Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

Colorado · AI compliance plan

What Colorado’s AI laws require of you.

Colorado has 14 enacted AI laws in our records. We have mapped 10 of them duty by duty: 74 duties in all, each with who it falls on, when it starts and the section of law it comes from. The next one starts January 1, 2027.

Read from official legal texts by AI Laws by State Last checked November 15, 2026 How we verify Information, not legal advice
Change states or topics

Build a plan

Where you do business
Topics that matter to you (leave blank for all)
Numbers show how many mapped laws each choice includes. No sign-up needed to see the plan.

The plan at a glance

74duties from 10 laws
25start in the next 90 days; the next on January 1, 2027
3laws let people sue over a violation
1law gives a set number of days to fix a violation before enforcement
Download CSV and calendar with Pro Open as a checklist

Pro turns this plan into a spreadsheet for audit files and a calendar of every start date. The plan on this page stays open to everyone.

Already in effect 29 duties

These duties are in force today.

StartsLawWhoWhat it requiresHow oftenSource
September 7, 2021 Colorado SB 21-169: insurers' use of external consumer data, algorithms and predictive models Insurer Do not unfairly discriminate, in any insurance practice, based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity or gender expression.Applies when: Any insurance practice: marketing, underwriting, pricing, utilization management, reimbursement methodologies and claims management. Ongoing C.R.S. 10-3-1104.9(1)(a), (8)(c)
September 7, 2021 Colorado SB 21-169: insurers' use of external consumer data, algorithms and predictive models Insurer Cooperate with the commissioner and the Division when they examine or investigate its use of external consumer data, algorithms or predictive models.Applies when: An examination or investigation under C.R.S. 10-3-1106. Ongoing C.R.S. 10-3-1104.9(4)
August 10, 2022 Colorado facial recognition services law for government agencies (SB 22-113) Facial recognition service provider Make available an API or other technical capability, chosen by the provider, for independent testing of accuracy and unfair performance differences; the provider bears the burden of minimizing related risks.Applies when: An agency deploys the provider's service in a decision-making context; the agency must require this. Proprietary data and access enabling cyberattacks need not be disclosed. Ongoing C.R.S. 24-18-304(2)(a), (c)
August 10, 2022 Colorado facial recognition services law for government agencies (SB 22-113) Agency File a notice of intent, prepare an accountability report, hold at least three public meetings, and post the report 90 days before operational use; update it every two years.Applies when: An agency uses or intends to develop, procure or use a facial recognition service. Ongoing C.R.S. 24-18-302(1)-(5), (7)
August 10, 2022 Colorado facial recognition services law for government agencies (SB 22-113) Agency Subject decisions with legal or similarly significant effects to meaningful human review; test in operational conditions before deploying; train operators periodically; and keep records sufficient for public reporting and auditing.Applies when: An agency uses a facial recognition service to make decisions about individuals. Ongoing C.R.S. 24-18-303; 24-18-304(1); 24-18-305; 24-18-306
August 10, 2022 Colorado facial recognition services law for government agencies (SB 22-113) Law enforcement agency Do not use facial recognition for ongoing surveillance, real-time identification or persistent tracking without a warrant or other listed basis, or as the sole basis for probable cause.Applies when: Any law enforcement use; exceptions include a warrant, a missing or deceased person court order, and the other listed grounds. Use based on religious, political or social views is barred. Ongoing C.R.S. 24-18-307(1), (2), (4)
July 1, 2024 Colorado candidate election deepfake disclosure law (HB 24-1147) Person Do not distribute or broadcast a communication about a candidate that includes a deepfake, unless it carries the required disclosure statement.Applies when: Within 60 days before a primary or 90 days before a general election, to an audience that includes voters for that office, when the person knows or recklessly disregards that the candidate did not say or do what is shown. Ongoing C.R.S. 1-46-103(1), (2)(a)
April 18, 2025 Colorado school facial recognition law (SB 25-143) Contractor (school contractor) Do not process a student's, staff member's or other person's biometric identifiers from facial recognition without first getting the required opt-in consent on a stand-alone form.Applies when: Processing biometric identifiers for a Colorado school. Consent may be gathered each school year or before each use. Ongoing C.R.S. 22-32-150(2.5)(a)(I)-(III); 22-30.5-529(2.5)(a)
April 18, 2025 Colorado school facial recognition law (SB 25-143) Contractor (school contractor) Do not keep any individual's biometric identifier for longer than eighteen months.Applies when: A school contractor in possession of biometric identifiers. Ongoing C.R.S. 22-32-150(2.5)(c); 22-30.5-529(2.5)(c)
August 6, 2025 Colorado intimate digital depictions law (SB 25-288) Person (discloser) Do not disclose, or threaten to disclose, an intimate digital depiction of an identifiable person without their consent.Applies when: The person knew or recklessly disregarded that the individual did not consent, would suffer severe emotional distress, and was identifiable. A disclaimer is not a defense. Ongoing C.R.S. 13-21-1503(1), (3)
August 6, 2025 Colorado intimate digital depictions law (SB 25-288) Actor Do not disclose or threaten to disclose a private intimate image or intimate digital depiction online, without consent, to harass, intimidate or coerce, causing harm.Applies when: Actor 18 or older; depicted individual 18 or older; disclosure through electronic media or a website causes physical, emotional or reputational harm. Ongoing C.R.S. 18-7-107(1)(a), (2.5)
August 6, 2025 Colorado intimate digital depictions law (SB 25-288) Actor Do not disclose or threaten to disclose a private intimate image or intimate digital depiction without consent to obtain money or another pecuniary benefit, including payment for removal.Applies when: Actor 18 or older; also covers disclosure without consent, despite an expectation of privacy, that causes financial harm. Ongoing C.R.S. 18-7-108(1)(a)
August 6, 2025 Colorado intimate digital depictions law (SB 25-288) Person (child sexual exploitation) Treat realistic computer-generated or digitized depictions of an identifiable child in explicit sexual conduct as sexually exploitative material under the child sexual exploitation offense.Applies when: Not knowing the depiction was digitally created is not a defense. Ongoing C.R.S. 18-6-403(2)(j)(II), (9), (10)
June 30, 2026 Colorado Artificial Intelligence ActEnds December 31, 2026 Developer Use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination from intended and contracted uses of a high-risk AI system.Applies when: Developer of a high-risk AI system, on and after June 30, 2026. Ongoing C.R.S. 6-1-1702(1), as amended by SB 25B-004 § 1
June 30, 2026 Colorado Artificial Intelligence ActEnds December 31, 2026 Developer Post a public statement summarizing the types of high-risk AI systems it offers and how it manages algorithmic discrimination risks; update within 90 days of an intentional and substantial modification.Applies when: Developer of a high-risk AI system, on and after June 30, 2026. Ongoing C.R.S. 6-1-1702(4)
June 30, 2026 Colorado Artificial Intelligence ActEnds December 31, 2026 Deployer Use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination.Applies when: Deployer of a high-risk AI system, on and after June 30, 2026. Ongoing C.R.S. 6-1-1703(1), as amended by SB 25B-004 § 2
June 30, 2026 Colorado Artificial Intelligence ActEnds December 31, 2026 Deployer Implement a risk management policy and program for high-risk AI systems, reasonable in light of the NIST AI Risk Management Framework, ISO/IEC 42001 or an equivalent framework, and reviewed regularly.Applies when: Deployer of a high-risk AI system, on and after June 30, 2026, unless the small-deployer exemption in 6-1-1703(6) applies. Ongoing C.R.S. 6-1-1703(2)
June 30, 2026 Colorado Artificial Intelligence ActEnds December 31, 2026 Deployer Complete an impact assessment for each high-risk AI system deployed on or after June 30, 2026, then annually and within 90 days of a substantial modification; keep records three years.Applies when: Deployer of a high-risk AI system deployed on or after June 30, 2026, unless the small-deployer exemption applies. Every year C.R.S. 6-1-1703(3)(a)(I), (3)(a)(II), (3)(f)
June 30, 2026 Colorado Artificial Intelligence ActEnds December 31, 2026 Deployer Review each deployed high-risk AI system at least annually to confirm it is not causing algorithmic discrimination.Applies when: Deployer of a high-risk AI system, on and after June 30, 2026, unless the small-deployer exemption applies. Every year C.R.S. 6-1-1703(3)(g)
June 30, 2026 Colorado Artificial Intelligence ActEnds December 31, 2026 Deployer Post a public statement summarizing the high-risk AI systems deployed, how algorithmic discrimination risks are managed, and the nature, source and extent of information collected and used; update periodically.Applies when: Deployer of a high-risk AI system, on and after June 30, 2026, unless the small-deployer exemption applies. Ongoing C.R.S. 6-1-1703(5)
June 30, 2026 Colorado Artificial Intelligence ActEnds December 31, 2026 Deployer or developer Tell each consumer who interacts with an AI system intended for consumer interaction that it is an AI system, unless that would be obvious to a reasonable person.Applies when: Any AI system intended to interact with consumers, on and after June 30, 2026. Ongoing C.R.S. 6-1-1704(1), (2), as amended by SB 25B-004 § 3
August 12, 2026 Colorado AI in psychotherapy law (HB 26-1195) Psychotherapy provider Review any outputs of an AI system used for administrative or supplementary support, and remain responsible for them.Applies when: Using AI for tasks such as scheduling, billing, notes or progress tracking that involve no therapeutic communication. Ongoing C.R.S. 12-245-224.5(2)
August 12, 2026 Colorado AI in psychotherapy law (HB 26-1195) Psychotherapy provider Before using AI to record or transcribe a therapy session, tell the client in writing that AI will be used and why, and get written consent.Applies when: Consent is needed for the first use on or after the effective date, and again only if the purpose or manner of use materially changes. Once C.R.S. 12-245-224.5(4)(a)(I)-(II), (4)(b)
August 12, 2026 Colorado AI in psychotherapy law (HB 26-1195) Psychotherapy provider Do not let an AI system engage in therapeutic communication with clients unless the provider takes part in the interaction synchronously, in real time.Applies when: Any client interaction that is therapeutic communication. Reviewing an interaction afterward does not count as synchronous. Ongoing C.R.S. 12-245-224.5(5)(a), (1)(e)
August 12, 2026 Colorado AI in psychotherapy law (HB 26-1195) Psychotherapy provider Do not let an AI system generate therapeutic recommendations or treatment plans without the provider's review and approval.Applies when: Any use of AI that produces recommendations or treatment plans. Ongoing C.R.S. 12-245-224.5(5)(b)
August 12, 2026 Colorado AI in psychotherapy law (HB 26-1195) Psychotherapy provider Give clients written information about these limits on AI in psychotherapy at the initial client contact.Applies when: Each new client. Each time it happens C.R.S. 12-245-224.5(6)(b)
August 12, 2026 Colorado AI in psychotherapy law (HB 26-1195) Person offering an AI system Do not use terms in an AI system's advertising, interface or outputs implying its output comes from, is endorsed by or equals a licensed psychotherapist.Applies when: Any AI system offered or used in Colorado, outside the training, research and wellness-tool exemptions. Ongoing C.R.S. 6-1-1705.2(1)(a)
August 12, 2026 Colorado AI in psychotherapy law (HB 26-1195) Person offering an AI system Do not represent that an AI system provides psychotherapy, or that user data is protected like therapist-client confidentiality.Applies when: Any AI system offered or used in Colorado, outside the training, research and wellness-tool exemptions. Ongoing C.R.S. 6-1-1705.2(1)(b), (1)(c)
August 12, 2026 Colorado conversational AI service law (HB 26-1263) Operator Use commercially reasonable or generally accepted methods to estimate the age of account holders and users, and do not willfully disregard clear and convincing information that one is a minor.Applies when: Applies to every operator of a conversational AI service. Ongoing C.R.S. 6-1-1708(2) (HB 26-1263 § 2)

Starting in the next 90 days 25 duties

Time to prepare is short for these.

StartsLawWhoWhat it requiresHow oftenSource
January 1, 2027 Colorado AI in health care utilization review law (HB 26-1139) AI utilization review user Make sure the AI system bases determinations on the individual's clinical history, circumstances and records, and never solely on group data.Applies when: Using an AI system to conduct utilization review. Ongoing C.R.S. 10-16-112.7(3)(a), (3)(b)
January 1, 2027 Colorado AI in health care utilization review law (HB 26-1139) AI utilization review user Make sure the AI system is not used to discriminate unlawfully and is applied fairly and equitably, including under federal HHS regulations and guidance.Applies when: Using an AI system to conduct utilization review. Ongoing C.R.S. 10-16-112.7(3)(c), (3)(d)
January 1, 2027 Colorado AI in health care utilization review law (HB 26-1139) AI utilization review user Keep documentation, audit logs and model-governance records that show compliance with this section and C.R.S. 10-3-1104.9.Applies when: Using an AI system to conduct utilization review. Ongoing C.R.S. 10-16-112.7(3)(e)
January 1, 2027 Colorado AI in health care utilization review law (HB 26-1139) AI utilization review user Review the AI system's performance, use and outcomes periodically to maximize accuracy and reliability.Applies when: Using an AI system to conduct utilization review. The text sets no review interval. Ongoing C.R.S. 10-16-112.7(3)(f)
January 1, 2027 Colorado AI in health care utilization review law (HB 26-1139) AI utilization review user Do not use an individual's health data beyond its intended or stated purpose, and keep the system's criteria consistent with other utilization review and coverage laws.Applies when: Using an AI system to conduct utilization review. Ongoing C.R.S. 10-16-112.7(3)(g), (3)(h)
January 1, 2027 Colorado AI in health care utilization review law (HB 26-1139) AI utilization review user Give written disclosures to the regulator identifying the AI's review functions, when it is used, the human oversight process and how audit information is kept.Applies when: Disclosures go to the Division of Insurance, the Department of Human Services or the Department of Health Care Policy and Financing, as applicable. No filing date is stated. Ongoing C.R.S. 10-16-112.7(4)
January 1, 2027 Colorado AI in health care utilization review law (HB 26-1139) Carrier Do not deny coverage on medical necessity grounds solely on AI output; a competent licensed clinician, physician or other regulated professional must review and approve the denial.Applies when: Any denial based in whole or in part on medical necessity. Each time it happens C.R.S. 10-16-112.7(5)(b)
January 1, 2027 Colorado AI in health care utilization review law (HB 26-1139) Carrier Do not cover psychotherapy services provided directly to an individual and conducted by an AI system.Applies when: Health benefit plans issued or renewed in Colorado on or after the effective date. Ongoing C.R.S. 10-16-112.7(6)(a)
January 1, 2027 Colorado AI in health care utilization review law (HB 26-1139) Medicaid or CHP+ payer Do not pay for psychotherapy services provided directly to an individual and conducted by an AI system.Applies when: Mental or behavioral health services under the Colorado Medical Assistance Act or the Children's Basic Health Plan Act. Ongoing C.R.S. 25.5-1-209
January 1, 2027 Colorado automated decision-making technology law (SB 26-189) Developer Give each deployer documentation: intended and known harmful uses, categories of training data, known limitations, instructions for use, monitoring and human review, and information the deployer needs for its disclosures.Applies when: A covered ADMT marketed, configured, contracted, sold or licensed to materially influence a consequential decision. The deployer must be told if information is withheld. Ongoing C.R.S. 6-1-1702(1), (3), (5)
January 1, 2027 Colorado automated decision-making technology law (SB 26-189) Developer Keep records needed to show compliance, including version identifiers, changelogs and update notices, for at least three years after each record is created.Applies when: Records required or created under the developer section; longer if other law requires. Ongoing C.R.S. 6-1-1702(4)
January 1, 2027 Colorado automated decision-making technology law (SB 26-189) Deployer Before using a covered ADMT in a consequential decision, give the consumer clear and conspicuous notice of that use and instructions for getting more information.Applies when: Any consequential decision materially influenced by a covered ADMT. A prominent public notice reasonably accessible at the point of interaction satisfies this. Ongoing C.R.S. 6-1-1704(1), (2)
January 1, 2027 Colorado automated decision-making technology law (SB 26-189) Deployer Keep records needed to show compliance for at least three years after the date of each consequential decision.Applies when: Every consequential decision; longer if other law requires. Ongoing C.R.S. 6-1-1703
January 1, 2027 Colorado automated decision-making technology law (SB 26-189) Deployer or developer Provide required notices and disclosures in a manner reasonably accessible to consumers with disabilities and consumers with limited English proficiency.Applies when: All notices and disclosures under the part. Ongoing C.R.S. 6-1-1704(8)
January 1, 2027 Colorado automated decision-making technology law (SB 26-189) HIPAA covered entity Give patients a general notice of its use of advanced technologies, including covered ADMT; give specific disclosures when a covered ADMT decides eligibility for financial assistance.Applies when: Financial-assistance disclosures may be given in advance or within 30 calendar days after an adverse outcome. Ongoing C.R.S. 6-1-1708(3)(c)-(e)
January 1, 2027 Colorado automated decision-making technology law (SB 26-189) Developer or deployer Contract terms that indemnify a developer or deployer for its own discriminatory use of ADMT are void; do not rely on them.Applies when: Contracts between developers and deployers for ADMT used in consequential decisions; exception where the use was not intended by a compliant developer. Ongoing C.R.S. 6-1-1707(7)
January 1, 2027 Colorado conversational AI service law (HB 26-1263) Operator Clearly tell a known minor they are talking to AI, not a human: persistent on-screen, intermittent audio, or at each session start and every three hours.Applies when: The operator knows the account holder or user is a minor (an age estimate counts as knowledge). The disclosure must also answer the minor's questions about whether it is human. Ongoing C.R.S. 6-1-1708(2)(a)
January 1, 2027 Colorado conversational AI service law (HB 26-1263) Operator Do not give known minors points or similar rewards at unpredictable intervals meant to increase engagement.Applies when: The operator knows the account holder or user is a minor (an age estimate counts as knowledge). Ongoing C.R.S. 6-1-1708(2)(b)
January 1, 2027 Colorado conversational AI service law (HB 26-1263) Operator Use technically feasible measures to stop the service producing sexual content or intimate digital depictions for known minors, urging them toward sexual conduct, or engaging them in erotic interactions.Applies when: The operator knows the account holder or user is a minor (an age estimate counts as knowledge). Ongoing C.R.S. 6-1-1708(2)(c)
January 1, 2027 Colorado conversational AI service law (HB 26-1263) Operator Use reasonable measures to stop responses that simulate emotional dependence or isolation, including claims of being human or sentient, romantic companionship, or adult-minor romantic role-play.Applies when: The operator knows the account holder or user is a minor (an age estimate counts as knowledge). Ongoing C.R.S. 6-1-1708(2)(d)
January 1, 2027 Colorado conversational AI service law (HB 26-1263) Operator Implement protocols that bar the service from explicit sexual conduct with a minor and make it stop engaging when prompted about such conduct.Applies when: The operator knows the account holder or user is a minor (an age estimate counts as knowledge). Ongoing C.R.S. 6-1-1708(2)(e), (f)
January 1, 2027 Colorado conversational AI service law (HB 26-1263) Operator Give known minors, and their parents or guardians, tools to manage privacy and account settings, including memory of past sessions and use of their data for training.Applies when: The operator knows the account holder or user is a minor (an age estimate counts as knowledge). Operators must also follow the Colorado Privacy Act (part 13) for minors' data. Ongoing C.R.S. 6-1-1708(2)(g), (h)
January 1, 2027 Colorado conversational AI service law (HB 26-1263) Operator Clearly disclose to every user that the service is AI: at the first interaction each day, every three hours or persistently, and when asked.Applies when: Applies to all users, not only minors. Ongoing C.R.S. 6-1-1708(3)
January 1, 2027 Colorado conversational AI service law (HB 26-1263) Operator Implement a protocol for prompts about suicidal ideation or self-harm that refers users to a crisis service (not law enforcement) and escalates repeated or severe crisis signs.Applies when: A user prompt concerns suicidal ideation or self-harm. Ongoing C.R.S. 6-1-1708(4)
January 1, 2027 Colorado conversational AI service law (HB 26-1263) Operator Do not state in advertising, the interface or outputs that the service's output comes from, is endorsed by, or equals a licensed health, legal or mental health professional or dietitian.Applies when: Applies to all advertising, interfaces and outputs of the service. Ongoing C.R.S. 6-1-1708(5)

Starting later 1 duty

Dates further out, in order.

StartsLawWhoWhat it requiresHow oftenSource
July 1, 2027 Colorado conversational AI service law (HB 26-1263) Operator Report yearly to the Attorney General: crisis referral counts, self-harm detection and response protocols, and efficacy metrics, using evidence-based methods and no user identifiers.Applies when: Each year, starting July 1, 2027. Every year C.R.S. 6-1-1708(6)

Triggered by an event 19 duties

These apply when something happens, such as a request, an incident or a decision about a person. Each row says what triggers it.

StartsLawWhoWhat it requiresHow oftenSource
When triggered Colorado AI in psychotherapy law (HB 26-1195) Psychotherapy provider Do not deny psychotherapy services because a client refuses or revokes consent to AI recording or transcription.Applies when: A client declines or withdraws consent. Each time it happens C.R.S. 12-245-224.5(4)(a)(III)
When triggered Colorado Artificial Intelligence ActEnds December 31, 2026 Developer Give deployers a statement of intended and harmful uses, training-data types, limitations, bias evaluation, data governance, outputs, mitigations and use instructions, plus model or dataset cards where feasible.Applies when: When making a high-risk AI system available to a deployer or another developer, on and after June 30, 2026. Each time it happens C.R.S. 6-1-1702(2), (3)
When triggered Colorado Artificial Intelligence ActEnds December 31, 2026 Developer Disclose to the attorney general and known deployers any known or reasonably foreseeable algorithmic discrimination risk, without unreasonable delay and within 90 days of discovery or a credible deployer report.Applies when: After the developer discovers through testing, or a deployer credibly reports, that the system caused or likely caused algorithmic discrimination. Each time it happens C.R.S. 6-1-1702(5)
When triggered Colorado Artificial Intelligence ActEnds December 31, 2026 Deployer Before a consequential decision, tell the consumer a high-risk AI system is used, its purpose, the decision's nature, contact details, a plain-language description and any profiling opt-out.Applies when: Before using a high-risk AI system to make, or be a substantial factor in, a consequential decision about a consumer, on and after June 30, 2026. Each time it happens C.R.S. 6-1-1703(4)(a)
When triggered Colorado Artificial Intelligence ActEnds December 31, 2026 Deployer After an adverse consequential decision, give the principal reasons, the system's role and data sources, a chance to correct personal data, and an appeal with human review where technically feasible.Applies when: When a high-risk AI system makes or substantially factors into a decision adverse to the consumer, on and after June 30, 2026. Each time it happens C.R.S. 6-1-1703(4)(b)
When triggered Colorado Artificial Intelligence ActEnds December 31, 2026 Deployer Notify the attorney general, without unreasonable delay and within 90 days, after discovering that a deployed high-risk AI system has caused algorithmic discrimination.Applies when: After the deployer discovers algorithmic discrimination caused by its high-risk AI system. Each time it happens C.R.S. 6-1-1703(7)
When triggered Colorado Artificial Intelligence ActEnds December 31, 2026 Developer or deployer Produce the required statements, documentation, risk policy, impact assessments or records to the attorney general within 90 days of a request.Applies when: On the attorney general's request. Each time it happens C.R.S. 6-1-1702(7); 6-1-1703(9)
When triggered Colorado SB 21-169: insurers' use of external consumer data, algorithms and predictive models Insurer Do not use external consumer data and information sources, or algorithms or predictive models that use them, in a way that unfairly discriminates on those bases.Applies when: As provided in the commissioner's rules for the insurance type and practice. Rules could not take effect before January 1, 2023. Ongoing C.R.S. 10-3-1104.9(1)(b), (3)(a)
When triggered Colorado SB 21-169: insurers' use of external consumer data, algorithms and predictive models Insurer As rules require: report the external data sources used, explain their use, maintain a risk management framework, assess its results with ongoing monitoring, and file an officer attestation.Applies when: Once commissioner rules for the insurance type and practice are in effect. The Division's page lists Amended Regulation 10-1-1 for life, private passenger automobile and health benefit plan insurers, effective October 15, 2025; the regulation's text was not read. Ongoing C.R.S. 10-3-1104.9(3)(b)(I)-(V)
When triggered Colorado SB 21-169: insurers' use of external consumer data, algorithms and predictive models Life, private passenger automobile or health benefit plan insurer If it uses no external consumer data, or algorithms or models using such data, file an officer-signed attestation saying so through SERFF by December 1 each year.Applies when: The insurer does not use external consumer data and information sources in any insurance practice. Stated on the Division's implementation page for Amended Regulation 10-1-1; the regulation's text was not read. Every year Colorado Division of Insurance, SB21-169 implementation page (Amended Regulation 10-1-1)
When triggered Colorado automated decision-making technology law (SB 26-189) Developer Notify each deployer within a reasonable time of material updates, intentional and substantial modifications, and changes to intended use, limitations or risk mitigation.Applies when: After such a change. Public release notes suffice if each deployer gets direct notice of the release. Each time it happens C.R.S. 6-1-1702(2)
When triggered Colorado automated decision-making technology law (SB 26-189) Deployer Within 30 days of an adverse decision, give a plain-language description of the decision and the ADMT's role, a process to request more information, and an explanation of consumer rights.Applies when: When a covered ADMT materially influences a consequential decision with an adverse outcome for the consumer. Each time it happens C.R.S. 6-1-1704(3)
When triggered Colorado automated decision-making technology law (SB 26-189) Deployer On request after an adverse outcome, give instructions for requesting and correcting personal data, and an opportunity for meaningful human review and reconsideration to the extent commercially reasonable.Applies when: When the consumer asks. Opinions, predictions, scores and protected evaluations need not be corrected. Each time it happens C.R.S. 6-1-1705(1)
When triggered Colorado candidate election deepfake disclosure law (HB 24-1147) Person Make the edited-media disclosure clear and conspicuous: text at least as large as the largest other text; audio read at start, end and set intervals.Applies when: When relying on the disclosure to distribute a covered communication. For audio longer than two minutes the statement repeats at intervals of no more than one minute; it must also meet Secretary of State rules and any FCC requirements. Each time it happens C.R.S. 1-46-103(2)(b)(I), (II), (V), (VI)
When triggered Colorado candidate election deepfake disclosure law (HB 24-1147) Person Put the disclosure statement, the identity of the tool used to create the deepfake, and its creation date and time in the metadata; make the disclosure permanent where technically feasible.Applies when: When relying on the disclosure to distribute a covered communication. Each time it happens C.R.S. 1-46-103(2)(b)(III), (IV)
When triggered Colorado facial recognition services law for government agencies (SB 22-113) Facial recognition service provider If independent testing finds material unfair performance differences across subpopulations, develop and implement a plan to mitigate them within 90 days after receiving the results.Applies when: The provider's service is deployed by a Colorado agency and legitimate independent tests show material unfair performance differences. Providers in NIST's ongoing vendor test are exempt. Each time it happens C.R.S. 24-18-304(2)(b), (4)
When triggered Colorado facial recognition services law for government agencies (SB 22-113) Vendor Disclose any complaints or reports of bias about your facial recognition service to a Colorado agency procuring it, which must require this disclosure.Applies when: When a Colorado agency procures the service. The act places the duty on the procuring agency to require the disclosure from each vendor. Each time it happens C.R.S. 24-18-302(6)
When triggered Colorado facial recognition services law for government agencies (SB 22-113) Agency Disclose its use of a facial recognition service on a criminal defendant to that defendant in a timely manner before trial.Applies when: The agency used a facial recognition service on a person who becomes a criminal defendant. Each time it happens C.R.S. 24-18-308(1)
When triggered Colorado intimate digital depictions law (SB 25-288) Person (discloser) Before disclosing an intimate digital depiction on consent, get a knowingly and voluntarily signed plain-language written agreement describing the depiction, its specific use, platforms, availability period and security features.Applies when: Relying on consent. Consent to creation, or an earlier consensual disclosure, does not by itself establish consent to a later disclosure. Each time it happens C.R.S. 13-21-1503(2)(a)-(c)

Law by law

Who each law covers, who enforces it, the penalties, whether people can sue and what the text leaves open. Open a law to see it; every line cites its section.

Colorado AI in health care utilization review law (HB 26-1139)

9 duties · checked November 14, 2026

HB 26-1139 (2026), Session Laws 2026 ch. 325; adds C.R.S. 10-16-112.7 and 25.5-1-209; effective January 1, 2027. Official text · Full law page

Who it covers

  • AI utilization review user. A carrier that uses AI for utilization review or works through a person that does; a pharmacy benefit manager or private utilization review organization doing AI review for a carrier; a behavioral health administrative services organization or managed care entity using AI to review mental or behavioral health services. C.R.S. 10-16-112.7(2)
  • Carrier. A carrier offering a health benefit plan issued or renewed in Colorado on or after the effective date. C.R.S. 10-16-112.7(5)(b), (6)(a)
  • Medicaid or CHP+ payer. A payer of mental or behavioral health services under the Colorado Medical Assistance Act or the Children's Basic Health Plan Act. C.R.S. 25.5-1-209

Enforcement

  • Enforcer: The law does not name one
  • Penalty: the law does not set an amount.
  • Can people sue? The law does not say HB 26-1139 (silent)
  • Time to fix before enforcement: The law does not say

Exemptions

  • AI may still assist utilization review, including expedited approvals. C.R.S. 10-16-112.7(5)(a)
  • The psychotherapy coverage ban does not reach billing software, electronic health records, video platforms or other nontherapeutic tools used incident to a human provider's services, or software used for supervision or consultation. C.R.S. 10-16-112.7(6)(b), (6)(c)

What the text leaves open

  • The act names no enforcer and no penalty; enforcement under the Colorado Insurance Code was not read.
  • C.R.S. 25.5-1-209 points to 10-16-112.7(1)(b) for the definition of AI system, but (1)(b) defines a behavioral health administrative services organization; (1)(a) holds the AI definition.
  • The act was subject to a referendum petition through November 2026; whether a petition was filed was not checked.

Colorado AI in psychotherapy law (HB 26-1195)

8 duties · checked November 14, 2026

HB 26-1195 (2026); amends C.R.S. 12-245-224 and adds 12-245-224.5 and 6-1-1705.2; effective August 12, 2026. Official text · Full law page

Who it covers

  • Psychotherapy provider. A licensee, registrant, certificate holder or other individual lawfully permitted to provide psychotherapy services in Colorado. C.R.S. 12-245-224.5(2)-(6)
  • Person offering an AI system. Any person using terms, letters or phrases in an AI system's advertising, interface or outputs. C.R.S. 6-1-1705.2(1)

Enforcement

  • Enforcer: For psychotherapy providers, a violation is a prohibited activity under the mental health practice act (C.R.S. 12-245-224(1)(y)); the act names no enforcer for C.R.S. 6-1-1705.2.
  • Penalty: the law does not set an amount.
  • Can people sue? The law does not say HB 26-1195 (silent)
  • Time to fix before enforcement: The law does not say

Exemptions

  • Use of AI in an accredited or approved educational or professional training program, if not used with clients or the public and clinical content is reviewed by a licensed professional. C.R.S. 12-245-224.5(7); 6-1-1705.2(3)
  • Development, testing or evaluation of AI solely for research under a registered institutional review board, if not offered to consumers. C.R.S. 12-245-224.5(8); 6-1-1705.2(4)
  • Self-help and wellness tools, and FDA-authorized tools, that do not diagnose or treat mental health disorders and clearly disclose they are not a substitute for clinical care. C.R.S. 12-245-224.5(9); 6-1-1705.2(5)

What the text leaves open

  • C.R.S. 6-1-1705.2 sits in part 17 of article 1 of title 6, which SB 26-189 repeals and reenacts on January 1, 2027; whether 6-1-1705.2 survives that was not confirmed.
  • The act does not say whether a violation of 6-1-1705.2 is a deceptive trade practice, or who enforces it.
  • Discipline and penalties for providers under the mental health practice act (article 245 of title 12) were not read.
  • The act was subject to a referendum petition; whether one was filed was not checked.

Colorado Artificial Intelligence Act

14 duties · checked November 11, 2026

C.R.S. 6-1-1701 to 6-1-1707 (part 17 of article 1 of title 6), as enacted by SB 24-205 (2024) and amended by SB 25B-004 (2025 First Extraordinary Session); repealed and reenacted by SB 26-189 (Session Laws 2026, ch. 131) effective January 1, 2027. Official text · Full law page

Ends December 31, 2026. SB 26-189 repeals and reenacts part 17 effective January 1, 2027; the duties in this file stop then and SB 26-189's take their place. (SB 26-189 § 5(1), (3) (signed act))

Who it covers

  • Developer. A person doing business in Colorado that develops, or intentionally and substantially modifies, an artificial intelligence system. C.R.S. 6-1-1701(7)
  • Deployer. A person doing business in Colorado that deploys (uses) a high-risk artificial intelligence system. C.R.S. 6-1-1701(5), (6); 6-1-1703(6)
  • Deployer or developer that makes an AI system available to interact with consumers. Any deployer or developer that deploys, offers, sells, leases, licenses, gives or otherwise makes available an AI system intended to interact with consumers. C.R.S. 6-1-1704(1)

Enforcement

Exemptions

  • Deployers with fewer than 50 full-time equivalent employees that do not train the system on their own data, use it only for the developer's disclosed intended uses, and make the developer's substantially similar impact assessment available to consumers: excused from 6-1-1703(2), (3) and (5). C.R.S. 6-1-1703(6)
  • AI systems approved, authorized, certified or cleared by a federal agency such as the FDA or FAA, or that comply with equivalent federal standards; research to support such approvals; systems used under contracts with the U.S. Departments of Commerce or Defense or NASA unless used for employment or housing decisions. C.R.S. 6-1-1705(5)
  • HIPAA covered entities providing AI-generated health-care recommendations that require a provider to take action and are not high risk. C.R.S. 6-1-1705(5)(d)
  • AI systems acquired by or for the federal government, unless used for employment or housing decisions. C.R.S. 6-1-1705(6)
  • Insurers and fraternal benefit societies subject to C.R.S. 10-3-1104.9 and the insurance commissioner's rules, and their AI developers, are deemed in full compliance. C.R.S. 6-1-1705(7)
  • Banks, out-of-state banks, Colorado-chartered and federal credit unions and their affiliates or subsidiaries examined under substantially equivalent or stricter prudential-regulator guidance are deemed in full compliance. C.R.S. 6-1-1705(8)
  • The act does not restrict compliance with other law, cooperation with law enforcement, legal claims, security and fraud prevention (excluding facial recognition), certain research, or steps to protect life or safety. C.R.S. 6-1-1705(1)

What the text leaves open

  • The approval line on the signed SB 24-205 PDF was not legible in the fetched copy; the May 17, 2024 signing date was not confirmed from an official source on either pass.
  • The signed SB 26-189 does not mention June 30, 2026 or change the current part 17 before January 1, 2027, so the SB 24-205 duties described here run from June 30, 2026 until the reenactment takes effect. SB 26-189 itself needs its own file before 2027.
  • A federal court stipulation in X.AI LLC v. Weiser (D. Colo.) reportedly limits the attorney general's enforcement timing; court filings were not reviewed today and are not reflected in the enforcement fields.
  • The penalty amounts were read from the 2024 edition of the Colorado Revised Statutes on the General Assembly's site, the newest edition posted there; any 2025 or 2026 amendment to C.R.S. 6-1-112 was not checked.

Colorado SB 21-169: insurers' use of external consumer data, algorithms and predictive models

5 duties · checked November 14, 2026

SB 21-169 (2021 Regular Session; Session Laws 2021, ch. 436), signed July 6, 2021; adds C.R.S. 10-3-1104.9. Official text · Full law page

Who it covers

Enforcement

Exemptions

  • Title insurance. C.R.S. 10-3-1104.9(6)(a)
  • Bonds executed by qualified surety companies. C.R.S. 10-3-1104.9(6)(b)
  • Insurers issuing commercial insurance policies, except business owners' policies and commercial general liability policies with annual premiums of $10,000 or less, which stay covered. C.R.S. 10-3-1104.9(6)(c)
  • Insurers need not collect an applicant's or policyholder's race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity or gender expression. C.R.S. 10-3-1104.9(7)(a)
  • Life, annuity, long-term care and disability insurers need not test individual medical, family history, occupational, disability or behavioral information directly related to mortality, morbidity or longevity risk, unless it is part of testing a model that uses external data. C.R.S. 10-3-1104.9(7)(b)

What the text leaves open

  • Rules must give insurers a reasonable period of time to remedy an unfairly discriminatory impact (C.R.S. 10-3-1104.9(3)(c)(I)). The statute states no number of days, so no cure period is recorded.
  • Section 10-3-1104.9 does not itself call a violation an unfair or deceptive practice. The penalty entries reflect section 10-3-1108 as read, which also reaches violations of other provisions of title 10.
  • The codified text and penalty amounts were read from the 2024 edition of the Colorado Revised Statutes. Any 2025 or 2026 amendment to these sections was not checked.
  • The text of Amended Regulation 10-1-1, its adoption date and any other regulation under this section were not read.
  • Whether sections 10-3-1115 and 10-3-1116 could support a private claim tied to this section was not checked.

Colorado automated decision-making technology law (SB 26-189)

10 duties · checked November 11, 2026

SB 26-189 (2026 Regular Session; Session Laws 2026, ch. 131), approved May 14, 2026; repeals and reenacts C.R.S. 6-1-1701 to 6-1-1709 (part 17 of article 1 of title 6) and adds 6-1-105(1)(uuuu). Official text · Full law page

Who it covers

  • Developer. A person doing business in Colorado that develops, sells, licenses or otherwise makes commercially available a covered ADMT, develops a component designed for one, or intentionally and substantially modifies an ADMT into one. Research-only and internal-only developers are excluded. C.R.S. 6-1-1701(8)
  • Deployer. A person doing business in Colorado that deploys a covered ADMT, meaning automated decision-making technology used to materially influence a consequential decision. C.R.S. 6-1-1701(7), (5)
  • HIPAA covered entity. A HIPAA covered entity doing business in Colorado. It is exempt from most of the part but owes patients a general notice, and specific disclosures when a covered ADMT decides financial assistance eligibility. C.R.S. 6-1-1708(3)(c), (d)

Enforcement

Exemptions

  • Not ADMT: listed basic technologies (anti-malware, calculators, databases, spam filtering, spell-checking, non-ML spreadsheets, web hosting and similar), tools used only to summarize or organize information for human review, and consumer-facing chat technology not intended for consequential decisions and barred from that use by an acceptable use policy. C.R.S. 6-1-1701(2)(b)
  • Not consequential decisions: low-stakes or routine processes, advertising and marketing, search, content moderation, cybersecurity, fraud prevention, sanctions and anti-money-laundering controls, and routine academic administration. C.R.S. 6-1-1701(3)(b)
  • Insurers and affiliates subject to C.R.S. 10-3-1104.9 are in compliance for the practice of insurance, but not for their own employment decisions. C.R.S. 6-1-1708(1), (2)
  • HIPAA covered entities and their business associates are outside 6-1-1701 to 6-1-1706, except for employment decisions; for health-care providers this applies only when operating from a Colorado location. C.R.S. 6-1-1708(3)(a), (b)
  • FDA-overseen medical devices and FDA-overseen pharmaceutical or device research and development. C.R.S. 6-1-1708(4)
  • A creditor whose federal Equal Credit Opportunity Act and Fair Credit Reporting Act notice also satisfies this section need not send a separate notice. C.R.S. 6-1-1704(6)
  • A deployer subject to FERPA may use its existing FERPA notice, record access, amendment and appeal processes for education decisions. C.R.S. 6-1-1704(9); 6-1-1705(2)
  • No duty to disclose trade secrets or legally protected information (the consumer must be told information was withheld), or to disclose where federal law prohibits it or it would compromise security or fraud programs. C.R.S. 6-1-1704(5), (7)

What the text leaves open

  • The text sets no employee-count or revenue threshold; unlike the 2024 act it has no small-deployer exemption.
  • The act does not carry over the 2024 act's risk-management program, impact assessments, public statements or AI-interaction disclosure; those duties end when this reenactment takes effect.
  • How the 30-day disclosure interacts with sector notices is left to attorney general rules.
  • The penalty amounts were read from the 2024 edition of the Colorado Revised Statutes on the General Assembly's site, the newest edition posted there; any 2025 or 2026 amendment to C.R.S. 6-1-112 was not checked.

Colorado candidate election deepfake disclosure law (HB 24-1147)

3 duties · checked November 14, 2026

HB 24-1147 (2024 Regular Session; Session Laws 2024, ch. 250), approved May 24, 2024; adds C.R.S. 1-46-101 to 1-46-106 and 1-45-111.5(1.5)(c.5); amends 1-45-111.7(2)(a). Official text · Full law page

Who it covers

  • Person. Any person who distributes, disseminates, publishes, broadcasts, transmits or displays a communication about a candidate that includes a deepfake, to an audience that includes voters for that office, within 60 days before a primary or 90 days before a general election. C.R.S. 1-46-103(1); 1-46-102(7)

Enforcement

  • Enforcer: Colorado Secretary of State's office, on a written complaint from any person, reviewed and decided through the campaign finance complaint and administrative hearing process; a hearing officer sets the civil penalty. A depicted candidate may also sue in district court. A web search on November 14, 2026 found no report of a court order blocking this law; court dockets were not searched.
  • Penalty: At least $100 per violation; a hearing officer may set more, each failure to include the required disclosure where no paid advertising or other promotional spending is involved. A higher amount may reflect distribution and public exposure. C.R.S. 1-45-111.5(1.5)(c.5)(I)
  • Penalty: At least 10% of the amount paid or spent; a hearing officer may set more, advertising or promoting a prohibited communication that lacks the required disclosure. C.R.S. 1-45-111.5(1.5)(c.5)(II)
  • Can people sue? Yes C.R.S. 1-46-105(1), (4) (depicted candidate only; proof by clear and convincing evidence)
  • Time to fix before enforcement: The law does not say

Exemptions

  • Radio and television broadcasters, including cable and satellite operators, airing a deepfake in a bona fide newscast, news interview, news documentary or on-the-spot coverage, if they clearly acknowledge that its authenticity is in question. C.R.S. 1-46-103(3)(b)
  • Broadcasters, cable and satellite operators, programmers, producers and streaming services that are paid to broadcast a communication that includes a deepfake. C.R.S. 1-46-103(3)(c)
  • Websites and regularly published newspapers, magazines and periodicals of general circulation that routinely carry news and commentary, if they clearly state the communication does not accurately represent the candidate. C.R.S. 1-46-103(3)(d)
  • Satire or parody, and content that depends substantially on a person physically or verbally impersonating the candidate rather than on generative AI or other technical means. C.R.S. 1-46-103(3)(e)
  • Providers of the technology used to create a deepfake, and interactive computer services for content provided by another information content provider; rights and immunities under 47 U.S.C. 230 are unchanged. C.R.S. 1-46-103(3)(a), (f), (g)
  • Content only minimally edited, adjusted or enhanced by generative AI, without materially changing its meaning, is not AI-generated content. C.R.S. 1-46-102(1)(b)

What the text leaves open

  • The act sends complaints through C.R.S. 1-45-111.7, which was not opened; any notice or cure step in that process is not reflected here.
  • Whether the Secretary of State has adopted deepfake disclosure rules under 1-46-103(4) was not checked.
  • Bills after 2024 that may have amended article 46 of title 1 were not searched for.
  • The audio rule reads oddly: the interval requirement applies to audio longer than two minutes but the interval is no more than one minute. Both passes returned the same reading.

Colorado conversational AI service law (HB 26-1263)

11 duties · checked November 14, 2026

HB 26-1263 (2026 Regular Session), Session Laws ch. 208; adds C.R.S. 6-1-1701(3.5), (10.5), (12.5), (15.3), (15.5), (16.5), (18) and 6-1-1708. Official text · Full law page

Who it covers

  • Operator. A person or entity that develops and makes publicly available a conversational AI service, or offers one to a consumer. App stores and search engines are not operators just for providing access. C.R.S. 6-1-1701(15.5)

Enforcement

  • Enforcer: The law does not name one
  • Penalty: the law does not set an amount.
  • Can people sue? The law does not say HB 26-1263 (no provision)
  • Time to fix before enforcement: The law does not say

Exemptions

  • Tools primarily for developers or researchers, commerce or customer service, business operations and productivity, or a business's internal use only. C.R.S. 6-1-1701(3.5)(b)(I), (II), (IV), (VI)
  • Narrow-topic tools and voice assistants on consumer devices that cannot produce sexually explicit output or sustain (or, for voice assistants, encourage) self-harm dialogue; game and theme-park characters limited to their own topics. C.R.S. 6-1-1701(3.5)(b)(III), (V), (VII), (VIII)
  • HIPAA covered entities and business associates, entities under the Health Care Availability Act, and limited school tools not designed for emotional companionship. C.R.S. 6-1-1701(3.5)(b)(IX)-(XI)
  • A feature inside another app or program, including a social media platform, that is not itself a conversational AI service and is not designed for emotional companionship. C.R.S. 6-1-1701(3.5)(b)(XII)

What the text leaves open

  • HB 26-1263 adds its duties as section 6-1-1708 of part 17. SB 26-189 (signed May 14, 2026) repeals and reenacts part 17 effective January 1, 2027, with a different section 6-1-1708. How the two are reconciled (for example, renumbering by the revisor of statutes) was not confirmed; the 2026 Colorado Revised Statutes were not opened.
  • Enforcement depends on that answer. As reenacted by SB 26-189, 6-1-1706 has the Attorney General enforce part 17 through the Colorado Consumer Protection Act, makes a violation of part 17 a deceptive trade practice, and creates no new private right of action. Whether that covers these operator duties was not confirmed, so enforcer, penalties and right to sue are left as not stated.
  • The legislature's bill summary describes all requirements as effective January 1, 2027; the statute text attaches that date only to the duties after the age-estimation sentence in 6-1-1708(2).
  • Read once; no second pass was done.

Colorado facial recognition services law for government agencies (SB 22-113)

7 duties · checked November 15, 2026

SB 22-113 (2022 Regular Session; Session Laws 2022, ch. 463), approved June 8, 2022; adds C.R.S. 24-18-301 to 24-18-309, 22-32-150 and 22-30.5-529, and 2-3-1707; amends 2-3-1701 and 18-5.5-102. Official text · Full law page

Who it covers

  • Agency. An agency of the state government or of a local government, or a state institution of higher education, that uses or intends to develop, procure or use a facial recognition service. C.R.S. 24-18-301(2); 24-18-302(1)
  • Facial recognition service provider / vendor. A provider or vendor of a facial recognition service used or procured by a Colorado agency. The act does not define 'provider'; duties reach providers through 24-18-302(6) and 24-18-304(2). C.R.S. 24-18-302(6); 24-18-304(2)
  • Law enforcement agency. A law enforcement agency using a facial recognition service. C.R.S. 24-18-307

Enforcement

Exemptions

  • Not a facial recognition service: device unlocking, consumer address-book or personal photo tools, and law enforcement redaction that keeps no biometric data. C.R.S. 24-18-301(5)(b)
  • Reporting duties do not apply to a generally available consumer product used only for personal or household purposes, if the agency publicly certifies it will not be used for governmental purposes. C.R.S. 24-18-302(8)
  • The operational and independent testing duties do not apply where the provider takes part in NIST's Face Recognition Vendor Test ongoing project. C.R.S. 24-18-304(4)
  • The part does not apply to certain federally required uses, airport travel verification, physical access control for secure areas, research-only state agency use that affects no decisions, or a utility. C.R.S. 24-18-309

What the text leaves open

  • The act does not define 'provider' in 24-18-304; this file reads it as the facial recognition service provider from context.
  • Provider and vendor duties arise through agency contracts and procurement; the act states no direct penalty against a provider.
  • Whether part 3 of article 18 of title 24 was amended after 2022 was not checked against the codified statutes.

Colorado intimate digital depictions law (SB 25-288)

5 duties · checked November 15, 2026

SB 25-288 (2025 Regular Session; Session Laws 2025, ch. 339), approved June 2, 2025; creates C.R.S. 13-21-1501 to 13-21-1507 and amends C.R.S. 18-6-403, 18-7-107, 18-7-108 and 18-7-109. Official text · Full law page

Who it covers

  • Person (discloser). Anyone who discloses, or threatens to disclose, an intimate digital depiction of an identifiable individual without consent, knowing or recklessly disregarding the lack of consent and likely severe emotional distress. C.R.S. 13-21-1503(1)
  • Actor. A person aged 18 or older who discloses or threatens to disclose a private intimate image or intimate digital depiction of a depicted individual aged 18 or older through electronic media or a website. C.R.S. 18-7-107(1)(a), (6); 18-7-108(1)(a)
  • Person (child sexual exploitation). Anyone handling sexually exploitative material, which now includes realistic digitized or computer-generated depictions of an identifiable child in explicit sexual conduct. C.R.S. 18-6-403(2)(e.3), (2)(j)(II)
  • Broadcaster. A broadcaster that airs third-party content containing an intimate digital depiction; it keeps a safe harbor only if it meets the conditions in 13-21-1504(8). C.R.S. 13-21-1504(8)

Enforcement

  • Enforcer: Civil suits by the depicted individual (or a guardian, family member or estate representative); criminal prosecution under 18-7-107, 18-7-108 and 18-6-403 (the act does not name the prosecutor). A web search on November 15, 2026 found no court order blocking this law.
  • Penalty: Greater of actual damages (including emotional distress) or $150,000 liquidated damages, plus the defendant's monetary gain, exemplary damages, costs and reasonable attorney fees, a successful civil action under 13-21-1503; courts may also issue restraining orders and injunctions. C.R.S. 13-21-1506(1), (2)
  • Penalty: Class 1 misdemeanor; class 6 felony if the disclosure posed an imminent and serious threat to the safety of the individual or immediate family and the actor knew or should have known, disclosure for harassment (18-7-107) or for pecuniary gain (18-7-108). C.R.S. 18-7-107(1)(b); 18-7-108(1)(b)
  • Penalty: Fine of up to $10,000, in addition to any other sentence, credited to the crime victim compensation fund, a conviction under 18-7-107 or 18-7-108. C.R.S. 18-7-107(1)(c); 18-7-108(1)(c)
  • Can people sue? Yes C.R.S. 13-21-1503(1), (4); 13-21-1506
  • Time to fix before enforcement: The law does not say

Exemptions

  • Good-faith disclosures to law enforcement or in a legal proceeding, to report or investigate unlawful or unwelcome conduct, on a matter of public concern, or reasonably meant to help the depicted individual. Not available to the person who created the depiction, or if made for arousal, humiliation or commercial gain. C.R.S. 13-21-1504(1), (2)
  • Satire or parody, and media that relies on human impersonation rather than computer-generated means. C.R.S. 13-21-1504(4)
  • Providers of the technology used to create the depiction are outside the civil part. C.R.S. 13-21-1504(5)
  • Interactive computer, information and telecommunications service providers for content provided by others, and for good-faith voluntary restriction of access or providing filtering tools (civil and criminal). C.R.S. 13-21-1504(6), (7); 18-7-107(5); 18-7-108(5)
  • Good-faith disclosure to law enforcement when reporting a violation, or to a court, party or fact-finder in a related criminal proceeding, is not a crime. C.R.S. 18-7-107(5.5); 18-7-108(5.5)

What the text leaves open

  • Prison and fine ranges for a class 1 misdemeanor and a class 6 felony are set in C.R.S. 18-1.3-501 and 18-1.3-401, which were not opened.
  • The act sets no statute of limitations for the civil action, and its applicability clause covers only sections 2 to 8; whether the civil action reaches disclosures before August 6, 2025 is not stated.
  • Penalty levels for sexual exploitation of a child (18-6-403) were not restated in the act and were not checked.
  • A news headline reports a Colorado Supreme Court decision that this act cannot support charges for conduct before it took effect; the ruling was not opened. No order blocking the act was found.
  • Later amendments after 2025 were not checked.

Colorado school facial recognition law (SB 25-143)

2 duties · checked November 15, 2026

SB 25-143 (2025 Regular Session; Session Laws 2025, ch. 86), approved April 18, 2025; amends C.R.S. 22-32-150 (school districts) and 22-30.5-529 (institute charter schools). Official text · Full law page

Who it covers

Enforcement

  • Enforcer: Any aggrieved party may seek a restraining order or injunction in district court against the school, a school employee or a school contractor. No government enforcer is named. A web search on November 15, 2026 found no court order blocking this law.
  • Penalty: the law does not set an amount.
  • Can people sue? Yes C.R.S. 22-32-150(2.5)(d) (injunctive relief only)
  • Time to fix before enforcement: The law does not say

Exemptions

  • Contracts in effect on the act's effective date, and contracts signed before August 10, 2022 and their renewals, are outside the contracting ban. C.R.S. 22-32-150(2)(a)
  • Contracts with a school service contract provider for a product that analyzes facial features for educational purposes with board-approved curricula. C.R.S. 22-32-150(2)(c); 22-30.5-529(2)(c)
  • Security uses: an articulable and significant threat against a school, a lost or missing student, or a person ordered off district property who may try to reenter. C.R.S. 22-32-150(2)(d)(I)-(III)

What the text leaves open

  • The contracting ban in 22-32-150(1) and the section's definition of facial recognition service were not reproduced in either copy read, so the ban is not mapped as a duty.
  • Whether the consent rule applies to all processing or only to the exempted educational and security uses is not clear from the text read.
  • School-only duties (posting notices, disabling the system after an incident, district access policies) bind public schools and districts and are not mapped. The text sets no deadline for the district policy.
  • SB 22-113 (2022) created the original school contracting ban; later amendments after 2025 were not checked.

Other enacted laws to check

These 4 enacted AI laws are in the states you chose, but they are not yet mapped duty by duty, so they are not in the plan above. Each page has a summary and the official source.

Information, not legal advice. This plan summarizes what the official texts of the laws listed say. It does not decide whether a law applies to your organization; that turns on facts such as your size, your role as a developer or deployer, and how you use AI. Laws change, and courts and regulators can read them differently. Check the official text linked with each duty and talk to a qualified lawyer before acting. Using this page does not create an attorney-client relationship. See our terms of service.

How the plan is built

Each law in the plan was read from its official text, on the legislature’s or state’s own website. 265 of the 326 have also been read a second time to confirm every date, threshold, penalty and enforcer; the rest have had one full read, and each shows the date it was last checked. Each duty is written in plain English in 30 words or fewer and carries the section it comes from, with a link.

Where a law is silent, the plan says so. It does not borrow a penalty from another statute or guess at a deadline. A law that is repealed or replaced on a known date shows that end date, and its duties leave the plan once the date passes. The date each law was last checked appears with it.

The plan is built fresh from these records every time the page loads, so it changes as soon as a law is added or re-checked. To report an error, use the corrections page. For how we find laws and decide what counts as an AI law, see our methodology. If you are not sure which laws touch your business at all, start with Am I Affected?

Common questions

What does an AI compliance plan cover?

Each duty an enacted state AI law places on a business or other regulated party: who it applies to, what it requires, when it starts, how often it recurs, who enforces it, the penalties and whether people can sue. The builder covers 1,235 duties in 326 enacted laws across 50 states, and every duty links to the section of law it comes from.

Where does the information come from?

From the official text of each law: the enrolled bill, session law or codified statute, opened on the legislature's or state's own website. 265 of the 326 laws have also been read a second time to confirm every date, threshold, penalty and enforcer, and the date each law was last checked is shown with it. Where a law is silent on a point, such as a penalty amount, the plan says the law does not say rather than filling the gap. Law firm summaries and news reports are never used as sources.

Does the plan include every AI law in a state?

Not yet. It includes the enacted laws we have mapped duty by duty. When you choose a state, its other enacted AI laws are listed separately with links, so nothing is left out of view. New laws are added as they are read. When a law is repealed or replaced on a set date, its duties show that end date and leave the plan once it passes.

How do I know which duties apply to my company?

Start with the 'who it covers' entry for each law: many apply only above a size or revenue threshold, only to developers or only to deployers, or only in one industry. The plan quotes those conditions from the text. Whether your company meets them depends on facts only you and your counsel know.

Is this legal advice?

No. It is information drawn from official legal texts, organized so you can see what each law requires. Use it to brief your team and your lawyers, not in place of them.

What does Pro add?

The same plan as a CSV file for spreadsheets and audit files, and as a calendar file (.ics) with every dated duty as an event that links back to the law. Both are built from the states and uses you pick. The plan on this page, and printing it, are open to everyone.