Colorado AI Act Takes Effect June 30, 2026 — What You Need to Do Now
With months until the Colorado AI Act's effective date, here's a practical compliance checklist for businesses using high-risk AI systems in Colorado.
Colorado SB 24-205 — the Colorado Artificial Intelligence Act — takes effect on June 30, 2026. If your business uses high-risk AI systems that make consequential decisions about Colorado consumers, you have a compliance obligation.
Who Does This Affect?
The Colorado AI Act applies to deployers of high-risk AI systems that make or assist in making consequential decisions about Colorado residents in these categories:
- Employment: Hiring, promotion, termination, compensation
- Credit: Lending, financing, or lease decisions
- Education: Admissions, financial aid, academic evaluations
- Healthcare: Diagnosis, treatment recommendations, medication
- Housing: Applications or pricing
- Insurance: Applications, pricing, or claims
- Legal Services: Legal representation or referrals
A "high-risk AI system" is one that makes, or is a substantial factor in making, a consequential decision.
What You Must Do
1. Conduct an Impact Assessment
Before deploying any high-risk AI system, you must complete an impact assessment that documents:
- The intended purpose and reasonably foreseeable uses
- Benefits of the system
- Known and reasonably foreseeable risks of algorithmic discrimination
- How the system was evaluated for discrimination
- Transparency and explainability measures
- How human oversight is implemented
- How training data was collected and used
Impact assessments must be updated annually and when there are material changes to the system.
2. Implement a Risk Management Program
You need a program to manage the risk of algorithmic discrimination, including:
- Policies and procedures for high-risk AI governance
- Vendor/developer due diligence processes
- Monitoring for discriminatory outcomes in production
- Employee training on AI use policies
3. Notify Consumers
When a high-risk AI system is used to make a consequential decision, you must:
- Notify the consumer that AI was used
- Provide a plain-language explanation of how the AI contributed to the decision
- Offer a way for consumers to opt out of the AI system
- If the decision is adverse, explain what factors led to it
4. Annual Reports
Deployers must submit an annual report to the Colorado AG summarizing:
- High-risk AI systems deployed
- Impact assessments conducted
- Discrimination risks identified and mitigated
What's NOT Required
- You don't need to use a specific AI framework or obtain certification
- Small businesses may qualify for scaled-down obligations
- AI systems used solely for internal operations (not making consumer-facing consequential decisions) are not covered
Immediate Action Checklist
- Inventory all AI systems that make consequential decisions affecting Colorado residents
- Classify which are "high-risk" under the law's categories
- Assign ownership for each high-risk system
- Begin impact assessments for each covered system
- Engage legal counsel familiar with Colorado AI Act
- Review contracts with AI vendors — ensure they provide needed documentation
- Draft consumer notification language
- Design opt-out mechanism
Resources
Related Regulations
Not sure which AI laws apply to your business?
Use our free compliance checker — answer 4 questions, get instant results.
Check My ComplianceNot legal advice. This article is for informational purposes only. Always consult a qualified attorney for compliance decisions.