Crosswalk
Colorado AI Act ↔ EU AI Act
Colorado SB 24-205 is the first US state law directly modeled on the EU AI Act. Both target "high-risk" AI systems that make consequential decisions about consumers (credit, employment, housing, healthcare, education). The Colorado AG has explicitly said EU AI Act documentation may be used to demonstrate reasonable care.
| Colorado AI Act | EU AI Act | Notes |
|---|---|---|
§ 6-1-1701(9) High-risk AI system | Article 6 + Annex III High-risk AI systems | Substantially overlapping — CO adds housing, EU adds law enforcement. |
§ 6-1-1702(3) Risk management program | Article 9 Risk management system | Both continuous, documented. |
§ 6-1-1702(4) Impact assessment | Article 27 FRIA FRIA | CO CDPA analog; both apply pre-deployment and on modification. |
§ 6-1-1703 Deployer notice | Article 26(11) Notice to natural persons | Consumer disclosure. |
§ 6-1-1703(5) Adverse decision appeal | Article 26(11) Right to explanation | Direct analogue. |
§ 6-1-1706 AG enforcement | Article 99 Administrative fines | CO has 60-day cure period; EU has no equivalent cure. |
What to watch
Key differences
- · Colorado penalties = up to $20k/violation (CCPA); EU AI Act = up to €35M / 7% turnover.
- · Colorado covers Colorado consumers only; EU AI Act covers EU market.
- · Colorado has a 60-day cure period; EU has no cure period.
- · Colorado law enforced by AG exclusively; EU AI Act enforced by 27 national authorities + Commission.
- · Colorado does not regulate GPAI models; EU AI Act Chapter V explicitly does.
Primary sources
Where every mapping was verified
Next steps
Turn a crosswalk into an audit-ready posture
Free vendor matchmaking
Need vendors that cover both frameworks?
Get matched with vendors that ship controls, evidence, and mappings across both frameworks on this page.
No credit card. Independent directory — we do not sell software ourselves.