Colorado's AI Act: What It Means for Insurance Agents

Probably not, if your AI caller’s only job is qualifying a lead, checking a calendar, and booking a licensed agent’s time. Colorado’s new AI law, Senate Bill 26-189, signed by Governor Jared Polis on May 14, 2026, regulates automated systems that make or substantially help make a “consequential decision” about a consumer, and insurance is one of the domains it names. But a consequential decision is specifically about a person’s access to, eligibility for, or cost of coverage, not about whether a call gets scheduled. The law takes effect January 1, 2027. Whether it reaches your calling program at all depends entirely on what the AI is actually deciding, and that’s a narrower question than most of the headlines about it suggest.

What Colorado Just Did to Its Own AI Law

Colorado has now written three different versions of this law inside three years, and none of the first two ever actually governed a single call. Understanding why matters, because it tells you how much the ground under this topic is still moving.

Governor Polis signed the original bill, SB 24-205, on May 17, 2024, making Colorado the first state in the country to pass comprehensive legislation regulating high-risk AI systems. It was built around a broad duty of care for both developers and deployers of those systems, with mandatory impact assessments and a wide set of covered domains. Its effective date was set for February 1, 2026. Polis signed it with public reservations, saying in his signing statement that he worried the law was too broad and could slow innovation in the state, a tension that shaped everything that followed.

That tension turned into an actual delay. Facing pushback from tech and business groups ahead of the February 2026 start date, the legislature called a special session and passed SB25B-004, which Polis signed on August 28, 2025, pushing the effective date five months out to June 30, 2026. Lawmakers used the extra runway to keep negotiating a full rewrite rather than a patch.

That rewrite is SB 26-189. Polis signed it May 14, 2026, weeks before the delayed June 30 date would have triggered the original, broader law. SB 26-189 doesn’t amend SB 24-205; it repeals it outright and replaces it with a narrower framework built around “automated decision-making technology,” or ADMT, dropping the original law’s mandatory duty of care and impact assessment requirements for most deployers in favor of a notice-and-disclosure model. The new law’s primary compliance requirements take effect January 1, 2027.

The practical result: no version of Colorado’s AI law has ever actually been enforced against anyone. The original law was replaced before its delayed start date arrived. Every article you’ll find online describing “Colorado’s AI Act” written before May 2026 is describing a law that no longer exists in that form. That’s worth saying plainly, because a lot of what circulates about this topic, including search results an AI assistant might hand you, is now out of date by design.

What Counts as “Covered ADMT” and a “Consequential Decision”

The entire question of whether this law touches your agency comes down to two defined terms, and neither one is obvious from the name of the law.

Insurance is named explicitly as a covered domain. That’s the fact that will show up in every headline about this law and insurance agents in the same sentence, and it’s also the fact that, read alone, overstates what the law actually reaches. The definition isn’t “any AI system an insurance business uses.” It’s an AI system that makes or substantially factors into a decision about that specific consumer’s access to, eligibility for, or cost of insurance. A system that schedules a call is not deciding any of those three things. A system that decides who gets quoted and at what price is squarely inside them.

Does Your Lead-Qualification AI Caller Actually Count?

Here’s the honest answer, not the scary one. For the way most independent agencies actually use an AI caller, the answer is no, because the AI isn’t the thing deciding insurance eligibility, coverage, or price. It’s deciding whether to transfer the call, whether a time slot is open, and what question to ask next in a qualification script. Those are scheduling and routing functions. The carrier’s underwriting system, and the licensed agent who actually quotes and binds the policy, remain the ones making the consequential decision the law is written to govern.

That line moves the moment you configure the AI to do more than route and schedule. If you let it screen leads out before a human ever sees them, based on anything that functions like an eligibility filter, you’ve built a system that’s substantially factoring into access to insurance, which is exactly the fact pattern SB 26-189 targets. The same is true if an AI system is ever involved in setting or adjusting a quoted price, or in deciding who gets contacted about a product based on characteristics that look like a proxy for a protected class. None of that is typical for a lead-qualification and warm-transfer tool, but it’s a real configuration choice some agencies could make without thinking of it as “automated decision-making,” and it’s worth checking your own setup against that specific line rather than assuming the category is automatically safe because most uses of it are.

What’s Already Regulated Separately

SB 26-189 isn’t the only rule touching AI and insurance in Colorado, and it’s worth knowing it sits in a different lane from the state’s insurer-specific algorithm rules. The Colorado Division of Insurance, not the Attorney General, has separately built governance and testing requirements aimed specifically at carriers’ use of external consumer data and predictive models in underwriting, under different statutory authority than SB 26-189. That track is about a carrier’s pricing and underwriting algorithms, enforced by the insurance regulator. SB 26-189 is a general consumer-protection statute, enforced by the Attorney General, that happens to name insurance as one of several covered domains. If you’re an independent agent or agency, not a carrier, the Division of Insurance’s algorithm rules generally aren’t the ones your lead-follow-up calling program needs to worry about; SB 26-189, and whether your use case meets its definitions, is the more relevant question, alongside the federal rules below that apply no matter what Colorado does next.

The TCPA Still Applies, Full Stop

This is the part that gets lost in every conversation about state AI laws, and it’s the compliance question that actually touches nearly every agency running an AI caller, in Colorado or anywhere else: the federal Telephone Consumer Protection Act already governs AI-generated voice calls, and has since February 2024.

The FCC’s Consumer and Governmental Affairs Bureau issued a Declaratory Ruling, docketed as CG Docket No. 23-362 and numbered FCC 24-17, adopted February 2, 2024 and released February 8, 2024. Its holding is direct: “we confirm that the TCPA’s restrictions on the use of ‘artificial or prerecorded voice’ encompass current AI technologies that generate human voices.” The ruling goes on to state that calls using such technologies “therefore require the prior express consent of the called party to initiate such calls absent an emergency purpose or exemption.” The Commission was explicit that it would not allow “any carve out of technologies that purport to provide the equivalent of a live agent.”

That means a Colorado agency can clear SB 26-189’s definitions entirely, by running an AI caller that only schedules and qualifies, and still owe prior express consent under the TCPA before that same AI-voiced call goes out. The two obligations don’t overlap in what they regulate, and passing one tells you nothing about the other. Every post on this site about AI calling repeats this same point for a reason: the TCPA doesn’t care what state you’re calling into, doesn’t care whether a state AI law applies to you, and doesn’t go away because a narrower state statute got rewritten in your favor.

If SB 26-189 Does Apply to You: The Obligations

For the agency whose use case does cross into consequential-decision territory, here’s what the bill’s text actually requires, not a vague “be careful” warning.

A deployer, the agency actually using the system, has to give consumers clear and conspicuous notice at the point of interaction that a covered ADMT is in use. If that system produces an adverse outcome for a specific consumer, the deployer then has 30 days to provide a plain-language description of the ADMT’s role in that decision. Consumers get the right to request correction of personal data the system used if it’s factually wrong, and the right to request meaningful human review and reconsideration of an adverse decision. Deployers have to keep compliance records for at least three years.

A developer, the entity that built or substantially modified the system, owes a separate set of obligations: supplying technical documentation covering intended uses, categories of training data, known limitations, and guidance for appropriate use, starting January 1, 2027, plus notifying deployers of material updates and keeping its own three-year compliance record.

Enforcement runs through the Colorado Attorney General under the Colorado Consumer Protection Act, treating a violation as a deceptive trade practice. Through January 1, 2030, the AG has to give 60 days’ notice and a chance to cure a curable violation before bringing an action. The bill does not create a new private right of action, which means the main enforcement risk here runs through the state, not through individual consumer lawsuits, a meaningfully different exposure profile than the TCPA.

Why This Matters Before 2027, Not After

None of this is a 2027 problem to revisit in a year. The agencies building their AI calling stack right now are the ones who’ll either have clean documentation already in place when the law takes effect, or be scrambling to reconstruct it under a deadline.

Independent insurance agencies are adopting AI fast enough that “wait and see” is already the minority position. The Big “I“‘s 2026 Agents Council for Technology Tech Trends Report found that among independent agencies, 33% describe themselves as “just experimenting” with AI, 22% say they’re “using AI in limited areas,” and 8% say AI is “embedded in daily workflows,” against 31% not currently using it at all. Looking forward, 68% of agencies, combining those “very likely” and “somewhat likely,” say they plan to increase their AI use in the next 12 months.

An agency that documents what its AI caller does and doesn’t decide now, while it’s building the thing, has that answer ready the day a regulator, a carrier compliance audit, or a consumer request for human review actually asks. An agency that configures the system first and asks the compliance question in December 2026 is reconstructing that documentation under a deadline, for a system that’s already been running for a year.

How to Build a Compliant AI Calling Program Now

Here’s the method, whether you build this yourself or buy it from a vendor, including us.

1. Write down, in plain language, exactly what your AI caller decides versus what a human decides. If the honest answer is “it schedules and qualifies, a licensed agent quotes and binds,” you’ve just drafted the core of your own compliance position, and it’s worth putting it in writing before you need it.
2. Never let the AI be the last stop for a lead before coverage, pricing, or eligibility gets decided. The line between “outside SB 26-189” and “inside it” is whether a human, licensed decision-maker sits between the AI’s output and anything that touches access, cost, or eligibility. Keep that human in the loop by design, not as an afterthought.
3. Capture prior express consent before any AI-voiced call goes out, separate from whatever Colorado requires. The FCC’s February 2024 ruling means this obligation exists everywhere you call, under the TCPA, regardless of what state law does or doesn’t say about automated decision-making.
4. Disclose that the caller is AI where required, and build the disclosure into the call script itself, not a buried terms page. A verbal disclosure at the start of the call satisfies both the spirit of SB 26-189’s notice requirement and the broader disclosure norms showing up across other states, which is worth reading more on in the disclosure laws roundup on this site.
5. Keep full call recordings and transcripts, retained at least three years. That’s the floor SB 26-189 sets for deployers if it applies to you, and it’s a good floor to hold yourself to regardless, since it’s also the raw material a TCPA consent dispute or a CMS marketing audit would ask for.
6. If you buy this instead of building it, ask the vendor what documentation they can hand you, not just what the system can do. A developer under SB 26-189 owes deployers documentation on intended uses, training data categories, known limitations, and usage guidance. A vendor who can’t produce anything like that when asked is a vendor who hasn’t thought about this question either.

You can build every piece of this yourself with a compliant dialer and a documented process. Plenty of agencies do, and it’s worth pricing that build against buying it before deciding either way.

How TheAffordableAI Handles This

None of this tells you whether your specific configuration counts as a covered ADMT under Colorado law; that’s a question about what you’ve built, not what any vendor sells you. If you want to hear what the disclosure and the warm transfer actually sound like before deciding anything, there’s a live demo call on the homepage. The math above uses $0.20 a minute because that’s the published Single Account rate; run it against your own numbers on the pricing page.

What You Actually Get

Reading SB 26-189 closely instead of reacting to the headline “Colorado passes new AI law” turns a vague worry into an actual checklist: know what your AI decides versus what a human decides, keep a human between the AI and anything that touches eligibility or price, document it in writing, and treat the TCPA’s consent requirement as the floor that applies no matter what Colorado’s AI law ends up covering. Most lead-follow-up and scheduling use cases clear that bar by design, not because the law is weak, but because that’s genuinely not the kind of decision a calling tool makes.

This article reflects a reading of SB 26-189’s published text at leg.colorado.gov, the FCC’s February 2024 declaratory ruling, and the sources cited throughout, as of this article’s publish date. It is general information, not legal advice for your specific agency. The law’s own Attorney General rulemaking is still developing guidance as of this writing, and that guidance could sharpen or shift exactly where the line sits. Talk to counsel before finalizing a compliance position, especially if any part of your AI calling program touches pricing, underwriting, or who gets access to a quote.

Colorado spent three years and three versions of this law trying to land on the right scope, and landed on one that reaches a lot less than “any AI an insurance business touches.” Know what your system actually decides, keep the record of it, and the law that took three tries to write becomes a short checklist instead of a reason to panic.