Colorado’s AI Act takes effect on June 30, 2026 – making it the first comprehensive, state-level artificial intelligence law in the United States to actually go live. If your company uses AI to make decisions about people’s jobs, loans, housing, health care, or education, you now have legal obligations in Colorado. And if you’re a Colorado resident, you now have rights you didn’t officially have yesterday.
I’ve been watching this law wind through amendments, delays, and a full rewrite for the past two years. What strikes me most isn’t the fine print – it’s what it signals. The U.S. has spent years watching Europe build its AI regulation framework from the top down. Colorado just built a floor from the bottom up. The rest of the country is watching.
What Is the Colorado AI Act?
The Colorado Consumer Protections for Artificial Intelligence Act (Senate Bill 24-205) was signed into law on May 17, 2024. It was the first bill of its kind in the U.S. – a state-level framework that specifically addresses how AI systems can harm people in high-stakes situations.
The core concern is what the law calls “algorithmic discrimination.” That’s when an AI system treats you differently – and worse – based on your race, gender, age, disability, religion, or other protected characteristics. Think about a lending algorithm that approves fewer mortgages for minority applicants, or a hiring tool that filters out women from engineering roles. That’s the kind of harm this law is designed to prevent.
The law applies to “high-risk AI systems” – meaning AI tools that play a substantial role in making or influencing “consequential decisions.” The law defines those broadly: decisions that meaningfully affect access to education, employment, financial services, housing, health care, insurance, or government services. In other words, anywhere that being denied or approved actually changes your life.
Who Does This Apply To?
The law splits obligations between two categories of actors: developers and deployers.
A developer is a company or person that creates or substantially modifies a high-risk AI system. They have to maintain transparency about how their systems work – their limitations, known risks, and the types of data used to train them. If they discover their AI could cause discrimination, they have 90 days to notify the Colorado Attorney General and all known users of that system. They also have to maintain a public-facing webpage summarizing the types of high-risk systems they develop.
A deployer is any business that actually uses one of these AI systems to make decisions affecting Colorado residents. Deployers have to conduct and document impact assessments for every high-risk AI they use. They need to be upfront with people when AI is involved in a decision. And they have to let consumers challenge adverse decisions and request a human review – no hiding behind an algorithm and calling it final.
One thing that surprised me when I first read through the requirements: the law’s reach isn’t limited to Colorado-based companies. Any company making consequential decisions about Colorado residents using high-risk AI falls under this framework. That’s a meaningful scope.
What Consumers Actually Get
As a consumer, here’s what the Colorado AI Act gives you starting June 30:
- The right to know: If a business is using AI to interact with you or make decisions about you, they have to disclose it. No more “our team has carefully reviewed your application” when it was really a model that ran your data through a scoring function.
- The right to appeal: If an AI-influenced decision goes against you – denied for a loan, rejected for a job, flagged by an insurance algorithm – you have the right to appeal that decision and get a human to look at it.
- The right to correct your data: If the AI used inaccurate information about you to reach a decision, you can request that data and have factual errors corrected.
These aren’t revolutionary rights in isolation. What makes them significant is that they exist now, in law, with the Colorado Attorney General as the enforcement arm. Violations are treated as deceptive trade practices under Colorado’s existing Consumer Protection Act. That gives it teeth.
Quick Reference: Colorado AI Act at a Glance
| Category | Detail |
|---|---|
| Law Name | Colorado Consumer Protections for AI Act (SB24-205) |
| Effective Date | June 30, 2026 |
| Applies To | High-risk AI used in consequential decisions affecting CO residents |
| Key Obligations | Impact assessments, consumer disclosure, appeal rights, discrimination prevention |
| Consequential Decisions Cover | Education, employment, housing, financial services, health care, insurance, government services |
| Enforcement | Colorado Attorney General via Consumer Protection Act |
| Who It Covers | Developers + Deployers of high-risk AI systems |
| Updated Version | SB26-189 (effective January 1, 2027) |
The Plot Twist: Colorado Already Rewrote the Law
Here’s where it gets interesting. Just as SB24-205 was about to go live, Colorado passed a completely rewritten version of the law. Governor Jared Polis signed Senate Bill 26-189 in May 2026 – and it goes into effect January 1, 2027.
SB26-189 takes a different approach. Instead of focusing on “high-risk AI systems,” it centers on “automated decision-making technology” (ADMT) – a narrower and more precisely defined term. It also drops three of the biggest compliance burdens from the original law: risk management programs, formal impact assessments, and the requirement to use “reasonable care” to prevent algorithmic discrimination.
Some consumer advocates see this as a weakening. Others argue it’s a more practical framework that businesses can actually implement. The truth is probably both: the new law is more targeted, with clearer definitions and a tighter scope, but it also asks less of companies than the original did.
What stays in place under SB26-189: pre-use notice to consumers, post-adverse-decision notification within 30 days, the right to access and correct personal data, and the right to request human review. The core consumer protections survive the rewrite.
So right now, we’re in a brief window where SB24-205 is the active law – and SB26-189 replaces it in six months. If you’re a business trying to get compliant, you’re really building toward the January 2027 framework, while technically needing to meet the June 30 requirements today. That’s a genuinely messy compliance situation, and it’s worth getting legal counsel if AI touches any of the covered decision categories in your business.
Why This Matters Beyond Colorado
Twenty-five states had AI-related bills moving through their legislatures as of early 2026. Colorado finishing first matters because it creates a template – or a cautionary tale, depending on who you ask – for every other state watching how this unfolds.
The federal picture remains fragmented. The Great American AI Act is still working through Congress, and there’s no single federal AI consumer protection law on the books yet. That gap is exactly why state-level action like Colorado’s carries so much weight right now.
If you’re following the development of AI systems and want to understand what they actually do under the hood, understanding how AI agents work is a useful foundation – because the systems making these consequential decisions are increasingly agentic, not just simple classifiers.
The Colorado Attorney General’s office has set up a dedicated AI rulemaking page at coag.gov/ai where you can track the ongoing rulemaking process and find guidance for businesses trying to comply.
What Happens If a Company Doesn’t Comply?
The enforcement mechanism runs through Colorado’s Consumer Protection Act. A violation of the AI Act is treated as a deceptive trade practice – the same category as false advertising or deceptive pricing. The Attorney General can investigate, issue civil penalties, and seek injunctive relief.
Importantly, there’s no private right of action in the current law. Individual consumers can’t sue a company directly for violating the AI Act; they have to go through the AG’s office. That limits how aggressive enforcement will actually be in the near term, but it also means the state is the gatekeeper on how this gets applied.
The law does include a one-year cure period – running from June 30, 2026 to June 30, 2027 – during which businesses that discover and disclose violations in good faith can potentially avoid penalty. That’s a grace period, not a free pass, but it does signal that the intent is compliance, not punishment.
Frequently Asked Questions
Does the Colorado AI Act apply to companies outside Colorado?
Yes. The law covers any company using high-risk AI systems to make consequential decisions affecting Colorado residents, regardless of where the company is based. If you’re using an AI hiring tool and your candidate pool includes Coloradans, this law applies to you.
What qualifies as a “high-risk AI system” under this law?
A high-risk AI system is one that makes or substantially contributes to a “consequential decision” – which the law defines as decisions related to education, employment, financial services, housing, health care, insurance, or government services. Systems used for advertising or entertainment generally don’t qualify.
What’s the difference between SB24-205 and SB26-189?
SB24-205 (in effect June 30, 2026) uses a “high-risk AI systems” framework with broad requirements including impact assessments and discrimination prevention duties. SB26-189 (effective January 1, 2027) replaces it with a narrower “automated decision-making technology” framework that drops the impact assessment requirement but keeps core consumer notice and appeal rights.
How will the Colorado AI Act actually be enforced?
Enforcement runs through the Colorado Attorney General’s office under the Consumer Protection Act. There’s no private right of action – meaning individual consumers can’t sue companies directly. The AG can investigate complaints, impose civil penalties, and seek court orders. A one-year cure period runs through June 30, 2027, giving compliant businesses a path to correct violations before facing penalties.
Sofia follows emerging technology, from AI and VR to IoT and blockchain, and translates the hype into plain language. She cares about what these tools mean for everyday users, not just the headlines.