Colorado AI Act

What is the Colorado AI Act?

The Colorado AI Act is the state's law on automated decision-making technology (ADMT) used to make consequential decisions about people. The current version is SB 26-189, signed on 14 May 2026. It repealed and re-enacted the 2024 law before that law ever took effect.

The original law, SB 24-205, was the first broad US state AI law. It put a duty of reasonable care against algorithmic discrimination on developers and deployers of "high-risk artificial intelligence systems." SB 26-189 replaced that model with narrower documentation, transparency and consumer-rights duties.

Our lesson on US state AI laws puts Colorado next to Texas, California and others.

How did the Colorado AI Act change?

How the two versions compare:

Who does the Colorado AI Act apply to?

It applies to developers and deployers doing business in Colorado, as defined in the signed act.

• A deployer is a person doing business in Colorado that deploys a covered ADMT.
• A developer offers, sells or licenses a covered ADMT, builds a component designed for one, or substantially modifies an ADMT so it becomes covered.

Three definitions set the scope (C.R.S. 6-1-1701):

• ADMT is technology that processes personal data and uses computation to produce outputs, such as scores or rankings, used in decisions about individuals.
• Covered ADMT is ADMT used to materially influence a consequential decision. Its output must be a non-de minimis factor that affects the outcome. Incidental, trivial or clerical uses don't count.
• A consequential decision concerns a person's access to, eligibility for, selection for or compensation in a covered domain. There are seven: education, employment, residential real estate, financial or lending services, insurance, health care, and essential government services and public benefits.

"Consumer" includes employees and job applicants who are Colorado residents.

Basic tools such as calculators, firewalls and spreadsheets without machine learning are excluded. So are tools used only to summarize, draft or present information for human review. Advertising, search, content moderation, fraud prevention and cybersecurity are not consequential decisions.

Sector carve-outs apply. Insurers already subject to Colorado's insurance algorithm law (C.R.S. 10-3-1104.9) are treated as compliant for insurance practice. HIPAA covered entities are exempt except for employment decisions, but must give patients a general notice. FDA-regulated medical devices are excluded. Creditors can meet the disclosure duties with ECOA and FCRA notices that also cover this law's content.

SB 24-205 partly exempted deployers with fewer than 50 full-time employees. The new law has no size-based exemption.

When does the Colorado AI Act take effect?

SB 26-189 takes effect on 1 January 2027. It applies to consequential decisions made on or after that date, and developer documentation duties start the same day.

A few provisions took effect when the bill was signed on 14 May 2026. They require the Attorney General to adopt rules by 1 January 2027 on post-adverse-outcome disclosures and on the correction and human-review rights.

What must developers do?

From 1 January 2027, a developer must give each deployer, in an understandable form (C.R.S. 6-1-1702):

• a general statement of intended uses and known harmful or inappropriate uses;
• the categories of data used to train the covered ADMT, including personal data, to the extent known;
• known limitations and risks, and circumstances where the tool should not be used;
• instructions for appropriate use, monitoring and meaningful human review; and
• information the deployer needs for its own disclosures.

Developers must notify deployers, within a reasonable time, of material updates, substantial modifications and changes to intended use, limitations or risk mitigation. Public release notes work if each deployer gets direct notice of them.

Developers keep compliance records for at least three years. These duties apply only where the ADMT was marketed or licensed for consequential decisions.

What must deployers do?

• Notice before use. Tell consumers clearly and conspicuously that a covered ADMT will be used in a consequential decision about them. Say how to get more information. A prominent public notice at points of interaction can satisfy this.
• Explanation after an adverse outcome. Within 30 days, give a plain-language description of the decision and the ADMT's role. Include how to request details, such as the tool's name, version, developer and the personal data used, and explain the consumer's rights.
• Correction. On request, let consumers obtain and correct factually incorrect or materially inaccurate personal data used in the decision. Opinions, predictions and scores need not be corrected.
• Human review. Offer meaningful human review and reconsideration of an adverse decision, to the extent commercially reasonable. The reviewer must be trained, have authority to change the outcome, consider the evidence and not default to the output (see human oversight).
• Records. Keep compliance records for at least three years after each decision.

Notices must be accessible to people with disabilities and limited English proficiency.

SB 26-189 dropped several SB 24-205 duties. Gone are the risk management program, annual impact assessments and the general duty to disclose AI interactions. So is the 90-day report to the Attorney General after discovering algorithmic discrimination.

How is the Colorado AI Act enforced?

• Attorney General only. The Attorney General has exclusive enforcement power. A violation is a deceptive trade practice under the Colorado Consumer Protection Act (C.R.S. 6-1-1706).
• Notice and cure. Before acting, the Attorney General must send a notice of violation if a cure is possible, then allow 60 days. This step doesn't apply to knowing or repeated violations, and it is repealed on 1 January 2030.
• No new private right of action. Consumers can't sue under this law. Existing claims, such as under the Colorado Anti-Discrimination Act, remain available.
• Shared fault. In discrimination claims involving covered ADMT, fault is split between developers and deployers by relative fault (C.R.S. 6-1-1707). A developer isn't liable for uses it didn't intend or contract for. Contract clauses that shield a party from liability for its own discriminatory acts are void.
• No framework defense. Unlike SB 24-205, the law has no affirmative defense for following the NIST AI RMF or ISO/IEC 42001. Complying with it is also no defense under other laws.

Under the original act, the defense required curing violations found through feedback, red teaming or internal review. The company also had to follow the NIST AI RMF and ISO/IEC 42001, or an equivalent or designated framework.

How does the AIGP exam test the Colorado AI Act?

BoK v2.1 was approved in September 2025, before SB 26-189 existed. Exam questions may still describe SB 24-205. Look for high-risk AI systems, a duty of reasonable care against algorithmic discrimination, risk management programs, impact assessments or a framework-based defense. Answer the version the question describes.

Two points hold under both versions: only the Attorney General enforces it, and there is no private right of action.

Also contrast Colorado with Texas's TRAIGA. Colorado is impact-based, so a biased outcome matters even without intent. Texas is intent-based, so disparate impact alone isn't enough.

Change log

• 7 Nov 2026: Page published.