Colorado Artificial Intelligence Act (SB 24-205)
The 2024 Colorado AI Act required developers and deployers of high-risk AI to use reasonable care to avoid algorithmic discrimination. Its effective date was delayed to 30 June 2026 and it was then repealed and replaced by SB 26-189, the Automated Decision-Making Technology Act, effective 1 January 2027.
| Jurisdiction | Colorado |
|---|---|
| Category | AI Regulations |
| Status | Superseded |
| Effective date | |
| Latest development |
Analysis
Key Requirements
The Colorado Artificial Intelligence Act (SB 24-205) imposes several key requirements on developers and deployers of high-risk AI systems:
- Annual Impact Assessments: Organizations must conduct yearly assessments of their high-risk AI systems, evaluating potential risks of algorithmic discrimination and documenting mitigation strategies.
- Transparency Notices: Deployers must provide clear notifications to consumers when high-risk AI systems are used to make consequential decisions affecting them.
- Risk Management Programs: Companies are required to implement and maintain comprehensive risk management policies aligned with standards like the NIST AI Risk Management Framework.
- Incident Reporting: Organizations must notify the Colorado Attorney General within 90 days of discovering instances of algorithmic discrimination.
- Documentation Requirements: Developers must maintain detailed documentation on their AI systems, including data sources, training methods, and known limitations.
Compliance Challenges
Organizations face several challenges in complying with the Colorado AI Act:
- Defining High-Risk AI Systems: Companies struggle to determine which of their AI systems qualify as "high-risk" under the law's broad definition.
- Conducting Thorough Impact Assessments: Many organizations lack the expertise to perform comprehensive algorithmic impact assessments, especially for complex AI systems.
- Implementing Effective Risk Management: Developing and maintaining robust risk management programs that align with evolving AI standards presents ongoing challenges.
- Ensuring Transparency: Providing clear and understandable notifications to consumers about AI use in decision-making processes can be difficult, especially for technical systems.
Implementation Best Practices
To effectively implement the Colorado AI Act requirements:
- Conduct a thorough inventory of AI systems to identify those that qualify as high-risk.
- Establish a cross-functional team to oversee compliance, including legal, IT, and data science experts.
- Implement a standardized impact assessment process using frameworks like the NIST AI Risk Management Framework.
- Develop clear, plain-language templates for consumer notifications about AI use in decision-making.
- Invest in AI governance tools and platforms to streamline documentation and risk management processes.
Recent Updates
As of February 2025, there have been no significant amendments to the Colorado AI Act. Key dates include:
- May 17, 2024: Governor Jared Polis signed SB 24-205 into law
- February 1, 2026: Effective date for compliance with the Act's requirements
The Colorado Attorney General's office is expected to release additional guidance and rules before the effective date.
Related Regulations
The Colorado AI Act intersects with several other regulations:
- EU Artificial Intelligence Act: Many provisions of the Colorado law are similar to the EU's approach, particularly regarding high-risk AI systems.
- California Privacy Rights Act (CPRA): While focused on privacy, the CPRA includes provisions on automated decision-making that overlap with the Colorado AI Act's transparency requirements.
- New York City AI Hiring Law: This law specifically regulates AI use in employment decisions, complementing the Colorado Act's provisions on consequential decisions.
Industry Impact
The Colorado AI Act is expected to have significant impacts across industries:
- Healthcare: AI systems used for diagnosis or treatment recommendations will require rigorous testing and documentation to ensure compliance.
- Financial Services: Banks and lenders using AI for credit decisions will need to implement robust anti-discrimination measures and provide clear explanations to consumers.
- Human Resources: Companies using AI in hiring and promotion decisions will face increased scrutiny and documentation requirements.
- Education: AI systems used for admissions or academic evaluations will need to demonstrate fairness and transparency in their decision-making processes.
Sources
- Colorado General Assembly - SB24-205
- Akin Gump - Colorado Passes New Watershed AI Consumer Protection Bill
- Diligent - The Colorado AI Act: What you need to know now
- IAPP - The Colorado AI Act: What you need to know
- Flaster Greenberg - Understanding Colorado's Landmark AI Legislation
- Reed Smith - Colorado sets baseline for comprehensive AI regulation in U.S.
- Workable - U.S. regulations on hiring with AI: a state-by-state guide
- Frost Brown Todd - Decoding Colorado's Artificial Intelligence Act
- NAAG - A Deep Dive into Colorado's Artificial Intelligence Act
- NIST - AI Risk Management Framework
- FTC - Using Artificial Intelligence and Algorithms
- IBM Watson Studio
- EU Digital Strategy - Regulatory framework on AI
- California Privacy Protection Agency - CPRA Regulations
- NYC Commission on Human Rights - Automated Employment Decision Tools Law
- Nature Digital Medicine - AI in healthcare
- McKinsey - AI-powered decision making for banks
- SHRM - How to Use AI in Hiring Ethically
- Brookings - How Artificial Intelligence Is Transforming Education
Recent developments
- — Colorado Governor signs House Bill 26-1263, the **Chatbot Safety Act**, adding new requirements on conversational AI providers (age estimation, AI disclosure, teen protections, suicide/self-harm protocols) that interact with and complement SB 24-205, effective January 1, 2027[7]. (source)
- — HB 1195, signed June 3, 2026, regulates AI use in psychotherapy and takes effect August 12, 2026, reflecting a shift from SB 24-205’s general framework toward more tailored oversight of AI in sensitive professional contexts.[6] (source)
- — On June 2, 2026, Colorado passed HB 1139 regulating the use of AI in health insurance coverage decisions, signaling targeted sector‑specific regulation that complements and partially supplants the broad approach originally taken by SB 24-205.[6] (source)
- — As part of a broader recalibration of AI regulation following SB 24-205’s replacement, Colorado enacted HB 1263 on chatbot safety on May 29, 2026, establishing future rules for AI chatbots that interact with consumers, with an effective date of January 1, 2027.[6] (source)
- — Colorado enacts Senate Bill 26-189 (signed May 2026), repealing and reenacting SB 24-205’s core automated decision‑making provisions with updated requirements for developers and deployers of ADMT and setting a new effective date of January 1, 2027, reshaping compliance expectations for high‑risk AI users[7]. (source)
- — Colorado Governor Jared Polis signed SB 26-189 on May 14, 2026, repealing and replacing the original Colorado AI Act (SB 24-205) with the narrower Colorado Automated Decision-Making Technology (ADMT) Act, which now takes effect on January 1, 2027.[8][6] (source)
- — Industry commentators report that SB 24-205 is “essentially dead” following its replacement by SB 26-189, noting that the new ADMT Act significantly scales back the original risk‑management, impact assessment, and algorithmic discrimination obligations in favor of a more limited notice-and-transparency framework.[6][8] (source)
- — The Colorado Attorney General’s office confirms that SB 26-189 repeals and reenacts the SB 24-205 provisions with new requirements for automated decision‑making technology in consequential decisions, and states that the new law’s consumer rights and protections will become effective January 1, 2027.[5] (source)
- — Governor Polis signed SB 26-189, repealing the 2024 Colorado AI Act and replacing it with a narrower Automated Decision-Making Technology Act effective 1 January 2027. (source)
- — Colorado legislature passes HB 26-1263, expanding the regulatory framework around AI by imposing safety and transparency obligations on chatbot operators, signaling a broader state push to regulate AI beyond the high‑risk systems covered by SB 24-205[7]. (source)
- — A Colorado magistrate judge issues an order on April 27, 2026, temporarily barring the Attorney General from enforcing SB 24-205 until final AI rulemaking is adopted, raising uncertainty over the law’s rollout and prompting businesses to closely monitor regulatory developments[4]. (source)
- — Legal analysis highlights that SB 24-205 “could be on the chopping block” following the magistrate’s non‑enforcement order and notes that lawmakers are considering SB 26‑189, a bill closely aligned with the Governor’s AI Policy Working Group proposal to revise the existing AI framework[4]. (source)
Read the full guide to Colorado Artificial Intelligence Act (SB 24-205)
Related regulations
- Internet Information Service Algorithmic Recommendation Management Provisions — China, Active
- National Artificial Intelligence Policy Bill — Chile, Active
- Artificial Intelligence Liability Directive — European Union, Active
- Federal Law on the Development and Use of Artificial Intelligence — Mexico, Active
- Presidential Regulation on the Framework for Artificial Intelligence Development — Indonesia, Active
- Law Establishing the Framework for the Development and Use of Artificial Intelligence — Peru, Active
- California Consumer Privacy Act AI Amendments — California, Active, effective 2020-01-01
- GPAI Framework for Responsible AI — AI Regulations, Active
Put it into practice
- Generate the policy: Colorado AI Act policy generator (generatepolicy.com)
- Buy the policy pack: AI Risk Assessment Template (cyberpolicy.shop)
- Build it yourself: AI Risk Register Pack (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates