Privacy Law Library

Colorado Artificial Intelligence Act (Consumer Protections for Artificial Intelligence)

Colorado AI Act (SB 24-205)

Artificial intelligence · Employees

Enacted in 2024 as the first comprehensive U.S. state law on algorithmic discrimination, it requires developers and deployers of high-risk AI systems to use reasonable care against algorithmic discrimination, with risk-management programs, impact assessments, consumer notices, correction and appeal rights, and disclosure when consumers interact with AI. The 2025 special session (SB 25B-004) moved its start date from February 1, 2026 to June 30, 2026. SB 26-189 repeals and reenacts Part 17 with a narrower automated decision-making framework effective January 1, 2027, so these duties are in force only for the interim. Enforcement is also on hold: in X.AI LLC v. Weiser (D. Colo. No. 1:26-cv-01515), a court order entered April 27, 2026 on the parties' stipulation bars the Attorney General from starting enforcement, including investigations, of SB 24-205 or legislation replacing it for conduct through 14 days after the court rules on xAI's forthcoming preliminary injunction motion.

Where

Colorado

Citation

C.R.S. 6-1-1701 to 6-1-1707 (as enacted by SB 24-205 and amended by SB 25B-004)

Status

Blocked by a court

In force since

2026-06-30

Last amended

2025-11-25

Enforced by

Colorado Attorney General (exclusive; 6-1-1706)

People can sue

No

Penalties

A violation is a deceptive trade practice under the Colorado Consumer Protection Act (civil penalties up to $20,000 per violation, 6-1-112). Affirmative defense for compliance with a recognized AI risk-management framework plus discovery and cure of violations (6-1-1706).

Applies to

• Developers and deployers doing business in Colorado of high-risk AI systems that make, or are a substantial factor in making, consequential decisions (education, employment, financial or lending, essential government services, health care, housing, insurance, legal services) about Colorado residents (6-1-1701)
• Deployers with fewer than 50 full-time-equivalent employees that do not train the system with their own data are exempt from the risk-management, impact-assessment, and public-statement duties if conditions are met (6-1-1703(6))
• Any person doing business in Colorado that deploys or makes available an AI system intended to interact with consumers (disclosure duty, 6-1-1704)