AI compliance checklist

The AI compliance checklist, built from the laws themselves.

Every item below is a duty an enacted state AI law sets out, written in plain English and tied to the section of law it comes from. 1235 items from 326 laws in 50 states, grouped by state and law. Filter to your states and topics, tick items off as you go, and print it for your files.

Read from official legal texts by AI Laws by State Last checked November 15, 2026 How we verify Information, not legal advice

State Topic Clear

74 items for your choices

0 of 74 ticked. Ticks are saved in this browser only.

See it as a dated plan Download as CSV with Pro

Colorado

74 items from 10 laws

Colorado AI in health care utilization review law (HB 26-1139)

HB 26-1139 (2026), Session Laws 2026 ch. 325; adds C.R.S. 10-16-112.7 and 25.5-1-209; effective January 1, 2027. Enforced by: The law does not name one. Checked November 14, 2026.

AI utilization review user: Make sure the AI system bases determinations on the individual's clinical history, circumstances and records, and never solely on group data. Starts January 1, 2027 · Ongoing · Applies when: Using an AI system to conduct utilization review. · C.R.S. 10-16-112.7(3)(a), (3)(b)

AI utilization review user: Make sure the AI system is not used to discriminate unlawfully and is applied fairly and equitably, including under federal HHS regulations and guidance. Starts January 1, 2027 · Ongoing · Applies when: Using an AI system to conduct utilization review. · C.R.S. 10-16-112.7(3)(c), (3)(d)

AI utilization review user: Keep documentation, audit logs and model-governance records that show compliance with this section and C.R.S. 10-3-1104.9. Starts January 1, 2027 · Ongoing · Applies when: Using an AI system to conduct utilization review. · C.R.S. 10-16-112.7(3)(e)

AI utilization review user: Review the AI system's performance, use and outcomes periodically to maximize accuracy and reliability. Starts January 1, 2027 · Ongoing · Applies when: Using an AI system to conduct utilization review. The text sets no review interval. · C.R.S. 10-16-112.7(3)(f)

AI utilization review user: Do not use an individual's health data beyond its intended or stated purpose, and keep the system's criteria consistent with other utilization review and coverage laws. Starts January 1, 2027 · Ongoing · Applies when: Using an AI system to conduct utilization review. · C.R.S. 10-16-112.7(3)(g), (3)(h)

AI utilization review user: Give written disclosures to the regulator identifying the AI's review functions, when it is used, the human oversight process and how audit information is kept. Starts January 1, 2027 · Ongoing · Applies when: Disclosures go to the Division of Insurance, the Department of Human Services or the Department of Health Care Policy and Financing, as applicable. No filing date is stated. · C.R.S. 10-16-112.7(4)

Carrier: Do not deny coverage on medical necessity grounds solely on AI output; a competent licensed clinician, physician or other regulated professional must review and approve the denial. Starts January 1, 2027 · Each time it happens · Applies when: Any denial based in whole or in part on medical necessity. · C.R.S. 10-16-112.7(5)(b)

Carrier: Do not cover psychotherapy services provided directly to an individual and conducted by an AI system. Starts January 1, 2027 · Ongoing · Applies when: Health benefit plans issued or renewed in Colorado on or after the effective date. · C.R.S. 10-16-112.7(6)(a)

Medicaid or CHP+ payer: Do not pay for psychotherapy services provided directly to an individual and conducted by an AI system. Starts January 1, 2027 · Ongoing · Applies when: Mental or behavioral health services under the Colorado Medical Assistance Act or the Children's Basic Health Plan Act. · C.R.S. 25.5-1-209

Colorado AI in psychotherapy law (HB 26-1195)

HB 26-1195 (2026); amends C.R.S. 12-245-224 and adds 12-245-224.5 and 6-1-1705.2; effective August 12, 2026. Enforced by: For psychotherapy providers, a violation is a prohibited activity under the mental health practice act (C.R.S. 12-245-224(1)(y)); the act names no enforcer for C.R.S. 6-1-1705.2.. Checked November 14, 2026.

Psychotherapy provider: Review any outputs of an AI system used for administrative or supplementary support, and remain responsible for them. Starts August 12, 2026 · Ongoing · Applies when: Using AI for tasks such as scheduling, billing, notes or progress tracking that involve no therapeutic communication. · C.R.S. 12-245-224.5(2)

Psychotherapy provider: Before using AI to record or transcribe a therapy session, tell the client in writing that AI will be used and why, and get written consent. Starts August 12, 2026 · Once · Applies when: Consent is needed for the first use on or after the effective date, and again only if the purpose or manner of use materially changes. · C.R.S. 12-245-224.5(4)(a)(I)-(II), (4)(b)

Psychotherapy provider: Do not deny psychotherapy services because a client refuses or revokes consent to AI recording or transcription. When triggered · Each time it happens · Applies when: A client declines or withdraws consent. · C.R.S. 12-245-224.5(4)(a)(III)

Psychotherapy provider: Do not let an AI system engage in therapeutic communication with clients unless the provider takes part in the interaction synchronously, in real time. Starts August 12, 2026 · Ongoing · Applies when: Any client interaction that is therapeutic communication. Reviewing an interaction afterward does not count as synchronous. · C.R.S. 12-245-224.5(5)(a), (1)(e)

Psychotherapy provider: Do not let an AI system generate therapeutic recommendations or treatment plans without the provider's review and approval. Starts August 12, 2026 · Ongoing · Applies when: Any use of AI that produces recommendations or treatment plans. · C.R.S. 12-245-224.5(5)(b)

Psychotherapy provider: Give clients written information about these limits on AI in psychotherapy at the initial client contact. Starts August 12, 2026 · Each time it happens · Applies when: Each new client. · C.R.S. 12-245-224.5(6)(b)

Person offering an AI system: Do not use terms in an AI system's advertising, interface or outputs implying its output comes from, is endorsed by or equals a licensed psychotherapist. Starts August 12, 2026 · Ongoing · Applies when: Any AI system offered or used in Colorado, outside the training, research and wellness-tool exemptions. · C.R.S. 6-1-1705.2(1)(a)

Person offering an AI system: Do not represent that an AI system provides psychotherapy, or that user data is protected like therapist-client confidentiality. Starts August 12, 2026 · Ongoing · Applies when: Any AI system offered or used in Colorado, outside the training, research and wellness-tool exemptions. · C.R.S. 6-1-1705.2(1)(b), (1)(c)

Colorado SB 21-169: insurers' use of external consumer data, algorithms and predictive models

SB 21-169 (2021 Regular Session; Session Laws 2021, ch. 436), signed July 6, 2021; adds C.R.S. 10-3-1104.9. Enforced by: Colorado Commissioner of Insurance, through the Division of Insurance, who may examine and investigate insurers' use of external data, algorithms and predictive models and hold hearings under part 11.. Checked November 14, 2026.

Insurer: Do not unfairly discriminate, in any insurance practice, based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity or gender expression. Starts September 7, 2021 · Ongoing · Applies when: Any insurance practice: marketing, underwriting, pricing, utilization management, reimbursement methodologies and claims management. · C.R.S. 10-3-1104.9(1)(a), (8)(c)

Insurer: Do not use external consumer data and information sources, or algorithms or predictive models that use them, in a way that unfairly discriminates on those bases. When triggered · Ongoing · Applies when: As provided in the commissioner's rules for the insurance type and practice. Rules could not take effect before January 1, 2023. · C.R.S. 10-3-1104.9(1)(b), (3)(a)

Insurer: As rules require: report the external data sources used, explain their use, maintain a risk management framework, assess its results with ongoing monitoring, and file an officer attestation. When triggered · Ongoing · Applies when: Once commissioner rules for the insurance type and practice are in effect. The Division's page lists Amended Regulation 10-1-1 for life, private passenger automobile and health benefit plan insurers, effective October 15, 2025; the regulation's text was not read. · C.R.S. 10-3-1104.9(3)(b)(I)-(V)

Insurer: Cooperate with the commissioner and the Division when they examine or investigate its use of external consumer data, algorithms or predictive models. Starts September 7, 2021 · Ongoing · Applies when: An examination or investigation under C.R.S. 10-3-1106. · C.R.S. 10-3-1104.9(4)

Life, private passenger automobile or health benefit plan insurer: If it uses no external consumer data, or algorithms or models using such data, file an officer-signed attestation saying so through SERFF by December 1 each year. When triggered · Every year · Applies when: The insurer does not use external consumer data and information sources in any insurance practice. Stated on the Division's implementation page for Amended Regulation 10-1-1; the regulation's text was not read. · Colorado Division of Insurance, SB21-169 implementation page (Amended Regulation 10-1-1)

Colorado candidate election deepfake disclosure law (HB 24-1147)

HB 24-1147 (2024 Regular Session; Session Laws 2024, ch. 250), approved May 24, 2024; adds C.R.S. 1-46-101 to 1-46-106 and 1-45-111.5(1.5)(c.5); amends 1-45-111.7(2)(a). Enforced by: Colorado Secretary of State's office, on a written complaint from any person, reviewed and decided through the campaign finance complaint and administrative hearing process; a hearing officer sets the civil penalty. A depicted candidate may also sue in district court. A web search on November 14, 2026 found no report of a court order blocking this law; court dockets were not searched.. Checked November 14, 2026.

Person: Do not distribute or broadcast a communication about a candidate that includes a deepfake, unless it carries the required disclosure statement. Starts July 1, 2024 · Ongoing · Applies when: Within 60 days before a primary or 90 days before a general election, to an audience that includes voters for that office, when the person knows or recklessly disregards that the candidate did not say or do what is shown. · C.R.S. 1-46-103(1), (2)(a)

Person: Make the edited-media disclosure clear and conspicuous: text at least as large as the largest other text; audio read at start, end and set intervals. When triggered · Each time it happens · Applies when: When relying on the disclosure to distribute a covered communication. For audio longer than two minutes the statement repeats at intervals of no more than one minute; it must also meet Secretary of State rules and any FCC requirements. · C.R.S. 1-46-103(2)(b)(I), (II), (V), (VI)

Person: Put the disclosure statement, the identity of the tool used to create the deepfake, and its creation date and time in the metadata; make the disclosure permanent where technically feasible. When triggered · Each time it happens · Applies when: When relying on the disclosure to distribute a covered communication. · C.R.S. 1-46-103(2)(b)(III), (IV)

Colorado facial recognition services law for government agencies (SB 22-113)

SB 22-113 (2022 Regular Session; Session Laws 2022, ch. 463), approved June 8, 2022; adds C.R.S. 24-18-301 to 24-18-309, 22-32-150 and 22-30.5-529, and 2-3-1707; amends 2-3-1701 and 18-5.5-102. Enforced by: The law does not name one. Checked November 15, 2026.

Facial recognition service provider: If independent testing finds material unfair performance differences across subpopulations, develop and implement a plan to mitigate them within 90 days after receiving the results. When triggered · Each time it happens · Applies when: The provider's service is deployed by a Colorado agency and legitimate independent tests show material unfair performance differences. Providers in NIST's ongoing vendor test are exempt. · C.R.S. 24-18-304(2)(b), (4)

Facial recognition service provider: Make available an API or other technical capability, chosen by the provider, for independent testing of accuracy and unfair performance differences; the provider bears the burden of minimizing related risks. Starts August 10, 2022 · Ongoing · Applies when: An agency deploys the provider's service in a decision-making context; the agency must require this. Proprietary data and access enabling cyberattacks need not be disclosed. · C.R.S. 24-18-304(2)(a), (c)

Vendor: Disclose any complaints or reports of bias about your facial recognition service to a Colorado agency procuring it, which must require this disclosure. When triggered · Each time it happens · Applies when: When a Colorado agency procures the service. The act places the duty on the procuring agency to require the disclosure from each vendor. · C.R.S. 24-18-302(6)

Agency: File a notice of intent, prepare an accountability report, hold at least three public meetings, and post the report 90 days before operational use; update it every two years. Starts August 10, 2022 · Ongoing · Applies when: An agency uses or intends to develop, procure or use a facial recognition service. · C.R.S. 24-18-302(1)-(5), (7)

Agency: Subject decisions with legal or similarly significant effects to meaningful human review; test in operational conditions before deploying; train operators periodically; and keep records sufficient for public reporting and auditing. Starts August 10, 2022 · Ongoing · Applies when: An agency uses a facial recognition service to make decisions about individuals. · C.R.S. 24-18-303; 24-18-304(1); 24-18-305; 24-18-306

Law enforcement agency: Do not use facial recognition for ongoing surveillance, real-time identification or persistent tracking without a warrant or other listed basis, or as the sole basis for probable cause. Starts August 10, 2022 · Ongoing · Applies when: Any law enforcement use; exceptions include a warrant, a missing or deceased person court order, and the other listed grounds. Use based on religious, political or social views is barred. · C.R.S. 24-18-307(1), (2), (4)

Agency: Disclose its use of a facial recognition service on a criminal defendant to that defendant in a timely manner before trial. When triggered · Each time it happens · Applies when: The agency used a facial recognition service on a person who becomes a criminal defendant. · C.R.S. 24-18-308(1)

Colorado intimate digital depictions law (SB 25-288)

SB 25-288 (2025 Regular Session; Session Laws 2025, ch. 339), approved June 2, 2025; creates C.R.S. 13-21-1501 to 13-21-1507 and amends C.R.S. 18-6-403, 18-7-107, 18-7-108 and 18-7-109. Enforced by: Civil suits by the depicted individual (or a guardian, family member or estate representative); criminal prosecution under 18-7-107, 18-7-108 and 18-6-403 (the act does not name the prosecutor). A web search on November 15, 2026 found no court order blocking this law.. Checked November 15, 2026.

Person (discloser): Do not disclose, or threaten to disclose, an intimate digital depiction of an identifiable person without their consent. Starts August 6, 2025 · Ongoing · Applies when: The person knew or recklessly disregarded that the individual did not consent, would suffer severe emotional distress, and was identifiable. A disclaimer is not a defense. · C.R.S. 13-21-1503(1), (3)

Person (discloser): Before disclosing an intimate digital depiction on consent, get a knowingly and voluntarily signed plain-language written agreement describing the depiction, its specific use, platforms, availability period and security features. When triggered · Each time it happens · Applies when: Relying on consent. Consent to creation, or an earlier consensual disclosure, does not by itself establish consent to a later disclosure. · C.R.S. 13-21-1503(2)(a)-(c)

Actor: Do not disclose or threaten to disclose a private intimate image or intimate digital depiction online, without consent, to harass, intimidate or coerce, causing harm. Starts August 6, 2025 · Ongoing · Applies when: Actor 18 or older; depicted individual 18 or older; disclosure through electronic media or a website causes physical, emotional or reputational harm. · C.R.S. 18-7-107(1)(a), (2.5)

Actor: Do not disclose or threaten to disclose a private intimate image or intimate digital depiction without consent to obtain money or another pecuniary benefit, including payment for removal. Starts August 6, 2025 · Ongoing · Applies when: Actor 18 or older; also covers disclosure without consent, despite an expectation of privacy, that causes financial harm. · C.R.S. 18-7-108(1)(a)

Person (child sexual exploitation): Treat realistic computer-generated or digitized depictions of an identifiable child in explicit sexual conduct as sexually exploitative material under the child sexual exploitation offense. Starts August 6, 2025 · Ongoing · Applies when: Not knowing the depiction was digitally created is not a defense. · C.R.S. 18-6-403(2)(j)(II), (9), (10)

Colorado school facial recognition law (SB 25-143)

SB 25-143 (2025 Regular Session; Session Laws 2025, ch. 86), approved April 18, 2025; amends C.R.S. 22-32-150 (school districts) and 22-30.5-529 (institute charter schools). Enforced by: Any aggrieved party may seek a restraining order or injunction in district court against the school, a school employee or a school contractor. No government enforcer is named. A web search on November 15, 2026 found no court order blocking this law.. Checked November 15, 2026.

Contractor (school contractor): Do not process a student's, staff member's or other person's biometric identifiers from facial recognition without first getting the required opt-in consent on a stand-alone form. Starts April 18, 2025 · Ongoing · Applies when: Processing biometric identifiers for a Colorado school. Consent may be gathered each school year or before each use. · C.R.S. 22-32-150(2.5)(a)(I)-(III); 22-30.5-529(2.5)(a)

Contractor (school contractor): Do not keep any individual's biometric identifier for longer than eighteen months. Starts April 18, 2025 · Ongoing · Applies when: A school contractor in possession of biometric identifiers. · C.R.S. 22-32-150(2.5)(c); 22-30.5-529(2.5)(c)

Also check: 4 other enacted AI laws in your state are not yet mapped duty by duty: HB1468, HB26-1326, SB24-011, SB25B-004.

Get an email when Colorado AI bills change

We’ll email you when AI bills in Colorado are introduced or change status (at most one alert email a day), plus our weekly digest.

We’ll send a confirmation link first; nothing else is sent until you confirm. Unsubscribe anytime. See past weekly issues. Need alerts for specific bills only? Per-bill alerts come with Pro.

Information, not legal advice. This checklist summarizes what the official texts of the laws listed say. It does not decide whether a law applies to your organization; that turns on facts such as your size, your role as a developer or deployer, and how you use AI. Laws change, and courts and regulators can read them differently. Check the official text linked with each item and talk to a qualified lawyer before acting. Using this page does not create an attorney-client relationship. See our terms of service.

Where the items come from

Each item is one duty from an enacted law, read from the official text on the legislature’s or state’s own website. 265 of the 326 laws have also been read a second time to confirm every date, threshold, penalty and enforcer. Each item names who the duty falls on, when it starts, how often it recurs and the section it comes from, with a link.

Where a law is silent, the checklist says so rather than guessing. A law that is repealed or replaced on a known date shows that end date and drops off afterward. The list is rebuilt from these records every time the page loads.

Want the same duties ordered by start date, with penalties and enforcers side by side? Use the compliance plan builder. For AI in hiring specifically, see the AI hiring compliance checklist. To report an error, use the corrections page.

The AI compliance checklist, built from the laws themselves.

74 items for your choices

Colorado

Colorado AI in health care utilization review law (HB 26-1139)

Colorado AI in psychotherapy law (HB 26-1195)

Colorado Artificial Intelligence Act

Colorado SB 21-169: insurers' use of external consumer data, algorithms and predictive models

Colorado automated decision-making technology law (SB 26-189)

Colorado candidate election deepfake disclosure law (HB 24-1147)

Colorado conversational AI service law (HB 26-1263)

Colorado facial recognition services law for government agencies (SB 22-113)

Colorado intimate digital depictions law (SB 25-288)

Colorado school facial recognition law (SB 25-143)

Where the items come from

Session Expired

The AI compliance checklist, built from the laws themselves.

74 items for your choices

Colorado

Get an email when Colorado AI bills change

Where the items come from