Colorado Artificial Intelligence Act (SB 24-205)

· About Colorado Artificial Intelligence Act (SB 24-205)

Key Takeaways

  • Colorado’s original SB 24-205 AI Act was enacted in 2024, delayed by SB 25B-004 to 30 June 2026, and then repealed and reenacted by SB 26-189, which becomes effective 1 January 2027. [7][5][1][3]
  • As of 29 September 2026, the operative Colorado framework is the Automated Decision-Making Technology law in SB 26-189, not the 2024 high-risk AI regime. [1][3]
  • The repealed SB 24-205 framework would have applied to developers and deployers of high-risk AI systems making consequential decisions in areas such as employment, housing, lending, education, insurance, and health care. [7][12]
  • SB 24-205’s principal obligation was to use reasonable care to protect consumers from known or reasonably foreseeable algorithmic discrimination, supported by risk management, impact assessments, notices, and consumer remedy processes. [7][12]
  • The replacement law shifts the focus to ADMT disclosures and governance for consequential decisions, with duties tied to the new 1 January 2027 effective date and implementing rules to follow. [2][1][3]
  • For organizations still building programs, Colorado now functions as a transition jurisdiction: SB 24-205 no longer governs future conduct, but its concepts remain relevant for mapping existing controls to the 2027 ADMT regime. [1][3]

What It Is

Colorado’s 2024 Consumer Protections for Artificial Intelligence law, commonly called the Colorado AI Act or SB 24-205, was the first broad state law to impose duties on developers and deployers of high-risk AI systems used in consequential decisions. [7][12] It was enacted by the Colorado General Assembly and signed in 2024, with the legislature later delaying its operative date from 1 February 2026 to 30 June 2026 through SB 25B-004. [7][11][5]

The law did not survive intact to implementation. In 2026, Colorado enacted SB 26-189, which repeals and reenacts the AI provisions and replaces the original regime with a narrower Automated Decision-Making Technology framework effective 1 January 2027. [1][2][3] In practical terms, the 2024 act is now best understood as a repealed predecessor statute that shaped the replacement law rather than the current governing rule. [1][3]

The Colorado Attorney General is the enforcement body for the state AI framework, and the AG’s AI rulemaking page confirms that SB 26-189 “go[es] into effect January 1, 2027.” [3]

Who Must Comply

Under the repealed SB 24-205 framework, compliance applied to developers of high-risk AI systems and deployers that use those systems in making or assisting consequential decisions. [7][12] The law targeted decisions affecting access to or terms for employment, housing, lending, education, insurance, and health care, among other covered domains. [12][7]

The statute’s reach was not limited to Colorado-headquartered companies; it was designed to regulate systems used in Colorado markets and decisions affecting Colorado consumers, which gave it practical extraterritorial effect for out-of-state vendors and deployers serving Colorado residents. [7][12] That said, because SB 24-205 has been repealed and reenacted, the operative compliance question for 2026–2027 is whether an entity develops or deploys covered ADMT under SB 26-189, not whether it falls within the older high-risk AI definition. [1][2]

The 2024 act contained limited exceptions and carve-outs, but the most important implementation point for most businesses was the distinction between a downstream deployer making decisions and an upstream developer supplying the system. [7][12] Organizations should assume that vendors, affiliates, and third-party service providers may be pulled into the Colorado framework if they participate in consequential decision-making workflows. [7][2]

Core Requirements

  1. Reasonable care against discrimination. Developers had to use reasonable care to protect consumers from known or reasonably foreseeable algorithmic discrimination in high-risk AI systems used for consequential decisions. [7][12]
  1. Risk management program. The law required a documented risk management program that identified, mapped, measured, and governed foreseeable discriminatory risks in line with the system’s intended use. [12][7]
  1. Impact assessment before deployment. Developers and deployers had to perform and maintain impact assessments describing the system, its purpose, the data used, the categories of decisions affected, and the risks of algorithmic discrimination. [12][7]
  1. Consumer notices. Deployers were required to disclose to consumers when a high-risk AI system was used in a consequential decision and to provide meaningful information about the system’s role and the consumer’s rights. [12][7]
  1. Consumer appeal and correction processes. The law contemplated a process for consumers to challenge, correct, or appeal adverse consequential decisions and to request human review where appropriate. [12][7]
  1. Governance and disclosure documentation. Developers needed to provide deployers with relevant documentation, including notices about intended uses, known limitations, and steps necessary for compliant use. [12][7]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | SB 24-205 enacted | 17 May 2024 | Colorado adopted the original high-risk AI obligations. [7] | | Effective-date delay enacted | 25 November 2025 | SB 25B-004 delayed the principal operative date to 30 June 2026. [5][11] | | Original regime repealed and reenacted | 14 May 2026 | SB 26-189 replaced the 2024 law with a new ADMT framework. [1][3] | | Replacement law effective | 1 January 2027 | The new Colorado ADMT law becomes operative. [2][3] |

For the repealed SB 24-205 regime, the cited sources do not provide a clean standalone maximum-fine schedule in the bill text snippets available here, and the operative enforcement posture changed before full implementation. [7][1] The current Colorado materials instead emphasize the replacement regime, attorney general rulemaking, and the new effective date of 1 January 2027. [2][3]

Other sanctions under the original framework could include enforcement by the Colorado Attorney General under Colorado consumer-protection style authority, injunctive relief, and compliance obligations tied to remediation rather than a single bespoke AI fine table. [7][12] Because the old law was superseded before becoming fully operative, organizations should treat any penalty analysis under SB 24-205 as historical rather than as present compliance guidance. [1][3]

How to Comply

  1. Map all decision workflows. Inventory any model, rules engine, scoring tool, or vendor service that influences employment, housing, lending, insurance, education, health care, or other consequential decisions. Align this inventory with ISO 27001 asset management and data-flow controls.
  1. Classify the system and role. Determine whether the organization is a developer, deployer, or both, and whether a use case is likely to be treated as high-risk AI under the old regime or covered ADMT under the new one. Use a control matrix aligned to NIST CSF 2.0 governance and risk-management functions.
  1. Document risk management. Maintain a written risk program covering foreseeable discrimination, input data quality, model limitations, human oversight, testing, and post-deployment monitoring. This is where ISO 27001 and ISO 42001 map well, because both support structured AI/security governance and continuous improvement.
  1. Run impact assessments. Before launch and on material change, record purpose, affected populations, decision context, foreseeable harms, mitigation steps, and residual risk. Keep assessments version-controlled and auditable for regulator review.
  1. Implement notice and disclosure controls. Build consumer-facing and downstream-business notices that clearly state when automated systems are used and how consumers can seek review or contest outcomes. Ensure vendor contracts require upstream documentation and timely change notices.
  1. Add human review and appeals. Provide a practical route for consumers to seek correction or appeal adverse outcomes, with escalation criteria and turnaround times. Human review should be meaningful, not merely nominal.
  1. Test, monitor, and retrain. Establish drift monitoring, bias testing, incident logging, and rollback criteria for models and vendor systems. Tie these controls to NIST CSF 2.0 continuous monitoring and ISO 42001 improvement cycles.
  1. Prepare for the 2027 regime. Rework policies, notices, and vendor terms now for the ADMT framework effective 1 January 2027, because the replacement law is the current Colorado compliance target. [1][2][3]

Related Regulations

  • EU AI Act: The EU law is broader in scope and uses a different risk taxonomy, so multinational programs should avoid assuming Colorado’s ADMT disclosures satisfy EU provider and deployer duties.
  • Illinois AI Video Interview Act: Illinois focuses on employment video analysis and notice, creating a narrower but overlapping hiring-compliance obligation.
  • New York City Local Law 144: NYC’s bias-audit and notice requirements for automated employment decision tools overlap with Colorado’s employment use cases and can be paired in the same governance program.
  • California privacy laws: CPRA/CCPA can conflict or overlap where model inputs or outputs involve personal information, notices, and consumer rights around automated decision-making.
  • FTC Act Section 5: The FTC’s unfairness and deception authority can reach misleading AI claims or discriminatory model practices even where state AI statutes are narrower.

FAQ

Does the Colorado AI Act still apply in 2026?

No, not as a live compliance regime for future conduct. SB 24-205 was delayed and then repealed and reenacted by SB 26-189, which is the operative Colorado framework going forward and becomes effective 1 January 2027. [1][3]

Does it apply to companies outside Colorado?

Yes, if they develop or deploy systems used in Colorado-consequential decisions or affecting Colorado consumers. The statute was designed to reach out-of-state vendors and service providers that participate in covered decision workflows. [7][12]

What counts as a high-risk AI system under the old law?

The old law targeted AI used in consequential decisions, especially in employment, housing, lending, education, insurance, and health care. The key compliance trigger was not the mere use of AI, but the use of a system that materially influences those decisions. [12][7]

What changed with SB 26-189?

Colorado moved from a broad “high-risk AI” regime to a narrower ADMT model centered on consequential decisions and disclosures. The new law also pushes the implementation date to 1 January 2027 and requires rulemaking before full operationalization. [1][2][3]

Were there any 2025–2026 delays before repeal?

Yes. SB 25B-004 moved the principal operative date from 1 February 2026 to 30 June 2026, and SB 26-189 then replaced the entire framework before that delayed date became the practical compliance endpoint. [5][11][1]

What should compliance teams do now?

Treat SB 24-205 as historical background and build for SB 26-189 and its AG rules. The safest path is to inventory consequential-decision use cases, document notices and appeals, and align governance to ISO 27001, NIST CSF 2.0, and ISO 42001. [2][3]

Sources

Put it into practice

More compliance guides