01The First Comprehensive State AI Law
A national mortgage lender with operations in all 50 states received a wake-up call in early 2025. Their AI-powered underwriting system had been declining applications at slightly higher rates in certain Colorado zip codes. A consumer advocacy group filed a complaint with the Colorado Attorney General, citing patterns consistent with algorithmic discrimination. The lender's compliance team scrambled to respond—but discovered their AI governance framework, built around federal fair lending requirements, hadn't been updated to address Colorado's new impact assessment and disclosure requirements. They had no documented risk management policy specific to the AI system, no completed impact assessment, and no record of the consumer disclosures the law would require. With the February 2026 effective date approaching and an open complaint, they faced the prospect of entering the new regulatory regime already under scrutiny.
This scenario is playing out across industries as organizations assess their exposure to America's first comprehensive state AI law.
The Colorado AI Act (SB 24-205) is the first comprehensive US state law governing AI systems that make consequential decisions. It creates obligations for both developers and deployers of high-risk AI systems affecting Colorado consumers.
In May 2024, Colorado enacted SB 24-205, the Colorado Artificial Intelligence Act. While several states have AI-related legislation, Colorado is the first to create a comprehensive framework governing AI systems that make consequential decisions. The law takes effect February 1, 2026, giving organizations time to prepare—but preparation requires understanding what the law actually requires.
02Who Is Covered
The Colorado AI Act distinguishes between developers and deployers. Developers are persons doing business in Colorado that develop or intentionally and substantially modify AI systems. Deployers are persons doing business in Colorado that deploy high-risk AI systems.
If your organization develops AI systems used by Colorado businesses or deploys AI systems affecting Colorado consumers, you are likely covered.
03What Is a High-Risk AI System
The law applies to high-risk AI systems, defined as AI systems that make or are substantial factors in making consequential decisions.
Consequential decisions include those having material legal or similarly significant effects on consumers regarding education enrollment or opportunity, employment or employment opportunity, financial or lending services, essential government services, healthcare services, housing, insurance, and legal services.
This framework resembles the EU AI Act Annex III categories but is framed around consumer impact rather than domain classification.
04Developer Obligations
Developers of high-risk AI systems must make documentation available to deployers with sufficient information to understand the AI system. This includes intended uses and limitations, types of data used in training, known limitations and risks, and performance metrics and testing results.
Developers must provide risk assessment information giving deployers what they need for impact assessments—how the system was evaluated for bias, known risks of algorithmic discrimination, and recommended monitoring practices.
When developers discover that a high-risk AI system creates substantial risk of algorithmic discrimination, they must disclose the risk to both the Attorney General and known deployers. They must also maintain records of compliance activities available for regulatory review.
05Deployer Obligations
Deployers of high-risk AI systems face more extensive obligations.
Risk Management
Deployers must develop and maintain a risk management policy and program that identifies and documents potential risks of algorithmic discrimination, implements reasonable safeguards against those risks, and reviews and updates policies at least annually.
AI risk management for enterprises provides implementation guidance.
Impact Assessment
Deployers must complete impact assessments for each high-risk AI system covering the system's purpose and intended use, analysis of potential algorithmic discrimination risks, data inputs and processing methods, outputs and their use in decision-making, transparency and human oversight measures, and post-deployment monitoring plans.
Consumer Disclosure
Before a consequential decision is made, deployers must provide consumers with notice that an AI system is being used, a description of what the AI system does, contact information for the deployer, and a statement of appeal rights where applicable.
Human Review
For adverse consequential decisions, deployers must provide consumers the opportunity to appeal, enable review by a natural person where technically feasible, and correct discovered errors resulting from AI use.
Human-in-the-loop compliance details implementation patterns.
Reporting
Deployers must disclose to the Attorney General within 90 days if they discover that a deployed AI system has caused or is likely to cause algorithmic discrimination.
06What Is Algorithmic Discrimination
The law defines algorithmic discrimination as any condition in which use of an AI system results in unlawful differential treatment or impact based on age, color, disability, ethnicity, genetic information, national origin, race, religion, reproductive health, sex (including pregnancy, childbirth, and related conditions), sexual orientation, or veteran status.
This definition aligns with Colorado anti-discrimination law rather than creating new protected categories.
07Safe Harbor and Affirmative Defense
The law provides an affirmative defense to enforcement if deployers can demonstrate they discovered and cured the violation, complied in good faith with applicable industry standards or frameworks, and maintained reasonable compliance policies and programs.
Compliance with recognized frameworks like the NIST AI Risk Management Framework may support this defense.
08Enforcement
The Colorado Attorney General has exclusive enforcement authority. The law does not create a private right of action. However, violations may constitute unfair or deceptive trade practices under the Colorado Consumer Protection Act, which carries additional remedies.
09Key Differences from EU AI Act
Organizations subject to both regimes should note important differences.
On scope, Colorado focuses on consequential consumer decisions while the EU AI Act covers broader categories including public sector uses. On classification, Colorado uses a single high-risk category based on decision type, whereas the EU AI Act has multiple tiers with different requirements. On requirements, Colorado emphasizes algorithmic discrimination prevention while the EU AI Act has broader requirements including documentation, logging, and conformity assessment. On enforcement, Colorado relies on state AG enforcement while the EU AI Act includes conformity assessment and market surveillance.
10Implementation Roadmap
Before February 2026
Developers should inventory AI systems that may be high-risk, develop documentation packages for deployers, establish risk disclosure processes, and create record-keeping procedures.
Deployers should identify high-risk AI systems in use, develop risk management policies, conduct initial impact assessments, design consumer disclosure mechanisms, and establish appeal and review processes.
After Effective Date
Organizations must conduct annual policy reviews and updates, continuous monitoring for algorithmic discrimination, impact assessment updates as systems change, documentation maintenance, and regulatory reporting as required.
11Platform Support for Compliance
AI governance platforms like Veratrace support Colorado AI Act compliance by tracking high-risk AI system inventory and classification, maintaining impact assessment documentation, recording consumer disclosures and appeals, monitoring for bias and discrimination indicators, generating compliance reports for regulatory review, and providing audit trails demonstrating due diligence.
12Conclusion
The Colorado AI Act signals the direction of US state-level AI regulation. Organizations operating in Colorado or serving Colorado consumers should prepare now for the February 2026 effective date.
The requirements are manageable but require intentional implementation. Organizations with mature AI governance practices will find compliance straightforward; those without may need significant preparation.
SOC 2 certification alone is insufficient for Colorado AI Act compliance—purpose-built AI governance capabilities are required.
