Colorado AI Act

In May 2024, Colorado became the first US state to pass a broad law regulating high-risk artificial intelligence. SB 24-205 required developers and deployers of AI systems used in consequential decisions, such as hiring, lending, housing, insurance and health care, to use reasonable care to protect consumers from algorithmic discrimination. It called for risk management programs, impact assessments, consumer notices and reporting to the state attorney general. The law attracted national attention as a possible model for other states, and also strong criticism from businesses concerned about cost and complexity. Some critics argued its definitions were too broad and its obligations hard to apply.

The law never took effect. Its start date was moved from February 1, 2026 to June 30, 2026 during a 2025 special session, and in May 2026 the legislature repealed and replaced it with SB 26-189, a narrower law focused on automated decision-making technology that takes effect on January 1, 2027. For legal, compliance, HR, lending and product teams operating in Colorado, the important law now is SB 26-189, although many resources still describe the original act.

Definition of the Colorado AI Act

The Colorado AI Act is the common name for Colorado's legislation governing the use of AI and automated decision-making in consequential decisions about consumers, originally enacted as SB 24-205 and replaced, before taking effect, by SB 26-189, which regulates covered automated decision-making technology from January 1, 2027.

It is one of the main US examples of AI regulation, draws on concerns about algorithmic bias and contrasts with the broader, risk-tiered approach of the EU AI Act.

The Original Law, SB 24-205

SB 24-205 applied to high-risk AI systems that make, or are a substantial factor in making, consequential decisions about consumers.

It placed a duty of reasonable care on developers and deployers to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. This duty was one of the law's most debated features.

Deployers would have had to implement a risk management program, complete annual impact assessments, notify consumers and offer them a chance to correct data and appeal adverse decisions.

Developers would have had to provide documentation to deployers and disclose known risks to the attorney general.

The Replacement Law, SB 26-189

SB 26-189, signed on May 14, 2026, replaces the concept of high-risk AI with covered automated decision-making technology: technology that processes personal data and generates outputs that materially influence consequential decisions.

Consequential decisions cover education, employment, residential real estate, financial or lending services, insurance, health care and essential government services. Legal services, which appeared in the original law, are no longer listed.

Deployers must give consumers notice before use, a plain-language explanation within 30 days after an adverse decision, and on request the ability to access and correct their data and to obtain meaningful human review where commercially reasonable.

Developers must give deployers documentation on intended uses, known limitations, training data categories and instructions for human review, and both must keep records for three years.

The new law drops the duty of care, mandatory risk management programs, impact assessments and attorney general reporting. It is enforced only by the attorney general, with no private right of action and a 60-day period to cure many violations.

Importance of the Colorado AI Act in AI Governance

The Colorado law shows how AI regulation in the United States is developing. It moved from a broad, risk-management model toward narrower transparency and consumer rights obligations. This shift reflects wider debate about how to regulate AI without slowing its use.

It sets concrete requirements. Organizations using AI or automated tools in consequential decisions about Colorado residents must provide notices, explanations and human review.

It also influences other states. Colorado's experience is closely watched by lawmakers and businesses elsewhere.

The Colorado AI Act and Financial Management

Compliance costs under SB 26-189 come mainly from notices, explanation processes, data correction, human review and record keeping.

Dropping impact assessments and risk management programs reduces costs compared with the original law, although many organizations keep these practices for other reasons. Other laws, customers and frameworks often expect them anyway.

Violations are enforced under the Colorado Consumer Protection Act, so penalties can be significant.

Contracts between developers and deployers should reflect documentation duties and the law's rules on allocating fault.

Common Challenges

Many organizations prepared for SB 24-205 and must now adjust their programs to a different set of requirements. Much of that preparation remains useful as good governance.

Deciding whether a tool materially influences a consequential decision requires careful analysis. Tools that only support human judgment may fall outside the law, depending on how they are used.

Requirements differ from those in other states and the EU, complicating compliance for multi-jurisdiction organizations. Building to common themes, such as notice and human review, helps.