Colorado's Artificial Intelligence Act — formally known as SB 24-205 — goes into effect on June 30, 2026. That is roughly ten weeks from now. And the overwhelming majority of Colorado small businesses that it applies to have no idea it exists.
This guide cuts through the legal language. No attorney billing by the hour, no jargon, just what the law actually requires and what you need to do about it before June 30th.
What Is the Colorado AI Act?
The Colorado Artificial Intelligence Act is a state law signed in May 2024 that regulates how businesses use artificial intelligence in decisions that significantly affect Colorado residents. Originally set to take effect February 1, 2026, the legislature delayed it to June 30, 2026 after significant industry pushback — but the law survived that fight and is going into effect.
Colorado's approach is fundamentally different from Texas's TRAIGA. Where Texas focuses on intent — did you mean to cause harm — Colorado focuses on impact. The question Colorado asks is whether your AI system could cause algorithmic discrimination, regardless of your intent. That is a broader standard and in some ways a harder one to satisfy.
Who Does It Apply To?
The Colorado AI Act applies to any business that deploys a high-risk AI system in a consequential decision affecting a Colorado resident. The law defines high-risk systems as those that make or substantially influence consequential decisions — decisions about employment, education, housing, credit, healthcare, insurance, or legal services.
If you use any major hiring platform, background check service, credit scoring tool, tenant screening system, or AI-assisted customer management platform, you are almost certainly a deployer under the Colorado AI Act.
What the Law Requires
The Colorado AI Act has more specific requirements than TRAIGA. Here is what deployers must do.
Implement a risk management policy. You need a written AI risk management policy that identifies, assesses, and manages known and reasonably foreseeable risks of algorithmic discrimination from your AI systems. This is a written document, not a checkbox.
Conduct impact assessments. For each high-risk AI system you deploy, you must complete an impact assessment that documents the system's purpose, the data it uses, known limitations, and how you are managing discrimination risks. These assessments need to be updated annually and whenever you make significant changes to how you use the system.
Provide consumer disclosures. When you use a high-risk AI system to make a consequential decision about a Colorado resident, you must disclose that AI was used. The disclosure must happen before or at the time of the decision.
Offer a meaningful appeal process. Colorado residents affected by AI-assisted consequential decisions must be given the opportunity to appeal that decision and request human review. This is a specific Colorado requirement that TRAIGA does not have.
Maintain documentation. Every step above needs to be documented and kept as an auditable record. The Colorado AG can request these records during an investigation.
The Penalty Structure
The Colorado Attorney General has exclusive enforcement authority. There is no private right of action — individuals cannot sue you directly. But if the AG investigates and finds a violation, you have 60 days to cure it after receiving written notice. If you fail to cure, civil penalties apply.
The law does not specify a maximum per-violation penalty in the same way TRAIGA does, but the AG has broad authority to seek civil penalties, injunctive relief, and attorney's fees. Given Colorado's track record on consumer protection enforcement, businesses should treat this as a serious financial risk.
The Federal Uncertainty Factor
There is a real question about whether the Colorado AI Act will survive federal preemption efforts. Congress has twice declined to pass a preemption moratorium, and a December 2025 executive order attempting to challenge state AI laws faces significant legal hurdles. The safest assumption for Colorado businesses is that the law goes into effect June 30th as scheduled.
What To Do Right Now
You have roughly ten weeks. That sounds like a lot. It is not, once you factor in the time needed to inventory your AI vendors, draft documentation requests, wait for vendor responses, conduct impact assessments, and build the compliance file.
Start today. Identify every platform in your operation that uses AI in decisions affecting customers, employees, or applicants. That list is your compliance starting point.
This article is for informational purposes and does not constitute legal advice. For legal advice specific to your situation, consult a licensed Colorado attorney.