Colorado has three AI statutes that touch healthcare, arriving between August 2026 and January 2027 — and the one that gets the headlines is not the one most practices need to watch. Here is how they fit together.
Facts on this page were verified against primary and secondary sources between July 7 and July 17, 2026, and are reviewed on a recurring weekly schedule.
The much-discussed 2024 Colorado AI Act was repealed and reenacted before it ever took effect. If your compliance reading dates from 2024–2025, it likely describes obligations that no longer exist in that form. The current framework is SB 26-189, below.
Signed May 14, 2026, SB 26-189 reenacts the Colorado AI Act as an automated-decision-technology (ADMT) disclosure-and-rights framework. Core duties: notify people when they are interacting with AI; disclose an adverse ADMT outcome within 30 days; correct inaccurate personal data; and provide meaningful human review.
The healthcare carve-out — with limits. SB 26-189 largely exempts HIPAA-covered clinical AI use for providers operating from a Colorado location. The exemption has limits: it does not cover employment-related AI decisions, and exempt entities still owe general AI-use notices and financial-assistance disclosures. For most general clinical practices, this law is a monitor-not-trigger item — the substantive healthcare obligations live in the two bills below.
Regulated mental-health professionals may not let AI conduct therapeutic communication with clients or generate treatment plans without their real-time involvement and review. Marketing an AI system as equivalent to licensed psychotherapy is a Colorado Consumer Protection Act violation. For behavioral-health practices — including out-of-state practices doing telehealth with clients located in Colorado — this is the directly applicable law, and it arrives first.
AI and algorithms may not be the sole basis for coverage denials or delays — a licensed professional must review adverse determinations. This law regulates health plans and utilization review rather than clinical practices, but it matters to providers on the receiving end of AI-assisted denials: it gives you a basis to insist a licensed reviewer signed the denial.
From a governance standpoint — not legal advice:
Our free 7-question risk assessment shows where a practice stands on these dimensions, and the behavioral-health module covers the psychotherapy-specific rules.