Colorado Just Gutted Its Own AI Law. A Lesson for Canada

Two years ago Colorado passed the first comprehensive AI law in the United States, and every other state legislature treated it as the template. On May 14, 2026, the governor signed a bill that repealed it and rebuilt something much smaller in its place.

What SB 26-189 Actually Changed

SB 26-189 repeals and reenacts SB 24-205, the 2024 statute that first defined Colorado's approach to high-risk AI. The new version drops the three obligations that gave the original its teeth: mandatory risk management programs, impact assessments, and the duty of reasonable care to prevent algorithmic discrimination, which the original framed as a primary source of liability.

The operative requirements now apply to consequential decisions made on or after January 1, 2027; specified rulemaking and implementation provisions took effect on passage. Under the signed act, sections 6-1-1706 and 5, the 60-day cure process before 2030 applies where the attorney general considers cure possible. Knowing or repeated violations need not receive a cure period.

What remains targets covered automated decision-making technology that materially influences consequential decisions, not every use of AI. Developers supply documentation; deployers provide notice and, after adverse outcomes, explanations within 30 days. The act retains records duties and qualified correction and human-review rights. Developer/deployer definitions require doing business in Colorado, and exclusions matter. It does not erase existing discrimination law (signed act, sections 6-1-1701 to 1707).

The Most-Watched US State AI Law Just Deflated

The substance of the change matters less than the signal it sends. Colorado was the proof of concept that a US state could regulate AI systems comprehensively, and roughly a dozen states drafted bills that borrowed its structure. When the originator repeals its own core obligations before they ever take effect, the template loses its authority.

This is the second time in eighteen months a flagship AI statute has hollowed out before enforcement. Canada watched Bill C-27 and its Artificial Intelligence and Data Act die on the order paper when Parliament was prorogued in early 2025, and the bill has not come back. The pattern is consistent: ambitious AI legislation gets drafted, draws heavy industry pushback, and either dies or gets stripped down before anyone has to comply.

Canada Is in the Same Waiting Room

Canada had not enacted AIDA as a general federal private-sector AI statute. That does not leave AI outside federal law: privacy, competition, human-rights, sectoral, and professional rules can apply. Quebec's private-sector privacy statute also contains specific automated-decision and profiling provisions, with their own triggers. The federal transparency consultation describes existing laws and later proposals; their scope and legislative stage must be checked separately.

A small firm's buying cycle will therefore overlap with legal change. It should identify the rules applicable to the actual use case and require the vendor to support updates. The absence of a general AI statute does not suspend existing duties.

Why This Is a Software Problem, Not a Legislative One

The temptation, watching all this churn, is to wait: do not adopt AI tooling until the law settles. That is a mistake, because the law is not going to settle on a schedule that matches a firm's buying cycle, and the privacy obligations that actually bite already exist.

The better move is to buy adaptable controls: client-data isolation, useful audit records, documented processing locations, and contracts the firm can assess. Canadian hosting can be a preference, but it does not establish Law 25 compliance. In Quebec, a transfer outside Quebec can require an assessment and written agreement even if the destination is another Canadian province (private-sector Act, section 17). No vendor can guarantee compliance with legislation whose final requirements are unknown.

Building the Compliance In Instead of Waiting for It

This is the design principle behind Supacorp, entity management software for Canadian solo and small firms handling incorporations, annual returns, minute books, and client intake across federal, Ontario, BC, Alberta, and Quebec rules. The compliance posture is structural: multi-tenant data isolation through Postgres row-level security, Canadian data residency, and audit trails on the corporate record by default.

These controls are useful starting points. A firm still needs to test them against its duties, map each processing path, and update the workflow when an applicable rule changes. Strong defaults can reduce future rework; they cannot promise that no redesign will ever be necessary.

What to Watch

Two things. First, whether any US state holds the line on a duty-of-care model now that Colorado has retreated, or whether the whole first wave collapses into disclosure regimes. Second, whether Ottawa reintroduces anything resembling AIDA before the next election, or leaves the field to the provinces and the privacy commissioners. For a small firm, neither answer changes the right move today, which is to buy software whose controls can be demonstrated and updated as the applicable rules develop.