By Aashis Luitel

On Jan. 1, organizations using covered automated systems must begin complying with Senate Bill 26-189, Colorado’s new Automated Decision-Making Technology Act. They can identify those systems and start building the processes the statute clearly requires. What they cannot do is confidently finalize two key pieces: the disclosures consumers must receive after an adverse decision and the process for meaningful human review. The attorney general has until that same day to adopt the rules. Colorado has five months to finish them. Businesses will have only whatever time remains.

The state has spent two years getting here. It passed an ambitious first law in 2024, postponed its requirements, tried unsuccessfully to amend it and finally convened a working group to negotiate a compromise. By the date the original law would have taken effect, a federal court had already frozen enforcement and lawmakers already replaced the statute. The replacement, a narrower version, passed the Senate 34-1 and the House 57-6 and Gov. Jared Polis signed it on May 14.

Start with what the new law promises, because underneath the jargon, it is simple. Computer programs now help decide who gets a job interview, a loan, an apartment, insurance coverage or a government benefit. Starting in January, when one of those programs materially influences a decision about you, you generally have the right to know it was used. If the decision goes against you, you must receive, within 30 days, a plain-language description of the decision and the program’s role. You can request the personal data it used, correct information that is factually incorrect or materially inaccurate, and request meaningful human review and reconsideration to the extent commercially reasonable.

Those are sensible protections, and more modest ones than the 2024 law attempted. The original required companies to guard against algorithmic discrimination through risk-management programs and impact assessments, requirements that business groups argued were burdensome and unworkable. The rewrite dropped most of that and kept the rights a regular person can actually use: notice, access to personal data, correction and reconsideration. Whatever you think of the trade, near-unanimous votes in both chambers tell you this is the version Colorado’s lawmakers could live with.

Those final details still depend on the attorney general’s rules. The office closed its early public comment window on July 13. The formal process comes next: proposed rules, written comments and at least one public hearing. The deadline for finishing is Jan. 1, the very same day businesses must comply and consumers get their new rights.

I build compliance programs against deadlines like this for a living, and here is what that schedule means on the ground. Imagine telling every contractor in the state that a new building code takes effect in January, only to deliver the final code book in December. Responsible contractors will not sit idle; they can survey their projects and start the work the law itself makes clear. Businesses can inventory their automated systems now to determine which decisions are covered. But they can only begin. They cannot know whether their notices and review process meet the final requirements until the rules arrive. Late rules do not excuse anyone from preparing. They do make it much harder to do it right.

Then there is the lawsuit. xAI sued Colorado in April over the original law, and the U.S. Justice Department joined the case on xAI’s side. The court, acting on the parties’ agreement, barred the attorney general from investigating or enforcing alleged violations of the original law or its replacement that occur on or before 14 days after the court rules on xAI’s forthcoming request to block the law. xAI must file that request within 28 days after the final rules are adopted. If the rules arrive late in the year, the enforcement freeze could extend well beyond Jan. 1.

Now add the fact that makes this bite. The new law creates no private right of action. Enforcement of its requirements belongs entirely to the attorney general, the same office the court order currently restrains. Before Jan. 1, 2030, the law generally requires the attorney general to give a business 60 days to cure a violation when a cure is possible, except for knowing or repeated violations. That may protect a company from immediate penalties. It does nothing for a consumer trying to exercise a right while statewide enforcement is frozen.

So, picture New Year’s Day. The law is in effect. The instructions may have arrived only weeks earlier. The only office that can enforce it is currently under a court-ordered pause with no end date on the calendar. Coloradans will hold new rights on paper without a settled way to make companies honor them.

None of this means the law was a mistake. It means the next five months will decide whether two years of negotiating produced a working consumer protection or another promise waiting for implementation. The attorney general’s office should publish dates for the proposed rules, the hearing and final adoption, along with model notices, examples of genuine human review, and a plain list separating what businesses can build today from what depends on the final rules. If the rules are issued late, the office should explain how it will apply the 60-day cure provision while preserving consumers’ rights beginning Jan. 1. And if the court ultimately blocks a provision, lawmakers should fix that provision rather than reopen the entire law.

Laws like this get graded twice. The first test is whether elected officials can agree on the words. Colorado passed that test overwhelmingly in May. The second comes when someone is denied an apartment, a job or a loan after an automated system helps drive the decision. Can that person find out what happened, correct bad data and get a genuine human review? Can the state act if a company refuses?

That test begins Jan. 1. Colorado has five months left to make sure the rights it promised will work when someone needs them.

Aashis Luitel, of Aurora, is a cybersecurity and AI governance practitioner and educator who holds a doctorate of engineering from George Washington University and a master’s of public administration from Harvard’s Kennedy School. He teaches AI governance at the graduate level, and is a U.S. Navy veteran. The views expressed are the author’s own and do not represent his employer or the universities where he teaches.