What the Colorado AI Act Requires of Your Organization
The Colorado AI Act (SB 24-205), signed into law in May 2024 and effective February 1, 2026, is the most comprehensive state-level AI regulation in the United States. It targets algorithmic discrimination — any condition in which the use of an AI system results in unlawful differential treatment or impact on the basis of age, color, disability, ethnicity, genetic information, national origin, race, religion, sex, veteran status, or other protected characteristics.
The law creates distinct obligations for developers (those who build or substantially modify AI systems) and deployers (those who use AI systems to make consequential decisions). Non-compliance is enforceable by the Colorado Attorney General, with violations treated as deceptive trade practices.
Key Compliance Requirements
Deployer Impact Assessments
Deployers of high-risk AI systems must complete and annually update impact assessments documenting the purpose, intended use, data inputs, outputs, known limitations, and risks of algorithmic discrimination.
Developer Obligations
Developers must provide deployers with documentation including training data descriptions, known limitations, bias testing results, and instructions for safe and compliant use of the AI system.
Algorithmic Discrimination Prevention
Organizations must implement reasonable measures to prevent algorithmic discrimination, including ongoing testing and monitoring of AI outputs for disparate impact across protected classes.
Consumer Notification
Deployers must notify consumers when a high-risk AI system makes or substantially contributes to a consequential decision, and provide a right to appeal with access to a human reviewer.
Annual Reviews
Deployers must conduct annual reviews of their high-risk AI systems to ensure continued compliance, updating impact assessments and risk mitigation strategies as the system evolves.
Risk Management Program
Deployers must implement a risk management policy and program proportionate to the size and complexity of the organization, including employee training and oversight procedures.