Colorado AI Act: Requirements & Impact

Overview

The Colorado AI Act (SB 24-205), signed into law in May 2024, takes effect on February 1, 2026. It is the first comprehensive, enforceable AI governance law at the state level in the United States and serves as a potential model for other states.

Who Does It Apply To?

The Act applies to two categories:

Developers

Companies that design, code, or substantially modify AI systems that are:

•Deployed in Colorado, AND

•Used to make or be a substantial factor in consequential decisions

Deployers

Companies that use AI systems to make or substantially factor into consequential decisions affecting Colorado residents.

What Are Consequential Decisions?

Decisions that have material legal or similarly significant effects on consumers in areas including:

•Education enrollment or opportunities

•Employment or employment-related decisions

•Financial or lending services

•Essential government services

•Healthcare services

•Housing

•Insurance

•Legal services

Key Requirements

For Developers:

•Provide documentation on intended uses and known limitations

•Disclose training data information

•Publish information on how the system was evaluated for risks

•Notify deployers of known risks of algorithmic discrimination

For Deployers:

•Complete impact assessments before deploying high-risk AI

•Implement a risk management policy

•Provide consumers with notice that AI is being used

•Allow consumers to appeal AI-driven decisions

•Report instances of algorithmic discrimination to the AG

Penalties

•Enforced by the Colorado Attorney General

•Violations treated as deceptive trade practices

•60-day cure period for first-time violations

•ISO 42001 certification serves as an affirmative defense

Relationship to Other States

At least 15 additional US states are drafting similar AI legislation, many modeled on Colorado's framework. Early compliance positions companies favorably for the expanding regulatory landscape.

Key Points