The Colorado Artificial Intelligence Act gives exclusive enforcement authority to the Colorado Attorney General. No private lawsuits. No class actions from plaintiffs' attorneys. Just the AG — and a 60-day cure period that sounds more forgiving than it actually is in practice.
Here is how Colorado AI Act enforcement works, what triggers an investigation, and what businesses can realistically expect once the law takes effect on June 30.
How Enforcement Begins
Under the Colorado AI Act, enforcement begins with a complaint or an AG-initiated investigation. The AG can investigate potential violations based on consumer complaints, referrals from other agencies, or its own review of AI deployment practices in the state.
Colorado has a history of active consumer protection enforcement. The AG's office has pursued significant cases against technology companies, financial institutions, and data brokers in recent years. AI governance is a stated priority for the current administration, and the AG's consumer protection division has been staffing up in anticipation of SB 24-205 taking effect.
What the AG Can Request
Once an investigation is opened, the AG can issue civil investigative demands requiring businesses to produce:
Documentation of every AI system used in consequential decisions. Impact assessments for each of those systems. Evidence of consumer disclosure practices. Documentation of appeal processes. Vendor contracts and correspondence related to AI systems. Any internal policies or risk management documentation.
The breadth of these document requests is significant. A business that has no documentation to produce — because it never built a compliance record — has nothing to show the AG that demonstrates good faith compliance efforts. That is a very bad position.
The 60-Day Cure Period
Here is what the cure period actually means and what it does not mean.
If the AG finds a violation, they must provide written notice identifying the specific violation. The business then has 60 days to cure the violation, document how it was cured, and explain what changes were made to prevent recurrence. If the violation is cured within 60 days, the AG may decide not to pursue further enforcement.
What many businesses misunderstand is what can realistically be cured in 60 days. You can write a policy in 60 days. You can send vendor demand letters in 60 days. But you cannot retroactively create an impact assessment for decisions that were already made. You cannot document human oversight of AI decisions that already happened without oversight. You cannot produce records that were never created.
The cure period gives you 60 days to fix your process going forward. It does not erase your prior exposure. And it requires that you have the organizational capacity to actually produce meaningful documentation in 60 days — which is much harder if you are starting from zero than if you have some compliance infrastructure already in place.
Who Gets Investigated First
AG offices with limited enforcement resources prioritize cases that establish precedent, generate significant public impact, or respond to high volumes of consumer complaints.
For Colorado AI Act enforcement, the early cases are most likely to involve: businesses where consumers have complained about discriminatory AI outcomes in housing or employment. Large employers with significant AI footprints who made no compliance efforts. Cases where the AI discrimination is clear and documentable. Businesses in industries the AG is already watching — financial services, real estate, staffing.
Small businesses that made documented good faith compliance efforts — even imperfect ones — are not the priority targets. The documentation you build now is partly a substantive legal defense and partly a signal to enforcement that you took the law seriously.
This article is for informational purposes and does not constitute legal advice. For legal advice specific to your situation, consult a licensed Colorado attorney.