Two sets of state rules on automated decisions start on January 1, 2027: Colorado's replacement AI law, SB 26-189, and California's regulations on automated decision-making technology under the CCPA. Neither is aimed at ordinary back-office automation. Both are aimed at decisions about people, and both come down to the same question: can a person with real authority review what the system decided? The federal push against state AI laws has not moved either date.
This is a summary for operators, not legal advice. Check the detail with your counsel.
Colorado replaced its AI Act before it took effect
On May 14, 2026, Governor Polis signed SB 26-189, which repeals and replaces the original Colorado AI Act (SB 24-205). The new law is narrower. It covers automated decision-making technology that materially influences consequential decisions about consumers in education, employment, financial or lending services, insurance, healthcare and essential government services.
If you deploy that kind of technology, you must:
- Give a clear pre-use notice
- Within 30 days of an adverse outcome, explain the decision and the system's role, and tell the person how to ask for more information
- Correct personal data that is factually wrong
- Offer meaningful human review and reconsideration, to the extent commercially reasonable, by someone with authority to override the decision
- Keep compliance records for at least three years
The impact assessments and risk management program in the original law are gone. Tools that only summarize or organize information for a person to review are excluded, as are routine infrastructure and productivity tools, and uses such as fraud prevention and cybersecurity.
The Attorney General enforces it, with no private right of action. Until January 1, 2030, the AG must give notice and a 60-day chance to cure before suing, unless the violation is knowing or repeated.
One caveat: xAI is challenging the law in federal court. The AG agreed not to start enforcement until 14 days after the court rules on xAI's request for a preliminary injunction. If that request is granted, the start date could slip.
California's automated decision rules start the same day
California's new CCPA regulations on automated decision-making technology, risk assessments and cybersecurity audits were approved on September 22, 2025 and took effect on January 1, 2026. The deadlines are staggered:
| Requirement | Deadline |
|---|---|
| Automated decision-making technology used for significant decisions | Comply from January 1, 2027 |
| Risk assessments | Required from January 1, 2026; attestation and summary due April 1, 2028 |
| Cybersecurity audit certification | April 1, 2028, 2029 or 2030, depending on revenue |
Significant decisions are ones about things like lending, housing, education, employment and healthcare. Businesses using automated decision-making technology for them need pre-use notices, and in most cases a way for people to opt out or appeal to a person, plus access to information about how the technology was used.
California also signed two employment laws on September 30, 2026. SB 947, the No Robo Bosses Act, stops employers relying solely on automated decision systems for discipline or termination from July 1, 2027, and requires a person to verify the outcome. SB 951 requires layoff notices under Cal/WARN to say when AI caused the layoffs.
Texas and Illinois are already in force
Texas's Responsible AI Governance Act took effect on January 1, 2026. For private businesses it is mostly about intent: you cannot develop or deploy AI with the intent to unlawfully discriminate, and disparate impact alone is not enough to show that. Disclosure duties fall on government agencies and healthcare providers. The Attorney General enforces it with a 60-day cure period, penalties run from $10,000 to $200,000 per violation, and substantial compliance with the NIST AI Risk Management Framework or a similar recognized standard is a safe harbor.
Illinois's amendment to its Human Rights Act on AI in employment decisions also took effect on January 1, 2026.
What federal preemption has and has not done
Executive Order 14365, signed on December 11, 2025, set up a Justice Department task force to challenge state AI laws, asked Commerce to list "onerous" ones, and asked the FTC for a policy statement. In July 2026 the FTC proposed one, naming Colorado's law as its main example of a state law that might be preempted. It was a proposal, open for comment until July 31.
None of this invalidates a state law. The order says so itself, and Congress has not passed a preemption statute. Plan to comply.
What this means for back-office automation
Most back-office work is not a consequential decision about a person. Entering an order, matching an invoice or reconciling a statement is not covered. These laws protect individuals, so credit decisions about business customers generally fall outside them, while decisions about individual consumers, employees and job applicants do not.
Where your automation does touch people, the requirements line up:
- Know where it happens. List every place an automated system influences a decision about a consumer, employee or applicant.
- Put a real person on review. Someone with authority to overturn the result, not someone who signs off whatever the system says.
- Be able to explain it. A plain explanation of an adverse decision, producible within 30 days.
- Keep the record. Inputs, outputs, model versions and who reviewed what, for at least three years.
This is how we run the service anyway. Low-confidence work goes to our exception desk, decisions that need judgement go to your team, and every outcome is recorded in the Evidence File.
If you also operate in Canada
Canada has no federal AI law. The Artificial Intelligence and Data Act died in January 2025, and Bill C-36, which would replace the federal private-sector privacy law, has not moved since its first reading on June 15, 2026. Three rules already apply:
- Quebec's Law 25 requires you to tell a person when a decision about them was made exclusively by automated processing and, on request, explain the main factors and let them put their case to a staff member who can review it.
- Ontario has required employers with more than 25 employees to disclose AI screening in public job postings since January 1, 2026.
- OSFI Guideline E-23 applies to federally regulated banks and insurers from May 1, 2027. It covers AI and vendor models, so suppliers to those institutions should expect requests for model documentation.