Update (May 2026): SB 26-189 substantially rewrote the Colorado AI Act. The effective date has moved to January 1, 2027. The original June 30, 2026 deadline no longer applies.
Colorado SB 24-205 — the Colorado Artificial Intelligence Act, as amended by SB 26-189 — takes effect on January 1, 2027. If your business uses high-risk AI systems that make consequential decisions about Colorado consumers, you have a compliance obligation.
Who Does This Affect?
The Colorado AI Act applies to deployers of high-risk AI systems that make or assist in making consequential decisions about Colorado residents in these categories:
- Employment: Hiring, promotion, termination, compensation
- Credit: Lending, financing, or lease decisions
- Education: Admissions, financial aid, academic evaluations
- Healthcare: Diagnosis, treatment recommendations, medication
- Housing: Applications or pricing
- Insurance: Applications, pricing, or claims
- Legal Services: Legal representation or referrals
A "high-risk AI system" is one that makes, or is a substantial factor in making, a consequential decision.
What You Must Do
1. Conduct an Impact Assessment
Before deploying any high-risk AI system, you must complete an impact assessment that documents:
- The intended purpose and reasonably foreseeable uses
- Benefits of the system
- Known and reasonably foreseeable risks of algorithmic discrimination
- How the system was evaluated for discrimination
- Transparency and explainability measures
- How human oversight is implemented
- How training data was collected and used
Impact assessments must be updated annually and when there are material changes to the system.
2. Implement a Risk Management Program
You need a program to manage the risk of algorithmic discrimination, including:
- Policies and procedures for high-risk AI governance
- Vendor/developer due diligence processes
- Monitoring for discriminatory outcomes in production
- Employee training on AI use policies
3. Notify Consumers
When a high-risk AI system is used to make a consequential decision, you must:
- Notify the consumer that AI was used
- Provide a plain-language explanation of how the AI contributed to the decision
- Offer a way for consumers to opt out of the AI system
- If the decision is adverse, explain what factors led to it
4. Annual Reports
Deployers must submit an annual report to the Colorado AG summarizing:
- High-risk AI systems deployed
- Impact assessments conducted
- Discrimination risks identified and mitigated
What's NOT Required
- You don't need to use a specific AI framework or obtain certification
- Small businesses may qualify for scaled-down obligations
- AI systems used solely for internal operations (not making consumer-facing consequential decisions) are not covered
Immediate Action Checklist
- Inventory all AI systems that make consequential decisions affecting Colorado residents
- Classify which are "high-risk" under the law's categories
- Assign ownership for each high-risk system
- Begin impact assessments for each covered system
- Engage legal counsel familiar with Colorado AI Act
- Review contracts with AI vendors — ensure they provide needed documentation
- Draft consumer notification language
- Design opt-out mechanism
Resources
This article is for informational purposes only and does not constitute legal advice. Always consult qualified counsel before making compliance decisions. Try the free compliance checker →