Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
JoinJoin
Regulations › US states › Colorado

Colorado AI Act

Colorado Artificial Intelligence Act (SB 24-205)

Enforcement stayed ai automated decisions
WhenIts effective date moved from 1 February 2026 to 30 June 2026, a federal court stayed enforcement in April 2026, and the legislature has been revisiting it. Check the current position before relying on it.
Who enforces itColorado Attorney General
Who it applies toDevelopers and deployers of high-risk AI systems used in consequential decisions such as employment, lending, housing, education, health care and insurance.

The first broad US state law on algorithmic discrimination, modeled partly on risk-based approaches like the EU AI Act.

The law in brief

The Colorado AI Act (SB 24-205) was the first comprehensive US state law aimed at algorithmic discrimination. It puts duties on developers and deployers of high-risk AI systems, those that make, or are a substantial factor in making, consequential decisions about people.

Its status is unsettled. Its effective date was moved to 30 June 2026, and in April 2026 a federal court stayed its enforcement in a pending lawsuit, while the legislature has been revisiting the framework. The obligations below are the law as enacted; check Regulatory Watch before relying on dates.

Who it applies to

  • Developers of high-risk AI systems doing business in Colorado.
  • Deployers that use high-risk AI systems to make consequential decisions about Colorado consumers.
  • Consequential decisions are those with a material effect on access to, or the cost or terms of, education, employment, financial or lending services, essential government services, health care, housing, insurance or legal services.
  • Some small deployers (fewer than 50 employees, meeting conditions) are exempt from parts of the deployer duties.

What it requires

A duty of reasonable care

Developers and deployers must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination.

Deployer risk management and impact assessments

Deployers maintain a risk management policy and program, and complete an impact assessment for each high-risk system at least annually and after significant changes.

Tell consumers, explain, and allow appeal

Notify consumers before a high-risk system is used in a consequential decision about them, and after an adverse decision explain the reasons and offer correction and appeal.

Developer documentation and disclosure

Developers give deployers the documentation needed for impact assessments, publish a statement on their high-risk systems, and tell the Attorney General and known deployers of discovered risks of algorithmic discrimination within 90 days.

People's rights

Consumers must be told when a high-risk AI system is used to make a consequential decision about them. After an adverse decision they are entitled to an explanation of the principal reasons, a chance to correct incorrect personal data, and an appeal with human review where technically feasible.

Enforcement and penalties

Enforced only by the Colorado Attorney General, with violations treated as deceptive trade practices under the Colorado Consumer Protection Act; there is no private right of action. Following a recognized framework such as the NIST AI Risk Management Framework or ISO/IEC 42001 supports an affirmative defense.

What's changing

Stayed and under revision. Enforcement was stayed by a federal court in April 2026, and further legislative changes have been under consideration. Treat the duties below as the direction of travel, and check Regulatory Watch for the current position.

What to do first

  1. Inventory AI used in consequential decisions about Colorado consumers.
  2. Adopt a risk management program aligned to the NIST AI RMF or ISO/IEC 42001; it helps under any version of the law.
  3. Prepare impact assessments for high-risk systems.
  4. Draft consumer notices and an adverse-decision explanation and appeal process.
  5. Watch the court case and the legislature before committing to dates.

Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.

Recent developments

Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.

Sources