In one paragraph
Colorado's SB 24-205 (the Colorado AI Act) covers high-risk AI that makes, or is a substantial factor in making, consequential decisions such as hiring, lending, housing, insurance and health care. Developers and deployers must use reasonable care against algorithmic discrimination; deployers need risk programs, impact assessments and notices. Signed May 17, 2024 (Chapter 198). Duties run from June 30, 2026 (SB 25B-004) until SB 26-189 replaces Part 17 on January 1, 2027. Under a stipulated April 27, 2026 order in X. AI LLC v. Weiser (D. Colo.), the Attorney General may not start enforcement over violations through 14 days after a ruling on xAI's planned preliminary-injunction motion.
Plain-English summary, written with AI assistance. The official text controls.
What it means for business
Developers and deployers of high-risk AI in consequential decisions about Colorado residents: duties apply June 30 to December 31, 2026, but a stipulated court order bars AG enforcement over violations through 14 days after a preliminary-injunction ruling. SB 26-189 replaces them January 1, 2027.
Key provisions
- Covers high-risk AI systems: AI that, when deployed, makes or is a substantial factor in making a consequential decision on education, employment, financial or lending services, essential government services, health care, housing, insurance or legal services; narrow procedural tools are excluded, as are anti-fraud (without facial recognition), cybersecurity, databases, spreadsheets, chatbots under an accepted-use policy barring discriminatory or harmful content and similar tools unless they are a substantial factor (§ 6-1-1701)
- Developers: reasonable care against known or reasonably foreseeable algorithmic discrimination; give deployers documentation on uses, training data, limitations, evaluation and mitigation needed for impact assessments; publish a website statement of their high-risk systems; report discrimination risks to the Attorney General and known deployers within 90 days after learning the system caused or likely caused algorithmic discrimination (§ 6-1-1702)
- Deployers: reasonable care; a risk management policy and program (judged against frameworks such as the NIST AI RMF or ISO/IEC 42001); impact assessments at deployment, at least annually and within 90 days of an intentional and substantial modification, kept at least 3 years after final deployment; annual reviews for algorithmic discrimination (§ 6-1-1703)
- Consumers: notice before a high-risk system is used in a consequential decision; after an adverse decision, the principal reasons, a chance to correct incorrect personal data and an appeal with human review if technically feasible; deployers must also post a website statement and notify the Attorney General within 90 days of discovering algorithmic discrimination; deployers and developers offering an AI system meant to interact with consumers must disclose that it is AI unless that would be obvious to a reasonable person (§§ 6-1-1703, 6-1-1704)
- Deployers with fewer than 50 full-time-equivalent employees that do not train the system with their own data are exempt from the risk program, impact assessment and website duties if conditions are met; insurers under § 10-3-1104.9 and banks and credit unions under equivalent regulator guidance are deemed compliant; federally approved systems and certain HIPAA covered-entity uses are excluded (§§ 6-1-1703(6), 6-1-1705)
- Attorney General has exclusive enforcement; a violation is an unfair trade practice (§ 6-1-105(1)(hhhh)); rebuttable presumption of reasonable care for compliance; affirmative defense for discovering and curing violations (through feedback, red teaming or internal review) while complying with the NIST AI RMF and ISO/IEC 42001, an equivalent framework or one the AG designates; no private right of action; AG rulemaking (§§ 6-1-1706, 6-1-1707)
- Under an April 27, 2026 minute order in X. AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo.), granting a joint motion and stipulation to temporarily stay enforcement, the Attorney General may not initiate enforcement, including investigations, for violations of SB 24-205 or of legislation replacing or amending it enacted in the 2026 session that occur through 14 days after the court rules on xAI's planned preliminary-injunction motion; xAI must file that motion within 28 days after final adoption of implementing rules. The court has not ruled on the merits, and neither that motion nor a ruling on it appears on the docket as of October 1, 2026
- Signed May 17, 2024 (Chapter 198, Session Laws 2024), effective on signing; duties originally from February 1, 2026, moved to June 30, 2026 by SB 25B-004 (Chapter 3, 2025 First Extraordinary Session); SB 26-189 (Chapter 131, signed May 14, 2026) repeals and reenacts Part 17 effective January 1, 2027
Latest legislative action
May 17, 2024. Governor Signed
Sponsors (showing 5 of 97)
| Name | Role |
|---|---|
| Alex Valdez D | Primary |
| Andrew Boesenecker | Primary |
| Anthony Hartsook | Primary |
| Barbara Kirkmeyer R | Primary |
| Barbara McLachlan | Primary |
Roll call votes (showing 3 of 135)
Reconsideration Vote May 8, 2024
57 yea6 nay2 otherPassed
Final Passage May 8, 2024
59 yea4 nay2 otherPassed
Adoption May 8, 2024
63 yea0 nay2 otherPassed
Topics and industries
Related topics
Affected industries
This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error