On 14 May 2026 the Governor of Colorado signed Senate Bill 26-189, and one provision in it changes what a Denver business is allowed to agree to when it hires an AI agency. The bill voids a contract clause that would indemnify a party for its own discriminatory acts in the use of automated decision-making technology. That clause, or something close enough to it, sits in a great many vendor agreements, and from 1 January 2027 the version of it that matters will not hold in Colorado. Anyone searching for an AI agency in Denver this quarter is shopping against a deadline that most of the sales decks have not been updated for.
The firms themselves are a thinner market than the directories suggest. This site lists 16 agencies in Denver that are not seeded placeholders, which is more than any other city here. Exactly 1 of those 16 publishes an hourly rate. It publishes $125, with the minimum equal to the maximum, which is the signature of a firm renting out capacity rather than quoting a piece of work. The other 15 publish nothing about price at all. So the supply side has given a buyer almost no way to compare on money before the first call, at the precise moment the legal exposure of getting the choice wrong has gone up.
What the May signature actually did
Colorado got there first and then changed its mind in public. The 2024 statute, Senate Bill 24-205, was the first comprehensive state AI law in the United States, and it was built on the European model: a duty of care, risk management programmes, annual impact assessments, and a classification of high-risk systems. It never took effect. It was challenged in federal court, and then it was repealed and replaced before its start date by Senate Bill 26-189, which the Colorado General Assembly publishes in full on its own site.
What replaced it is narrower and shaped differently. The duty of care is gone. The mandatory risk programmes are gone. The annual impact assessments are gone. In their place are disclosure obligations: tell a person before an automated system is used on them in a decision that matters, explain an adverse outcome when one is asked for, keep records, and give a route to human review. Enforcement sits with the Attorney General, there is no private right of action, and the penalty ceiling is $20,000 per violation. The Colorado Attorney General has been running the rulemaking that fills in the detail, and filed proposed rules in August 2026.
One caveat belongs here rather than in a footnote. Enforcement of the replacement law has been contested in federal litigation of its own, and the outcome of that is not settled. Read the bill, read the Attorney General's rulemaking, and take advice from a Colorado lawyer. What follows is about how to brief and contract an agency, not about what the statute requires of you.
Seven places the obligations reach
The replacement law attaches to automated decision-making technology where it materially influences what the statute calls a consequential decision, and the domains it names are education, employment, housing, lending, insurance, healthcare and essential government services. That list is the single most useful thing in it for a buyer, because it tells you whether the project you are about to commission is inside the regime or outside it.
- Education, employment and housing
- Lending and insurance
- Healthcare and essential government services
A chatbot answering questions about your opening hours is outside it. A model that scores rental applicants, ranks job candidates, prices a policy, triages a patient or decides who gets offered credit is inside it. The distinction is not how clever the system is or which vendor built it. The distinction is whether a person is on the other side of the output and whether the output changes what happens to them. Plenty of projects sold as internal efficiency work turn out to sit inside the regime once you follow the output far enough, and the one to watch is anything touching hiring, because employees and applicants fall outside the Colorado Privacy Act and are explicitly inside this one.
The sentence to read before signing
The indemnification provision is the part that changes a negotiation rather than a compliance checklist. The standard shape of an agency contract puts the risk of the output on the client: the agency builds what was asked for, the client deploys it, and an indemnity clause moves the consequences of what it does back to the client. Colorado has legislated that from that date a clause purporting to indemnify a party for its own discriminatory conduct in this area will not hold.
The practical effect is that the contract has to allocate something real instead. Who is accountable for the training data, and for the holes in it. Who is accountable for testing the system against the groups it will touch, and on what cadence after launch. Who writes the notice the end user sees, and who is answerable when the explanation given for an adverse decision does not match what the model did. These were always the right questions, as we argued in what you actually own when an AI engagement ends, and they were easy to leave vague while an indemnity clause appeared to settle them. They are harder to leave vague now.
Two things follow for a Denver buyer. Re-read the contracts you already have, because the provision is not limited to agreements signed after that date. And treat any agency that has no view on this as telling you something about how closely it follows the market it sells into.
What the Denver bench looks like from inside the directory
Counting our own listings is the only market claim on this page we can stand behind, so here it is with the population named. Of the 16 Denver agencies listed here that are not seeded placeholders, the category split runs: 8 in ML and data science, 6 in AI strategy consulting, 5 in process automation and 4 in AI integration. Firms appear in more than one category, which is why those add to more than 16.
| What the Denver listings show | Count |
|---|---|
| Listings that are not seeded placeholders | 16 |
| Publishing an hourly rate | 1 |
| Publishing a team size | 1 |
| Listed in ML and data science | 8 |
| Listed in AI strategy consulting | 6 |
| Listed in process automation | 5 |
| Listed in AI integration | 4 |
Read that split against the law. The largest group in Denver builds models on data, which is the trade the consequential-decision rules land on hardest. The second largest sells strategy, which is the trade most likely to be asked what the rules mean and least likely to be contractually on the hook for the answer. If you are commissioning a scoring model from one firm and a roadmap from another, decide early which of them owns the compliance posture, because neither will volunteer for it.
The full list sits on the Denver agency page, and nothing on it is rated or ranked by quality. It is an index of firms that exist and work in the city.
The case for hiring in the metro rather than anywhere
Proximity is usually oversold, and we have argued that at length. Denver has a narrower argument in its favour than most cities, and it is the regulatory one: a firm that works across Colorado clients is the firm that has already had this conversation with somebody else, and that is worth more before 1 January 2027 than it will be in two years.
The labour market supports the case without being the reason for it. CompTIA, in its State of the Tech Workforce reporting, projects Denver's tech workforce to grow 2.2 percent in 2026, which is roughly 3,500 net jobs and among the stronger metro rates in the country. CBRE, in its Scoring Tech Talent work, placed Denver 16th of the 50 established tech talent markets it ranks. Neither number tells you anything about a specific agency. Both tell you the hiring pool a Denver firm staffs from is deep enough that a two-person shop can become a six-person shop inside a project, which is the failure mode worth asking about directly.
Does an AI agency in Denver cost more than one elsewhere?
There is no honest way to answer that from published rates, because 15 of the 16 Denver listings here publish none. The one that does publishes $125 an hour flat. Across the whole directory the pattern is the same: most listings in most cities publish no rate at all, so any national average you read for this market was built on a small and self-selected sample. Ask for a number against a written scope and compare two quotes only once you are satisfied they describe the same work.
Should the agency or the client own the compliance work?
Whoever can actually do it, named in the contract, with the testing cadence written down. The question is no longer settled by an indemnity clause. For a system inside one of the seven domains, assume you need a documented approach to bias testing before launch and at an interval after it, and assume somebody has to own the notice and explanation that reach the end user.
What if the law is struck down before January?
Then you will have built a system whose training data is documented, whose outputs are tested against the groups they affect, and which can explain an adverse decision to the person it was made about. Every one of those is worth having on the merits. The NIST AI Risk Management Framework asks for substantially the same things and is voluntary everywhere. Treat the deadline as a reason to do it this quarter rather than as the reason to do it.
Is a generalist agency enough for a regulated use case?
For a chatbot, often. For anything that scores a person, ask what the firm has shipped into a regulated setting and what the monitoring looked like afterwards. The useful signal is whether they describe a project that went wrong and what they changed. The first-time hiring checklist covers the rest of the diligence.
How long should this take?
A scoping phase of 2 to 4 weeks, then 3 to 6 months for a custom model from kickoff to production. Working back from 1 January 2027, a model started now is being tested while the rules commence, which is uncomfortable but survivable. A model started in December is not a 2026 project at all, and pretending otherwise is how a deadline turns into a shortcut.
What to put in the first call
Four questions, in this order, and the answers tell you more than any portfolio.
- Which of the seven consequential-decision domains does this project touch, if any? A firm that answers immediately has read the statute. A firm that asks what you mean has not.
- What goes in the contract now that the indemnity route is closed in Colorado? You are listening for a specific allocation of testing and documentation duties, not for reassurance.
- Who monitors the model after launch, how often, and at what cost? Model decay is the line item that gets dropped from proposals and then reappears as an invoice.
- What do we own if we stop working with you? Code, weights, pipeline, documentation. Get it in writing, which is the same answer in every city.
Denver's advantage in this particular quarter is that its agencies have been living with a moving target since 2024 and the good ones have opinions about it. That is a real thing to buy, and it is temporary, and it is not visible in any ranking.
Nothing on this page is an industry statistic and none of the sources below is quoted with a figure that cannot be read on its own page. The bill record and the rulemaking sit with the Colorado General Assembly and the Colorado Attorney General, and both are the documents to read rather than any summary of them, this one included. For the governance vocabulary a competent proposal should already be using, the NIST AI Risk Management Framework is the reference most firms will recognise. The workforce figures come from CompTIA and CBRE, both of which publish their methodology. None of this is legal advice.
Browse the 16 Denver listings, read the full directory if your brief is not geographic, or answer four questions on Get Matched for a shortlist filtered by project type and budget. If you run an AI firm in Colorado, add your listing, since the Denver bench on this site is 16 firms deep and the metro plainly holds more.