Colorado Artificial Intelligence Act
The first US comprehensive state AI law targeting algorithmic discrimination in consequential decisions. Since repealed and replaced by a narrower automated-decision-technology statute taking effect January 2027.
Overview
Two statutes sit behind this entry. Senate Bill 24-205 built a duty of reasonable care against algorithmic discrimination, with impact assessments, risk-management programmes and Attorney General notification for developers and deployers of high-risk AI, and it never took effect. Senate Bill 26-189, signed on 14 May 2026, repealed and reenacted part 17 of article 1 of title 6 of the Colorado Revised Statutes and swapped that model for a disclosure, documentation and consumer-rights regime organised around automated decision-making technology that materially influences a consequential decision in one of seven covered domains. Coverage turns on function, not on labels: any technology that processes personal data and computes an output used to make, guide or assist a decision about an individual is an ADMT, and it becomes a covered ADMT once its output is a non-de-minimis factor that affects the outcome of a consequential decision (Sec. 6-1-1701(2), (5), (13)). The Attorney General enforces through the Colorado Consumer Protection Act with a mandatory 60-day notice and cure before most actions, a carve-out for knowing or repeated violations, and an annual reporting duty, and that cure regime self-repeals on 1 January 2030 (Sec. 6-1-1706(1) to (3)).
Key dates
- May 17, 2024SB 24-205 signed into law
- Aug 2025Enforcement postponed from Feb 2026 to Jun 2026
- May 2026Repealed & replaced by a narrower ADMT statute (SB 26-189)
- Aug 12, 2026SB 26-189 takes effect; duties deferred to Jan 2027
- Jan 1, 2027Replacement statute takes effect
Risk areas addressed
Who it applies to
Duties fall on two roles, each defined by doing business in Colorado: a developer that develops, offers, sells, leases, licenses or otherwise makes a covered ADMT commercially available, builds a component intended for use in one, or intentionally and substantially modifies an ADMT so it becomes one; and a deployer that deploys a covered ADMT (Sec. 6-1-1701(7), (8)(a)). Consumers expressly include employees and Colorado-resident job applicants, so hiring, promotion and workforce tools are squarely in scope (Sec. 6-1-1701(4)(b)). There is no employee-count or revenue threshold, but the statute excludes insurers subject to Sec. 10-3-1104.9 in the practice of insurance, HIPAA covered entities and their business associates other than for employment decisions, FDA-regulated medical devices and pharmaceutical research, research-only and internal-only development, plus a long list of excluded technologies such as spam filters and spell-checkers and of low-stakes decisions such as scheduling, customer-service triage, advertising and content moderation (Sec. 6-1-1701(2)(b), (3)(b), (8)(b), Sec. 6-1-1708).
Key obligations
- As a developer, give each deployer a statement of intended and known harmful or inappropriate uses, the categories of training data including personal data, known limitations and risks and circumstances where the system should not be used, instructions for appropriate use, monitoring and meaningful human review, and whatever the deployer needs for its own disclosures, notifying the deployer if you withhold anything (Sec. 6-1-1702(1)).
- As a developer, notify every deployer within a reasonable time of material updates, intentional and substantial modifications, and changes to intended use, limitations or risk mitigation, relying on public release notes only if you also give direct notice of the release (Sec. 6-1-1702(2)).
- Retain records sufficient to demonstrate compliance for at least three years, developers from creation of the record including version identifiers, changelogs and update notices, and deployers from the date of the consequential decision (Sec. 6-1-1702(4), Sec. 6-1-1703).
- As a deployer, give the consumer clear and conspicuous notice before using a covered ADMT to materially influence a consequential decision, plus instructions for obtaining further information, which a prominent public posting reasonably proximate to the interaction can satisfy (Sec. 6-1-1704(1), (2)).
- Within 30 days of a consequential decision producing an adverse outcome, send the consumer a plain language description of the decision and of the covered ADMT's role, a simple process for requesting details of the system, its version, its developer and its data inputs, and an explanation of their rights and how to use them (Sec. 6-1-1704(3)).
- On request after an adverse outcome, give the consumer instructions for obtaining and correcting factually incorrect or materially inaccurate personal data used in the decision, and an opportunity for meaningful human review and reconsideration to the extent commercially reasonable (Sec. 6-1-1705(1)(a)).
- Resource human review to the statutory standard, using a designated individual with authority to approve, modify or override the decision, who is trained, considers relevant available primary evidence, does not default to the system output, and can see the output's intended use, material limitations, input categories and principal factors (Sec. 6-1-1701(15)).
- Strip from developer and deployer contracts any provision that indemnifies or holds a party harmless for its own acts or omissions in a Colorado anti-discrimination claim arising from a covered ADMT, because such provisions are void as contrary to public policy (Sec. 6-1-1707(7)(a)).
How to prepare
- Inventory every system that processes personal data and produces an output used in decisions about individuals, then test each one against the seven covered domains and the express exclusions for low-stakes, routine, fraud, cybersecurity, sanctions and summarisation uses.
- For the survivors, decide and write down whether the output is a non-de-minimis factor that affects the outcome, because that judgement is what converts an ADMT into a covered ADMT and pulls it into part 17.
- Fix your role for each covered ADMT and paper it through procurement: require vendors to deliver the Sec. 6-1-1702 documentation pack and continuing material-update notices, since your consumer disclosures depend on receiving them.
- Build the consumer-facing layer before 1 January 2027, covering point-of-interaction or public-posting notice, a 30-day adverse-outcome disclosure template per domain, and an intake channel for data access, correction and human review requests.
- Train and empower reviewers to the Sec. 6-1-1701(15) standard, and switch on three-year retention of version identifiers, changelogs and documentation of material mitigation changes.
- Track the Attorney General's rulemaking, which must produce post-adverse-outcome disclosure and consumer-rights rules on or before 1 January 2027 and may later clarify materially influence, then revise your templates and thresholds against the final rules.
Penalties & enforcement
Enforced by the Attorney General as a deceptive/unfair trade practice (no private right of action).
Enforced by: Colorado Attorney General
Colorado AI Act (SB 26-189) is enforced by Colorado Attorney General. The next dated milestone falls on Jan 1, 2027, 115 days away: Replacement statute takes effect. In practice that means knowing which of your AI systems fall in scope across every sector you operate in, holding assessments that speak to bias & discrimination, automated decisions and transparency, and being able to produce that evidence on request.