# Colorado Senate Bill 24-205: Consumer Protections for Artificial Intelligence (Colorado AI Act) - **Record type**: Policy instrument - **Jurisdiction**: Colorado (United States) - **Instrument type**: Act / statute - **Status**: Repealed - **Binding**: Yes - **Issuing body**: Colorado General Assembly - **Adopted**: 2024-05-17 - **Published**: 2024-05-17 ## In brief The Colorado AI Act is a binding act of Colorado (United States), issued by Colorado General Assembly. It was repealed 17 May 2024. Applies to developers and deployers doing business in Colorado of high-risk AI systems affecting Colorado consumers, with exemptions (for example certain small deployers, systems approved by federal agencies, and some regulated financial institutions). ## Summary The Colorado AI Act requires developers and deployers of high-risk AI systems to use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. High-risk systems are those that make, or are a substantial factor in making, consequential decisions about education, employment, financial or lending services, essential government services, healthcare, housing, insurance or legal services. Deployers must run risk-management programmes and impact assessments, notify consumers, and explain adverse decisions; developers must document systems and disclose known risks. ## Scope Applies to developers and deployers doing business in Colorado of high-risk AI systems affecting Colorado consumers, with exemptions (for example certain small deployers, systems approved by federal agencies, and some regulated financial institutions). Enforcement is exclusively by the Attorney General; there is no private right of action. ## Who it applies to Developers and deployers of high-risk AI systems used to make consequential decisions about Colorado residents. ## What organisations must do Deployers: adopt a risk-management policy and programme, complete impact assessments annually and within 90 days of substantial modification, notify consumers before a consequential decision, explain adverse decisions and offer correction and appeal, and notify the Attorney General of discovered algorithmic discrimination within 90 days. Developers: provide documentation and known-risk disclosures to deployers, publish a public statement on high-risk systems, and notify the Attorney General of discovered discrimination. ## Key dates Signed 17 May 2024; effective date delayed to 30 June 2026 by SB 25B-004; repealed and replaced by SB 26-189 on 14 May 2026 before taking effect (pending review). ## Penalties Violations are deceptive trade practices under the Colorado Consumer Protection Act, enforced by the Attorney General. A rebuttable presumption of reasonable care is available where the statute's requirements are met, and an affirmative defence exists for organisations that cure violations and follow a recognised risk framework such as the NIST AI RMF or ISO/IEC 42001. ## Notes on dates Repealed by SB 26-189 (signed 14 May 2026) before its delayed 30 June 2026 effective date; the duties below never applied. Confirm against the enrolled bill. ## Obligations recorded against this instrument (10) - **Deployers must implement a risk management policy and programme** (C.R.S. 6-1-1703(2)) — Deployers of high-risk AI must implement a risk-management policy and programme governing deployment, specifying principles, processes and personnel used to identify, document and mitigate known or reasonably foreseeable risks of algorithmic discrimination, and reasonable in light of recognised frameworks such as the NIST AI RMF or ISO/IEC 42001. - Binding: yes - Record: https://aipolicytracker.org/obligations/us-colorado-deployer-risk-management-program - **Deployers must complete impact assessments for high-risk AI** (C.R.S. 6-1-1703(3)) — Deployers must complete an impact assessment before deployment, annually, and within 90 days of any intentional and substantial modification, covering purpose, risks of algorithmic discrimination and mitigation, data categories, performance metrics, transparency measures and post-deployment monitoring, and retain assessments for at least three years. - Binding: yes - Record: https://aipolicytracker.org/obligations/us-colorado-deployer-impact-assessment - **Notify consumers and explain adverse consequential decisions** (C.R.S. 6-1-1703(4)) — Before a high-risk system makes a consequential decision, deployers must notify the consumer that AI is used, describe its purpose and nature, and provide contact and opt-out information where applicable. After an adverse decision they must state the principal reasons, the data used and its sources, and offer an opportunity to correct data and to appeal for human review where feasible. - Binding: yes - Record: https://aipolicytracker.org/obligations/us-colorado-consumer-notice-and-adverse-decision-explanation - **Developers must document high-risk systems and disclose known risks** (C.R.S. 6-1-1702) — Developers must make available to deployers a general statement of intended uses, documentation of known or reasonably foreseeable risks of algorithmic discrimination, training-data summaries, limitations, performance evaluation and mitigation measures, and information needed for deployer impact assessments, and must publish a public statement describing their high-risk systems and how they manage discrimination risks. - Binding: yes - Record: https://aipolicytracker.org/obligations/us-colorado-developer-documentation-and-disclosure - **Developers must use reasonable care to avoid algorithmic discrimination** (C.R.S. 6-1-1702(1)) — A developer of a high-risk AI system must use reasonable care to protect consumers from any known or reasonably foreseeable risk of algorithmic discrimination arising from the intended and contracted uses of the system. A developer that meets the documentation, public-statement and Attorney General disclosure duties in the rest of section 6-1-1702 benefits from a rebuttable presumption that it used reasonable care. - Binding: yes - Record: https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-reasonable-care - **Developers must notify the Attorney General and deployers of discovered algorithmic discrimination** (C.R.S. 6-1-1702(5)) — Within 90 days after a developer discovers, through ongoing testing or a credible report from a deployer, that a high-risk AI system it developed has caused or is reasonably likely to have caused algorithmic discrimination, it must disclose this to the Colorado Attorney General and to all known deployers or other developers of the system, without unreasonable delay. - Binding: yes - Record: https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-disclosure-to-attorney-general - **Deployers must use reasonable care to avoid algorithmic discrimination** (C.R.S. 6-1-1703(1)) — A deployer of a high-risk AI system must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. A deployer that runs the required risk-management programme, completes impact assessments, gives consumer notices and makes the required disclosures benefits from a rebuttable presumption of reasonable care; some deployers with fewer than 50 employees are relieved of parts of the programme and assessment duties when they rely on the developer's impact assessment. - Binding: yes - Record: https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-reasonable-care - **Deployers must publish a statement about the high-risk AI systems they use** (C.R.S. 6-1-1703(5)) — A deployer must make available on its website, or in another public way, a clear and readily available statement summarising the types of high-risk AI systems it currently deploys, how it manages known or reasonably foreseeable risks of algorithmic discrimination from those systems, and the nature, source and extent of the information it collects and uses. The statement must be updated periodically. - Binding: yes - Record: https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-public-statement - **Deployers must notify the Attorney General of discovered algorithmic discrimination** (C.R.S. 6-1-1703(7)) — If a deployer discovers that a high-risk AI system it uses has caused algorithmic discrimination, it must send a notice to the Colorado Attorney General within 90 days of the discovery, in the form the Attorney General prescribes, without unreasonable delay. - Binding: yes - Record: https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-disclosure-to-attorney-general - **Deployers and developers must disclose to consumers that they are interacting with an AI system** (C.R.S. 6-1-1704) — Any developer or deployer that makes an AI system available to consumers that is intended to interact with them must disclose to each consumer that they are interacting with an AI system, unless that would be obvious to a reasonable person. This duty is not limited to high-risk systems and covers chatbots and voice agents offered to Colorado consumers. - Binding: yes - Record: https://aipolicytracker.org/obligations/us-colorado-ai-act-consumer-ai-interaction-disclosure ## Dated deadlines - 2024-05-17 — Signed into law (precision: exact, status: scheduled) - 2026-02-01 — Original effective date (superseded) (precision: exact, status: scheduled) - 2026-06-30 — Delayed effective date (never reached) (precision: exact, status: scheduled) - 2026-05-14 — Repealed and replaced by SB 26-189 (precision: exact, status: scheduled) ## Provenance - **Permanent id**: AIPT-POL-0213 (https://aipolicytracker.org/id/AIPT-POL-0213; never changes or gets reused) - **Record page**: https://aipolicytracker.org/policies/us-colorado-ai-act - **Official source**: https://leg.colorado.gov/bills/sb24-205 - **Source document**: SB24-205 Consumer Protections for Artificial Intelligence - **Published by**: Colorado General Assembly - **Provision**: Colorado Revised Statutes 6-1-1701 to 6-1-1707 - **Review status**: pending review - **Confidence**: medium - **Facts last confirmed**: never confirmed against the official source - **Retrieved**: 2026-10-27 - **Licence**: https://creativecommons.org/licenses/by/4.0/ - **Cite as**: AIPolicyTracker (2026). "Colorado Senate Bill 24-205: Consumer Protections for Artificial Intelligence (Colorado AI Act)" [AIPT-POL-0213, record version 2, not yet verified]. https://aipolicytracker.org/id/AIPT-POL-0213 (accessed 27 October 2026). > This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.