Colorado AI Act Takes Effect: Impact Assessments, Consumer Notices and the Attorney General's Rules Explained

DENVER — The Colorado Artificial Intelligence Act is in force, the first state law in the country to regulate how artificial intelligence is used to decide who gets a job, a loan, an apartment, an insurance policy or a place in a program. It took effect on June 30 after a one-year delay, and the attorney general's rules implementing it were finalized last month. For the companies that build and use the systems it covers, the first set of annual impact assessments is due within weeks, and the question that has occupied compliance teams all year — what does the attorney general actually want in them — now has an answer.

"This law does not tell anyone they cannot use AI to make decisions. It tells them to know what the system does to people before they do," the attorney general said at a press briefing on the rules.

How the law got here

Senate Bill 24-205 was signed in May 2024 with an original effective date of February 1, 2026, and with a signing statement from the governor inviting the legislature to narrow it. Two sessions of negotiation among industry, civil rights groups and the sponsors produced no agreement, and in an August 2025 special session the legislature instead delayed the effective date to June 30, 2026. A further attempt to amend the law in the 2026 regular session added a small-business clarification and left the structure intact. Meanwhile the federal government moved against it: a proposed ten-year moratorium on state AI laws was stripped from federal tax legislation by a near-unanimous Senate vote in July 2025, and an executive order in late 2025 directed the Justice Department to challenge state AI laws it considered burdensome, with Colorado's the obvious target. No suit has been filed.

Who is covered

Term	Definition	Examples
High-risk AI system	A system that makes, or is a substantial factor in making, a consequential decision	Résumé screening tools; credit underwriting models; tenant screening; insurance pricing; clinical triage; benefits eligibility
Consequential decision	A decision with a material legal or similarly significant effect on access to, cost of or terms of education, employment, financial or lending services, essential government services, health care, housing, insurance or legal services	Hiring, promotion, termination; loan approval and pricing; lease approval; coverage decisions
Developer	Doing business in Colorado and developing or intentionally and substantially modifying a high-risk system	Vendors of hiring, lending and insurance models; companies that fine-tune a model for their own use
Deployer	Doing business in Colorado and using a high-risk system to make a consequential decision	Employers, lenders, landlords, insurers, hospitals, agencies
Exempt	Narrow-purpose tools (spam filters, calculators, spell-checkers), systems already regulated under equivalent federal frameworks, and deployers under 50 employees that do not train on their own data and rely on the developer's assessment	—

What developers must do

• Document for deployers. Provide a statement of the system's intended uses and known harmful or inappropriate uses, summaries of training data, known limitations and risks of algorithmic discrimination, performance evaluation results, and the information a deployer needs to complete its own impact assessment.
• Publish. Maintain a public statement summarizing the high-risk systems the developer offers and how it manages discrimination risk.
• Report. Notify the attorney general and known deployers within ninety days of discovering, or receiving a credible report, that a system has caused or is reasonably likely to have caused algorithmic discrimination.

What deployers must do

• Risk management program. An iterative, documented program governing the system's use, reasonable in light of the NIST AI Risk Management Framework, ISO/IEC 42001 or an equivalent, scaled to the deployer's size and the system's risk.
• Impact assessment. Before deployment, annually, and within ninety days of a substantial modification, covering purpose and use, discrimination risk and mitigation, data and outputs, performance metrics and limitations, transparency measures and post-deployment monitoring. Retained for three years; produced to the attorney general on request.
• Notice before the decision. Tell the consumer that a high-risk system is being used, what it is for, the type of decision, and how to contact the deployer; link to the deployer's public statement and, where applicable, to opt-out rights under the Colorado Privacy Act.
• After an adverse decision. Give the principal reasons, including the degree to which the system contributed, the data it used and its source; an opportunity to correct the data; and an opportunity to appeal for human review where technically feasible.
• Publish and report. A public statement about the high-risk systems in use, and notice to the attorney general within ninety days of discovering algorithmic discrimination.

What the attorney general's rules add

The rules finalized in September do three things the statute left open. They prescribe a format for impact assessments — a template the attorney general says will be the basis of his office's review, with sections corresponding to each statutory element and a requirement to identify the individuals who approved it. They specify the content and timing of consumer notices, including a requirement that the pre-decision notice be delivered before the consumer's data is processed by the system rather than at the point of decision. And they identify the frameworks that satisfy the risk management requirement, naming the NIST framework and ISO 42001 and reserving the power to designate others. The rules also adopt the statute's safe harbor: a deployer that uses a developer's assessment and follows its documented intended uses is presumed to have exercised reasonable care as to the system's design.

This law does not tell anyone they cannot use AI to make decisions. It tells them to know what the system does to people before they do.

Colorado attorney general, at a press briefing

Enforcement and defenses

Only the attorney general may enforce the Act; it creates no private right of action, and a violation is deemed an unfair trade practice under the Colorado Consumer Protection Act, with civil penalties of up to $20,000 per violation. Two protections soften the exposure. A rebuttable presumption of reasonable care arises from compliance with the documentation, assessment and notice requirements. An affirmative defense is available to a developer or deployer that discovers and cures a violation through internal testing, red-teaming or user feedback and that maintains a risk management program meeting a designated framework. The attorney general has said his office's first year will focus on whether covered companies have assessments and programs at all, not on second-guessing their conclusions.

How it fits with other law

• Colorado Privacy Act. Its profiling opt-out and data protection assessment overlap with the AI Act's notice and impact assessment; the rules allow a single document to satisfy both where the content matches.
• Employment law. New York City's automated employment decision tool law requires bias audits for hiring tools; Illinois amended its Human Rights Act, effective January 2026, to bar discriminatory use of AI in employment and require notice. Colorado's Act applies to all eight sectors, not employment alone.
• Federal law. Existing anti-discrimination statutes — Title VII, the Fair Housing Act, the Equal Credit Opportunity Act — already reach discriminatory outcomes; the Act adds process. The federal preemption threat has not materialized in a filed case; see The Counsel's report on the Supreme Court argument over the FTC's own authority over AI for the federal side of the picture.
• Other states. California's regulations on automated decision-making under its privacy law, and Texas's narrower AI statute, cover parts of the same ground; Colorado's remains the broadest.

A checklist for the first assessment cycle

1. Inventory every system used in the eight sectors and decide, with documentation, which are high-risk.
2. Obtain the developer documentation for each, and chase vendors that have not provided it; the statute obliges them.
3. Adopt a risk management framework and record the adoption.
4. Complete impact assessments on the attorney general's template, with sign-off.
5. Rebuild consumer notices to deliver before processing, and adverse-decision notices with reasons, correction and appeal.
6. Publish the public statement and stand up the ninety-day reporting process.
7. Confirm the small-deployer exemption's conditions if relying on it.

The Counsel will report the attorney general's first enforcement actions and any federal challenge. Deployers unsure whether a tool is a "substantial factor" in a decision should document the analysis either way; the presumption of reasonable care depends on the paper trail.