters to providers on the receiving end of AI-assisted denials: it gives you a basis to insist a licensed reviewer signed the denial.
Signed May 29, 2026. The act itself is effective August 12, 2026, but the operator requirements apply from January 1, 2027 — that later date is the one a practice actually feels. It reaches anyone operating a conversational AI service: age estimation, an AI disclosure, protection of minors from sexually explicit content and from engagement manipulation, privacy and account-management tools for minors, response protocols for users in crisis, and an annual report to the Attorney General. The provision that matters most in behavioral health is the bar on representing chatbot output as equivalent to licensed professional services.
The Attorney General is writing the rules for SB 26-189 and HB 26-1263 together. The notice was filed and the comment period opened August 11, 2026; the early-comment deadline was September 4, 2026; a revised draft circulates no later than September 23, 2026; and the comment period closes October 26, 2026 at 11:59 p.m. MST, extended through the last day of the formal hearing if that hearing runs later. The rules take effect January 1, 2027, the same day the operator duties do. The September 23 draft is the one worth reading — it shows which proposed duties survived.
From a governance standpoint — not legal advice:
Our free risk assessment shows where a practice stands on these dimensions, and the behavioral-health module covers the psychotherapy-specific rules.