Colorado Signs Artificial Intelligence Act into Law

On May 17, Colorado Governor Jared Polis signed into law the Colorado Artificial Intelligence Act (SB 205), making the state the first to enact a comprehensive legislative framework to regulate artificial intelligence (AI) tools. Developers have until February 1, 2026, to comply with most provisions of the law. 

Who Is Covered by the Law?

The law covers “developers” and “deployers” of “high risk artificial intelligence systems” who are doing business in Colorado. Notably, these terms are not necessarily limited to companies headquartered in Colorado, but could encompass companies, wherever located, that interact with Colorado residents or contract with Colorado entities.

The law defines a high-risk AI system as “any artificial intelligence system that, when deployed, makes, or is a substantial factor in making a consequential decision.” A “consequential decision” is defined as “a decision that has a material legal or similarly significant effect on the provision or denial to any consumer of, or the cost or terms of: (a) education enrollment or an education opportunity; (b) employment or an employment opportunity; (c) a financial or lending service; (d) an essential government service; (e) health-care services; (f) housing; (g) insurance; or (h) a legal service.”

The law exempts deployers from certain requirements provided that the deployer has fewer than 50 full-time equivalent employees, does not use its own data to train the system, uses the system only for the uses specified by the system developer, and makes certain information from the developer available to consumers. It also exempts certain banks and insurers who are subject to other industry-specific regulations.

What Does the Bill Require?

• The bill imposes a duty of reasonable care on developers and deployers of high-risk AI systems to protect consumers from known or reasonably foreseeable risks of “algorithmic discrimination,” which is defined as any condition in which the use of an AI system results in an unlawful differential treatment or impact that disfavors a member of a protected class. The bill creates a rebuttable presumption of reasonable care, provided regulated businesses disclose certain information about their high-risk systems, including a high-level summary of their training data and steps taken to mitigate risks of harm.
• By February 1, 2026, developers and deployers will need to post statements on their websites about the types of high-risk AI systems they develop or deploy, the steps they have taken to manage risks of algorithmic discrimination, and update those statements as necessary to ensure they remain accurate.
• Developers and deployers are required to notify the Colorado Attorney General and deployers of their AI tools no later than 90 days after discovering that their systems have caused or are reasonably likely to cause algorithmic discrimination or after receiving a credible report that their system has caused algorithmic discrimination. 
• Deployers of AI systems are required to implement “reasonable” risk management policies governing the deployment of high-risk AI systems, which must be systematically reviewed and updated.
• Deployers of high-risk AI systems must also conduct annual “impact assessments” of their deployed high-risk AI systems, covering topics including the purpose and intended uses of the system, known risks, and risk mitigations.
• For high-risk AI systems used to make a “consequential decision concerning a consumer,” deployers of those systems must (1) notify the consumer of the use of the AI system before the decision is made, (2) disclose to the consumer information such as the purpose of the system, and (3) provide information, if applicable, about the consumers’ right to opt out. If the AI system plays a role in making a consequential decision that is adverse to the consumer, the deployer must disclose the principal reasons for that decision.

Penalties and Enforcement

The state Attorney General is granted exclusive authority to enforce the law under the state’s unfair trade practices statute, Colo. Rev. Stat. § 6-1-105. The Attorney General can seek injunctive relief and civil penalties. The law does not allow for class actions or authorize private rights of action.

In any action by the Attorney General, it is an affirmative defense against liability if the developer or deployer discovers and cures any violations and is otherwise in compliance with the National Institute of Standards and Technology’s Artificial Intelligence Risk Management Framework, another nationally or internationally recognized risk management framework for AI, or a risk management framework designated by the Attorney General.