How to comply with the Colorado AI Act (SB 24-205)
Colorado AI Act (SB 24-205)
- Status
- In force
- Binding
- Yes
- Object analysed
- Automated decision
- Requirements
- 8
- Next milestone
- —
In short
First US state law on high-risk AI: duty of care against algorithmic discrimination in consequential decisions (employment, credit, housing, health, education, insurance, public services, legal).
Steps to compliance
- Qualify each AI systemAxes to decide: High-risk system (consequential decision).
- Determine your roleDuties vary by role: Developer and Deployer.
- Apply the 8 requirementsThey focus on: Transparency & notice, Fairness & non-discrimination, Technical documentation and Third parties & value chain.
- Prove it with checks14 checks to document, 12 of which also serve AI Act, PL 2338 and CoE Convention.
- Keep compliance up to dateEvery known milestone has passed: the obligations apply.
Scope and penalties
- Kind
- Statute
- Scope
- Developers and deployers of high-risk AI systems doing business in Colorado.
- Territorial reach
- Doing business in Colorado, decisions about residents.
- Penalties
- Unfair trade practice; Attorney General enforcement only. Affirmative defence when aligned with NIST AI RMF or ISO 42001.
- Jurisdiction
- Colorado
Timeline
Qualifying a system
Classification axes and possible verdicts
High-risk system (consequential decision)
Requirements
8 requirements
| Code | Article | Requirement | Applies to | Checks |
|---|---|---|---|---|
| CO-01 | §6-1-1702(1) | Reasonable care against algorithmic discrimination | ||
| CO-02 | §6-1-1702(2) | Documentation to deployers (risks, data, evaluations) | ||
| CO-03 | §6-1-1702(4) | Public statement of high-risk systems | ||
| CO-04 | §6-1-1702(5), 1703(7) | Report to the Attorney General within 90 days | ||
| CO-05 | §6-1-1703(2) | Risk management policy and programme | ||
| CO-06 | §6-1-1703(3) | Annual impact assessment and on each modification | ||
| CO-07 | §6-1-1703(4) | Consumer notice, adverse decision explanation, correction and human appeal | ||
| CO-08 | §6-1-1704 | Disclose interaction with an AI system |
Checks to document
Evidence collected for a check counts for every regulation that uses it.
| Code | Check | Scope | Themes | Also used by |
|---|---|---|---|---|
| CHK-BIAS | Fairness and bias are evaluated and results documented | System | ||
| VER-004-01 | Documented data governance (collection process, bias, quality) | System | ||
| VER-007-01 | Instructions for use complete and compliant with Art. 13 | System | ||
| VER-003-02 | Residual risks communicated to deployers | System | ||
| NEW-US-CO-01 | Public statement of high-risk systems published proposed | System | ||
| VER-013-F-04 | Communication to market surveillance authorities in the event of risk | System | ||
| NEW-US-CO-02 | 90-day Attorney General reporting procedure proposed | System | ||
| CHK-POL-RISK | An AI risk-management policy and process are established through transparent, documented controls | Organisation | ||
| VER-003-01 | Documented and up-to-date risk register | System | ||
| CHK-IMPACT-ASSESS | An impact assessment is performed, documented and used in go/no-go and risk decisions | System | ||
| VER-029-D-01 | Affected persons informed of the use of the AI system | System | ||
| VER-033-D-01 | Decision explanation procedure documented | Organisation | ||
| CHK-BR-CONTEST | Procedure to contest a decision and obtain human review published | Organisation | ||
| VER-018-D-01 | Persons informed of the interaction with an AI system | System |
Themes covered
Frequently asked questions
Who is in scope of Colorado AI Act?
Developers and deployers of high-risk AI systems doing business in Colorado. Doing business in Colorado, decisions about residents.
What penalties does Colorado AI Act carry?
Unfair trade practice; Attorney General enforcement only. Affirmative defence when aligned with NIST AI RMF or ISO 42001.
When do the Colorado AI Act obligations apply?
Aug 28, 2025: SB 25B-004: delay to 30 June 2026; Jun 30, 2026: Effective date (2026 session amendments to verify).
Is Colorado AI Act binding?
Yes. Kind: statute. Status: in force.
How does Colorado AI Act relate to other regulations?
The same checks serve several texts. Shared checks: AI Act (8), PL 2338 (8) and CoE Convention (5).
Related regulations
Official sources
Data checked on Sep 25, 2026. General information, not legal advice. Check the official texts and get advice for your situation.
Run these requirements across all your AI systems
TrustFlow inventories your systems, qualifies them under each regulation and collects evidence once for every referential.