Colorado SB26-090 critical infrastructure exemption

Colorado SB26-090 is a 2026 bill that would exempt "information technology equipment intended for use in critical infrastructure" from Colorado's Consumer Right to Repair Digital Electronic Equipment Act law (HB24-1121), which is a broad peice of right to repair legislation that implemented right to repair without the business-to-business exemptions found in other states' repair laws.^[1]

Danny Katz, executive director of CoPIRG, described the existing Colorado law as giving Colorado residents "the broadest repair rights in the country", and noted the potential for bill SB26-090 to roll back these rights.^[2] Bill SB26-090 borrows its definition of "critical infrastructure" from the USA PATRIOT Act (42 U.S.C. 5195c(e)), a definition that covers 16 federal sectors including communications, healthcare, food & agriculture, financial services, and information technology.^[3] The primary contention around the adoption of this definition relates to its scope, as the bill does not define "information technology equipment", which Katz said "leaves it up to the manufacturers to determine which items they will need to provide repair tools and parts to owners and independent repairers and which ones they don't".^[2]

Colorado has passed three right to repair laws in four years, making it one of the most active states in the wider right to repair movement.

In 2022, Colorado passed HB22-1031, protecting the right to repair powered wheelchairs.^[4] The following year, HB23-1011 made Colorado the first state to pass an agricultural equipment right to repair law.^[5][6]

The most consequential was HB24-1121, the Consumer Right to Repair Digital Electronic Equipment Act. The act requires the manufacturers of digital electronic equipment manufactured after July 1, 2021 to provide independent repair providers and owners with parts, tools, documentation, and schematics on fair and reasonable terms.^[7] "Fair and reasonable" is defined as costs "equivalent to the most favorable costs and terms that the manufacturer offers to an authorized repair provider." The law also bans the use of parts pairing in ways which would reduce repairability or functionality.^[7]

The act was sponsored by Representatives Brianna Titone and Steven Woodrow, as well as Senators Jeff Bridges and Nick Hinrichsen, passing the Colorado House by a vote of 39-18, and the Senate by a vote of 21-13.^[8] Governor Polis signed it on May 28, 2024, with an effective date of January 1, 2026.^[7]

HB24-1121 exempts motor vehicles, medical devices (except powered wheelchairs), construction and energy-related equipment, fire alarm systems, safety communications equipment, and internet/video/voice routers from its right to repair provisions,^[7] and treats violations as deceptive trade practices.^[8]

What set HB24-1121 apart from every other state repair law was its scope. By way of comparison to other states, Oregon, New York, California, and Minnesota's right to repair laws all contained exemptions for business-to-business equipment from the start, whereas HB24-1121 contained no such exemptions.^[1] This meant that enterprise networking hardware, servers, and business infrastructure were all subject to the same repair mandates as consumer phones and laptops, unless they independently fell within another exemption.^[1] Minnesota's law specifically included a "critical infrastructure" exemption; Colorado deliberately excluded one.^[1] SB26-090 would add back the same type of critical infrastructure carve-out that Colorado excluded when writing HB24-1121.^[1][2]

iFixit CEO Kyle Wiens described HB24-1121 as Colorado "taking a search-and-destroy approach to repair monopolies."^[1]

SB26-090, titled "Exempt Critical Infrastructure from Right to Repair," was introduced on February 10, 2026.^[9] Its sponsors are Senator John Carson (R-30), Senator Marc Snyder (D-12), and Representative Tony Hartsook (R-44), the House Minority Caucus Chair.^[9]

The bill adds a single sentence to Colorado Revised Statutes sections 6-1-1502 and 6-1-1504: "Nothing in this part 15 applies to information technology equipment that is intended for use in critical infrastructure."^[9]

On April 2, 2026, the Senate Business, Labor, and Technology Committee voted 5-0 to advance the bill to the Committee of the Whole.^[9][2] Second reading was scheduled for April 7, 2026.^[9] The bill still needs full Senate and House floor votes before taking effect.^[2]

The bill defines critical infrastructure as "systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters."^[10] This language comes directly from the USA PATRIOT Act of 2001, and was later incorporated into Presidential Policy Directive 21 (PPD-21), issued in 2013.^[11]

Under PPD-21, CISA designates 16 critical infrastructure sectors: Chemical, Commercial Facilities, Communications, Critical Manufacturing, Dams, Defense Industrial Base, Emergency Services, Energy, Financial Services, Food & Agriculture, Government Facilities, Healthcare & Public Health, Information Technology, Nuclear Reactors/Materials/Waste, Transportation Systems, and Water & Wastewater Systems.^[3]

The breadth of CISA's "essential critical infrastructure workers" guidance expanded during the COVID-19 pandemic to include automotive repair, retail groceries, call centers, and logistics, despite no formal change in definition.^[12] Consumer advocate Louis Rossmann noted that using similar logic, it would be easy for manufacturers to greatly expand the range of devices classified as critical infrastructure ^[13].

The bill also does not provide an explicit definition of "information technology equipment." Gay Gordon-Byrne, executive director of the Repair Association, testified at the committee hearing: "I can point out at least five problems with the bill as drafted. The definition of critical infrastructure is completely inadequate. The definition that has been proposed in this bill is not even a definition."^[2]

The bill uses the phrase "intended for use in critical infrastructure" but doesn't specify who decides whether a product meets that threshold and does not define "information technology equipment."^[2]

Nathan Proctor, leader of PIRG's national right to repair campaign, called the framing cynical: "The 'information technology' and 'critical infrastructure' thing is as cynical as you can possibly be about it. It sounds scary to lawmakers, but it just means the internet."^[2]

Cisco is the primary corporate backer of SB26-090. iFixit described the company as "the biggest voice in support" of the exemption.^[6] Consumer-grade internet/video/voice routers are already exempt from HB24-1121.^[7] SB26-090 would create an additional, broader exemption covering enterprise networking equipment.^[6]

Cisco's Non-Entitlement Policy states that "unauthorized repair voids the Cisco Warranty Entitlement" & that the company "does not offer or provide any replacement or spare parts to third-party service repair businesses."^[14] Third-party repairs are listed as "grounds for Cisco to cancel service or warranty support",^[14] despite the Magnuson-Moss Warranty Act (15 U.S.C. Section 2302(c)) prohibiting manufacturers from conditioning warranty coverage on the use of a specific service provider or brand of replacement part.^[15]

At the committee hearing, a Cisco representative stated: "Cisco supports SB-90. While it appreciates the arguments offered in favor of the right to repair, not all digital technology devices are equal."^[2]

IBM is also supporting the SB26-060, and has a general stance against the extension of right to repair to enterprise devices. An IBM spokesperson told Wired: "IBM supports right-to-repair policies that empower consumers while protecting cybersecurity, intellectual property, and critical infrastructure. Given the critical and often sensitive nature of enterprise-level products, any legislation should be clearly scoped to consumer devices."^[2]

The Colorado Secretary of State's Online Lobby System lists 68 lobbying registrations on SB26-090: 40 supporting, 11 opposing, 15 monitoring, and 2 other.^[16]

Of the 40 supporting registrations, 20 come from lobbyists registered under two different clients on the same bill. ^[16] HB Strategies registered eight lobbyists for IBM on February 11, 2026: Erin Goff, Micki Hackenberger, HB Strategies (the firm itself), Carrie Hackenberger, J. Andrew Green & Assoc., Lisa LaBriola, Elizabeth Lo, and Kevin Neimond.^[16] Nineteen days later, on March 2, the same eight registered for the Colorado Springs Chamber of Commerce & Economic Development Corporation (Colorado Springs Chamber & EDC).^[16] That produced 16 registrations from one firm.

Josh Hanfling and Sewald Hanfling Public Affairs registered themselves as lobbyists for both Cisco and the Colorado Technology Association, adding four more duplicate registrations.^[16] Jeffrey Weist & Weist Capitol Group, Inc. registered on the same day (February 18) for two separate cable industry trade groups with nearly identical names: the Colorado Cable Telecommunications Association, and the Colorado Cable Television Association.^[16] Three clusters of double-dipping: HB Strategies (16 registrations from 8 names across two clients), Sewald Hanfling (4 registrations from 2 names across two clients), & Weist (2 clients with almost the same name on the same day).

Cisco's in-house lobbyist Joseph Lee registered on February 10, the same day the bill was introduced, and IBM's eight HB Strategies lobbyists registered the next morning.^[16] Since a lobbyist can't file a position on a bill that hasn't been introduced, consumer advocate Louis Rossmann noted that same-day and next-day registrations from two separate companies could indicate that they both had advance knowledge of the bill before it was publicly filed^[13]. Cisco's outside firm (Sewald Hanfling), the cable associations, and the Denver Metro Chamber registered between February 16 and 18. The Colorado Springs Chamber added its matching HB Strategies team on March 2. The Colorado Technology Association added Sewald Hanfling on March 5-6. TechNet registered five lobbyists on March 12. The Colorado Chamber of Commerce was last, 44 days after introduction, on March 26.^[16]

At least $362,735 in known lobbying spending backs this exemption.^[17] Four of the ten supporting organizations have spending data on file with the Colorado Secretary of State. The other six (TechNet, Denver Metro Chamber, Colorado Chamber, both cable associations, and FGR Hub) don't appear in the database during this period, & March & April 2026 filings are not yet available.

Cisco paid Sewald Hanfling $6,500 per month for at least 14 of the 15 months between October 2024 and December 2025. In January 2026, the payment increased to $7,500.^[18][9]

IBM paid HB Strategies $72,500 in 13 payments between October 2024 and February 2026. IBM's in-house lobbyist Alexi Madon reported another $2,069.76 over three months.^[20]

The Colorado Technology Association paid $116,000 to Sewald Hanfling, the same firm Cisco pays.^[19] The Colorado Springs Chamber and EDC paid $44,311 split between HB Strategies and Weaver Strategies.^[21][22]

Micki Hackenberger, who runs HB Strategies, reported $510,922.50 in personal lobbying income for the year ending June 2025.^[23]

Hackenberger also personally donated to four of the five SB26-090 sponsors and committee members who received lobbying network money: $400 to Catlin, $450 to Hartsook, $225 to Snyder, & $450 to Carson.^[24] The only recipient she didn't donate to was Danielson, who received $3,800 from Sewald Hanfling instead.^[25]

J. Andrew Green & Assoc. is registered as IBM's lobbyist on SB26-090, but the state income database shows zero payments from IBM to Green.^[26] Green reports $14,840 from HB Strategies in January 2026.^[27] HB Strategies collects from both IBM and the Colorado Springs Chamber, then subcontracts Green from that pool.

The five organizations opposing the bill (CoPIRG, Eco-Cycle, Repair.org, the Digital Right to Repair Coalition, and NFIB) have zero disclosed lobbying spending in the same database during 2024-2026.^[17]

Lobbyists and firms registered to support SB26-090 donated a total of $15,725 to the bill's three sponsors and five committee members between 2024 and early 2026.^[28][29][30]

On December 19, 2025, Josh Hanfling of Sewald Hanfling Public Affairs donated $450 to the Committee to Elect Marc Snyder.^[31] Snyder sponsored SB26-090 53 days later. Cisco pays Hanfling's firm $7,500 per month, and Hanfling is registered as Cisco's lobbyist on the bill.^[18][16] The donation amount is small; the timeline connecting Cisco's lobbyist to a bill sponsor weeks before introduction is the pattern.

R.D. Sewald and Josh Hanfling of Sewald Hanfling Public Affairs donated a combined $3,800 to committee chair Jessie Danielson across four transactions:^[25]

Danielson chairs the Senate Business, Labor, & Technology Committee. She voted to advance SB26-090 on April 2, 2026.^[9]

On September 4, 2024, Jenifer Brandeberry and Julie McKenna of Brandeberry McKenna Public Affairs each donated $450 to committee member Senator Marc Catlin (RecordIDs 6851546, 6851547).^[36] Two days later, on September 6, four employees of Husch Blackwell Strategies (the parent company behind HB Strategies) donated to Catlin on the same day: Micki Hackenberger ($400, RecordID 6851545), Elizabeth Lo ($250, RecordID 6851542), Erin Goff ($200, RecordID 6851535), and Kevin Neimond ($100, RecordID 6851531).^[36] Six lobbyists from two firms, all later registered on SB26-090, donated $1,850 to the same senator within 48 hours. Catlin voted to advance the bill.^[9]

Senators Nick Hinrichsen and Iman Jodeh received no donations from any SB26-090 lobbying firm, PAC, or corporate employee in the 2024-2026 TRACER data.^[37][38] Both sit on the committee. Both voted to advance the bill.^[9]

Colorado law doesn't require lobbyists to break down spending by bill.^[39] The $362,735 figure is total client payments to their lobbyists during this period; the connection to SB26-090 comes from separate position filings where those same lobbyists registered as supporting the bill.^[16][17]

Three separate systems hold the data: the Secretary of State's Online Lobby System (lobbying registrations and bill positions), the Professional Lobbyist Income dataset on Colorado's open data portal (monthly payments from clients to lobbyists), and TRACER (campaign donations).^[39] Connecting a corporation's lobbying money to a specific vote requires pulling data from all three and matching records by hand.

Colorado law allows lobbyists to donate to legislators they lobby, as long as the donation falls outside the regular legislative session (C.R.S. 1-45-105.5).^[40] SB25-148, a bill to ban lobbyist donations to legislators year-round, was killed by the Senate Committee on State, Veterans, and Military Affairs in March 2025.^[41] Twelve months later, SB26-090's lobbyists had donated $15,725 to the bill's sponsors & committee members.^[28][29][30]

Manufacturers backing SB26-090 argue that sharing diagnostic tools, firmware, and schematics for enterprise infrastructure could enable bad actors to exploit vulnerabilities.^[2] iFixit CEO Kyle Wiens testified at the bill's hearing: "There's a general principle in cybersecurity that obscurity is not security. The money that's behind the scenes, that's what's driving the bill."^[2]

Some cybersecurity researchers have directly disputed the manufacturer framing. Security researcher Billy Rios, and threat researcher Andrew Brandt, spoke against the exemption on the Securepairs podcast.^[6] Paul Roberts, chief of The Security Ledger and founder of Securepairs.org, stated: "A vibrant and healthy market for repair isn't a cybersecurity risk. In fact, it should be considered a cybersecurity imperative!"^[6]

Repair advocates have also made the argument that restricting independent repair can have the unintended consequence of making critical infrastructure less secure, due to the need for timely repairs which may not be available through manufacturer-approved technicians.^[2]

The April 2, 2026 hearing before the Senate Business, Labor, & Technology Committee drew over a dozen repair advocates who testified against the bill.^[2] Organizations represented included iFixit, CoPIRG, the Repair Association, and PIRG's national campaign. Repair advocate Louis Rossmann was also present.^[2]

Katz, who described Colorado as having "the broadest repair rights in the country," warned that the bill "is a bad policy and would be a big step back for Coloradans' repair rights."^[2] Gordon-Byrne pointed to at least five drafting problems.^[2]

During the hearing, bill sponsor Senator John Carson stated the following:

"And I want to note that when Governor Polis signed House Bill 24-1121, when he signed it into law, he issued a directive in his signing statement that the law should be fixed before its implementation date of January 1, 2026. He noted that Colorado is the only state in the nation that requires devices used for critical infrastructure be included in their repair law. So we're running this bill to fix a critical mistake made in the original law and protect our devices from malicious attacks."^[42]

However, Governor Polis's official press release on signing HB24-1121, dated May 28, 2024, contains no mention of critical infrastructure, no directive to "fix" the law, and no statement that Colorado is an outlier.^[43] While the website for the Governor of Colorado's press release concerning House Bill 24-1121 originally stated " View the Governor’s signing statement" which would have customarily had a hyperlink to the signing statement, no hyperlink was included. Upon emailing the Governor's staff on 4-21-2026, the website was updated and the link corrected. The signing statement reads, in part:

This bill takes effect on January 1, 2026, and I encourage stakeholders to continue conversations in the interim to ensure that the full list of exclusions is appropriate and exhaustive, and take into consideration concerns that were raised during the process. ^[44][43]

In 2025, the Texas legislature passed HB2963, a right to repair bill signed on June 20, 2025 and effective September 1, 2026. The bill used the identical USA PATRIOT Act critical infrastructure exemption (42 U.S.C. 5195c(e)) as SB26-090, along with additional exemptions for medical devices and heavy equipment.^[45]

Several states that have passed repair laws, including Oregon, New York, California, and Minnesota, exempted business-to-business equipment from the start.^[1]

As of 2026, right to repair bills have been introduced in every U.S. state and passed in eight.^[2]

• Right to Repair
• Parts pairing
• Magnuson-Moss Warranty Act
• Cisco Systems, Inc.