Colorado AI Act (SB 24-205) Compliance Checker

Colorado SB 24-205, codified at Colorado Revised Statutes § 6-1-1701 et seq., is the first US comprehensive state AI consumer-protection law. Governor Polis signed it on 17 May 2024. It regulates developers and deployers of high-risk AI systems that make, or are a substantial factor in making, consequential decisions concerning Colorado consumers in eight enumerated categories: employment, education, financial or lending services, essential government services, healthcare services, housing, insurance, and legal services.

The Act becomes enforceable on 1 February 2026. Governor Polis has publicly stated that the effective date may be delayed by future amendments, but until any amendment is enacted the 1 February 2026 date is the legal baseline. Rulemaking by the Colorado Attorney General under § 6-1-1707 may add specificity before the effective date.

A developer, defined in § 6-1-1701(7), is a person doing business in Colorado that develops, or intentionally and substantially modifies, a high-risk AI system. A deployer, defined in § 6-1-1701(8), is a person doing business in Colorado that deploys a high-risk AI system. The same organization can be both for different systems. Developer duties sit in § 6-1-1702; deployer duties in § 6-1-1703.

Under § 6-1-1701(3), a consequential decision is a decision that has a material legal or similarly significant effect on the provision or denial to any consumer of, or the cost or terms of, education enrollment or opportunity, employment or employment opportunity, financial or lending services, essential government services, healthcare services, housing, insurance, or a legal service. Marketing, entertainment, and non-consumer-facing back-office AI is not consequential.

Under § 6-1-1701(11), an AI system is a substantial factor in a consequential decision if it (a) assists in making the decision, (b) is capable of altering the outcome of the decision, and (c) is used to generate content, decisions, predictions, or recommendations that serve as a principal basis for the decision. Human reviewers rubber-stamping AI output does not remove the substantial-factor status.

Under § 6-1-1703(6), a deployer with fewer than 50 full-time employees that (a) does not use its own data to train the high-risk AI system, (b) uses the system for its intended uses as disclosed by the developer, and (c) makes any developer-provided impact assessment available to consumers, is exempt from the § 6-1-1703(2) risk-management-policy duty and the § 6-1-1703(3) impact-assessment duty. The small-business deployer still owes all consumer-notice, appeal, public-statement, and Attorney General reporting duties.

Violations of the Colorado AI Act are treated as unfair or deceptive trade practices under the Colorado Consumer Protection Act. Under § 6-1-112 the AG can seek civil penalties of up to $20,000 per violation. Each affected consumer can constitute a separate violation. Enforcement is exclusive to the Colorado Attorney General under § 6-1-1706 — there is no private right of action. § 6-1-1706(3) provides an affirmative defense where the developer or deployer discovers the violation through required feedback, adversarial testing, or internal review, cures the violation, and is otherwise in compliance with a nationally or internationally recognized AI risk management framework such as NIST AI RMF or ISO/IEC 42001.

Both regulate high-risk AI, but the Colorado Act is narrower and consumer-focused. The EU AI Act (Regulation (EU) 2024/1689) has four risk tiers, applies extraterritorially to any AI placed on the EU market, imposes conformity assessments, requires CE marking for high-risk systems, and can fine up to €35M or 7% of global turnover. The Colorado Act has effectively two tiers (high-risk vs. everything else), applies only to persons doing business in Colorado, requires impact assessments and consumer notices, and caps penalties at $20,000 per violation. Many organizations that comply with the EU AI Act will find Colorado compliance is a lighter lift built on the same evidence.

The impact assessment required by § 6-1-1703(3) must include: (1) a statement of the purpose, intended use cases, and deployment context of the high-risk AI system; (2) the categories of data the system processes and the categories of outputs the system produces; (3) an analysis of whether the deployment of the system poses any known or reasonably foreseeable risks of algorithmic discrimination and, if so, the nature of that discrimination and the steps taken to mitigate it; (4) an overview of the categories of data processed as inputs and outputs; (5) any metrics used to evaluate the performance and known limitations of the system; (6) a description of the transparency measures taken; and (7) a description of the post-deployment monitoring and user safeguards provided.

No. This is a self-service preliminary check based on the plain text of SB 24-205 as codified at C.R.S. § 6-1-1701 et seq. The output is a defensible first-pass classification suitable for internal triage, vendor scoping, and budget planning. Rules promulgated by the Colorado Attorney General under § 6-1-1707 may add specificity before the 1 February 2026 effective date. Treat the checker output as a structured starting point for counsel, not a substitute for it.