Key points

• Colorado's artificial intelligence law, SB 24-205, was the first comprehensive state statute to impose duties on developers and deployers of high-risk AI systems that make or substantially influence consequential decisions.
• Its effective date was delayed from February 2026 to June 30, 2026. The legislature has continued to discuss amendments, so the current text and timing should be confirmed against the latest enacted version before relying on any summary, including this one.
• Deployers must use reasonable care to protect consumers from algorithmic discrimination, maintain a risk management program, complete impact assessments, give notices, and offer explanation and appeal for adverse decisions.
• Only the Colorado Attorney General enforces the law. There is no private right of action, and compliance with a recognized framework supports a rebuttable presumption of reasonable care and an affirmative defense.
• Federal policy has leaned toward limiting state AI regulation, which adds uncertainty but does not remove obligations that are in force.
• Deployers outside Colorado can be covered if they make consequential decisions about Colorado residents.

What the law covers

The Colorado Artificial Intelligence Act regulates high-risk artificial intelligence systems, meaning systems that make, or are a substantial factor in making, a consequential decision. A consequential decision is one that has a material legal or similarly significant effect on the provision, denial, cost or terms of education, employment, financial or lending services, essential government services, health care services, housing, insurance or legal services. Algorithmic discrimination means unlawful differential treatment or impact that disfavors a person or group on the basis of protected characteristics, such as age, color, disability, ethnicity, genetic information, national origin, race, religion, sex and veteran status.

The statute distinguishes developers, which build or substantially modify the systems, from deployers, which use them. This note focuses on deployers, since most companies in our client base, such as employers, lenders, insurers and health care operators, are on that side of the line.

Timing and the state of play

The law was signed in 2024 with a February 2026 effective date. In 2025 the legislature acted in a special session to delay the effective date to June 30, 2026, after industry, the governor and legislators voiced concern about the burden and the clarity of the statute. Since then, further proposals to amend or narrow the statute have been discussed. Companies should treat the statutory text in force as the point of reference, and check for changes before finalizing a compliance program. The federal executive branch has also signaled that it favors a national approach and is skeptical about state AI laws, but an executive statement does not displace a state statute, and any challenge would have to be resolved in the courts or by Congress.

What deployers must do

Reasonable care. A deployer of a high-risk system must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination.

Risk management policy and program. The deployer must implement a policy and program that identifies, documents and mitigates the risk. The statute refers to recognized frameworks, including the NIST AI Risk Management Framework and ISO/IEC 42001, and considers the size and complexity of the deployer and the nature of the system.

Impact assessments. A deployer must complete an impact assessment for each high-risk system, annually and after any intentional and substantial modification. The assessment covers the purpose, the intended use, the categories of data processed, the known limitations, the metrics used to evaluate performance, the transparency measures and the post-deployment monitoring. Records must be kept for a period set by the statute.

Notices. Before a consequential decision is made, the consumer must be told that a high-risk system is being used. A website statement describing the types of systems used and how risk is managed is also required.

Adverse decisions. If a consequential decision is adverse to the consumer, the deployer must explain the principal reasons, including the role of the AI system and the data used, and offer an opportunity to correct inaccurate personal data and to appeal, with human review where technically feasible.

Notification. If a deployer discovers that a system has caused algorithmic discrimination, it must notify the Attorney General without unreasonable delay and within a fixed period after discovery.

Exemptions and defenses

Small deployers with fewer than fifty full-time employees that do not train the system on their own data may be exempt from some obligations, including the risk management program and impact assessments, but must still provide certain information from the developer. The statute also contains carve-outs for entities regulated by certain federal agencies in specified circumstances and for some insurers and banks subject to comparable regimes, with conditions.

Enforcement lies exclusively with the Attorney General, who can bring actions under Colorado's consumer protection statute. There is a rebuttable presumption that a deployer used reasonable care if it complied with the statute and with rules the Attorney General may adopt. There is an affirmative defense for a deployer that discovers and cures a violation as a result of its own testing or review, and that complies with a recognized risk management framework. These provisions reward documentation, which is the main practical lesson.

Practical steps

Inventory the systems used in employment, lending, insurance, housing, health care and similar decisions, including tools supplied by vendors and tools embedded in other software. Decide which are high-risk under the statute's definitions. A tool that merely supports a human reviewer may still be a substantial factor, so analyze how much weight the output carries in practice.

Request documentation from developers. The statute requires developers to supply information that deployers need for impact assessments, including summaries of training data, known limitations and testing results. Contracts should require that information and notice of material changes. See our note on procuring AI.

Build the program. Adopt a risk management policy, assign owners, choose a framework, and set up an impact assessment template that can be repeated across systems. Prepare consumer notices, the adverse decision explanation process and the appeal path, and test them with real scenarios, including how the human reviewer is trained.

Connect to other regimes. A hiring tool used in Colorado may also be subject to local laws elsewhere, as discussed in our note on AI in hiring, and to the EU AI Act where European candidates are affected. A single governance program, built on one framework, is easier to maintain than a collection of local fixes. Boards should receive reports, as described in our note on AI governance for boards.

Corvane Ryle's Artificial Intelligence practice advises developers and deployers on state AI laws, including Colorado's, and on building programs that work across jurisdictions.