Colorado AI Act and US State AI Laws: The Complete Compliance Guide for 2026

On 1 February 2024, Colorado Governor Jared Polis signed Senate Bill 24-205 — the Colorado Artificial Intelligence Act — into law, making Colorado the first US state to enact comprehensive, cross-sector legislation governing the use of artificial intelligence in high-stakes decision-making. The law takes effect on 30 June 2026, and for any organisation that develops or deploys AI systems affecting Colorado residents, the compliance clock is already ticking.

But Colorado is not acting alone. Across the United States, a wave of state-level AI legislation is reshaping the regulatory environment. From California's frontier-model safety requirements to Illinois's restrictions on AI in video interviews, companies operating nationally now face a patchwork of overlapping — and sometimes conflicting — AI obligations that rivals the complexity European organisations confront under the EU AI Act.

This guide provides a detailed breakdown of Colorado SB 205, the broader US state AI regulatory landscape, and the practical steps to build a compliance programme that works across jurisdictions. If you operate in both the US and EU, see our global AI regulation comparison.

• Colorado SB 24-205 is the most comprehensive US state AI law and takes effect on 30 June 2026. It applies to any entity that develops or deploys "high-risk AI systems" that make or substantially influence "consequential decisions" about Colorado residents.
• Eight domains are covered: employment, lending, housing, insurance, healthcare, education, government services, and legal services. If your AI system operates in any of these areas, you are in scope.
• Developers must document training data, disclose known discrimination risks, report discovered vulnerabilities to deployers and the Colorado Attorney General within 90 days, and publish a public statement about each high-risk system.
• Deployers must implement risk management policies, conduct annual impact assessments, notify consumers when an adverse consequential decision was made or substantially influenced by AI, and provide avenues for appeal and data correction.
• An affirmative defense exists for organisations that follow the NIST AI Risk Management Framework and ISO 42001 (or substantially equivalent frameworks) and maintain a process to discover and cure violations.
• Penalties reach $20,000 per violation (up to $50,000 for violations affecting individuals aged 60 or older), enforced exclusively by the Colorado Attorney General — there is no private right of action.
• Colorado is not alone. Over 700 AI-related bills were introduced across US state legislatures in the 2024–2025 sessions alone, with California, New York, Illinois, Texas, and Connecticut among the most active.
• Practical strategy: build your compliance programme to the EU AI Act as the highest common denominator, then layer Colorado-specific consumer notification and AG reporting requirements on top. Use ISO 42001 and the NIST AI RMF as your operational backbone.

The US state AI regulation landscape in 2026

No federal comprehensive AI law

Despite years of Congressional hearings and multiple draft bills, the United States still lacks a comprehensive federal AI law as of mid-2026. The Biden-era Executive Order 14110 (October 2023) established reporting requirements for frontier AI developers, but executive orders lack the force of statute, and key provisions were rescinded in early 2025.

Federal regulation of AI remains sector-specific: the FDA governs AI in medical devices, the EEOC applies Title VII to algorithmic hiring discrimination, and the FTC uses its Section 5 authority against deceptive AI practices. There is no single federal body — and no single set of rules — that applies horizontally across all AI use cases.

States filling the gap

In the absence of federal action, state legislatures have stepped in aggressively. More than 700 AI-related bills were introduced across 45 states during the 2024–2025 sessions. While many address narrow issues — deepfake election content, government procurement — a growing number impose broad, cross-sector AI governance obligations on private-sector AI developers and deployers.

The most significant of these is Colorado SB 24-205, but it sits within a rapidly evolving ecosystem that includes:

• California SB 53 — safety testing and reporting for frontier AI models
• New York's RAISE Act — proposed comprehensive AI accountability
• Illinois AI Video Interview Act (AIVIRA) — consent and disclosure for AI-analysed job interviews
• Connecticut SB 2 — AI transparency and accountability (signed May 2024)
• Texas HB 1709 — proposed broad-scope AI regulation
• Utah AI Policy Act (SB 149) — AI governance and disclosure requirements (signed March 2024)

The patchwork compliance challenge

For organisations operating nationally, this patchwork creates a multiplied compliance burden: overlapping scopes (a single AI hiring tool may trigger Colorado SB 205, Illinois AIVIRA, and EEOC guidance simultaneously), inconsistent definitions of "high-risk" and "algorithmic discrimination," different enforcement mechanisms, and rapidly changing requirements. The practical implication: building to the strictest standard is the most efficient strategy. For most organisations, this means using the EU AI Act as the compliance ceiling and mapping state-specific requirements as local addenda.

Colorado SB 24-205 — The most comprehensive US state AI law

Colorado SB 24-205, codified at C.R.S. § 6-1-1701 et seq., represents the most far-reaching attempt by any US state to regulate AI across sectors. Unlike narrower state laws that target specific use cases (hiring algorithms, insurance underwriting), Colorado's law applies horizontally to any AI system that makes or substantially influences "consequential decisions."

Effective date: 30 June 2026

The law was signed on 17 May 2024 and takes effect on 30 June 2026. The Colorado AG's office will publish additional rulemaking guidance before the effective date, but organisations should not wait — the statutory requirements are clear enough to act on now.

Scope: "Consequential decisions" in eight domains

SB 205 applies to "high-risk artificial intelligence systems" — defined as any AI system that, when deployed, makes or is a substantial factor in making a "consequential decision" concerning a consumer. The law defines "consequential decision" as a decision that has a material legal or similarly significant effect on a consumer's access to, or the cost, terms, or availability of, services or opportunities in any of the following eight domains.

The eight consequential decision domains

The breadth of these domains means that most enterprise AI applications are in scope if they affect Colorado residents. An AI-powered applicant tracking system, a credit scoring model, an insurance pricing algorithm, or a clinical decision-support tool would all fall within the statute's reach.

Algorithmic discrimination defined

At the centre of SB 205 is the concept of "algorithmic discrimination" — defined as any condition in which the use of an AI system results in an unlawful differential treatment or impact that disfavours an individual or group of individuals on the basis of one or more protected characteristics.

This definition is important because it explicitly ties the Colorado AI Act to existing anti-discrimination law rather than creating a novel standard. If the differential treatment would be unlawful under Title VII, the Fair Housing Act, the Equal Credit Opportunity Act, or Colorado's own Anti-Discrimination Act (C.R.S. § 24-34-301 et seq.), then it constitutes algorithmic discrimination under SB 205 as well.

For guidance on testing your AI systems for bias and discrimination, see our AI bias testing and fairness guide.

Protected characteristics covered

SB 205 covers a broad set of protected characteristics, including:

• Race, colour, ethnicity, and national origin
• Sex, gender identity, and sexual orientation
• Religion and creed
• Disability (physical and mental)
• Age (with enhanced penalties for harm to individuals aged 60+)
• Veteran status
• Familial status
• Genetic information

This list is substantially broader than what some federal anti-discrimination statutes cover in any single domain and aligns closely with the protected characteristics recognised under the EU AI Act's provisions on high-risk systems.

Developer obligations under Colorado SB 205

SB 205 distinguishes between "developers" (entities that design, code, or substantially modify an AI system) and "deployers" (entities that use an AI system to make or inform consequential decisions). This mirrors the provider/deployer distinction in the EU AI Act, though the specific obligations differ.

Developers of high-risk AI systems bear four primary categories of obligation under SB 205.

1. Documentation and disclosure to deployers

Developers must provide deployers with reasonably sufficient documentation to enable the deployer to understand and comply with its own obligations. This documentation must include:

• A general description of the types of high-risk AI systems the developer makes available and the known beneficial uses and foreseeable risks of those systems.
• A high-level summary of the training data used to develop the system, including the types and sources of data.
• Known or reasonably foreseeable limitations of the system, including known circumstances in which the system may produce inaccurate, unreliable, or discriminatory outputs.
• A description of the types of data the system processes as inputs and the outputs it generates.
• Documentation of any evaluations conducted to assess the system's performance, including any testing for algorithmic discrimination across the protected characteristics covered by the law.

This requirement effectively mandates that developers create and maintain technical documentation analogous to what the EU AI Act requires under Annex IV — though the Colorado requirements are somewhat less prescriptive in format.

2. Disclosure of known discrimination risks

If a developer discovers — or receives a credible report — that a high-risk AI system it has developed has caused or is reasonably likely to cause algorithmic discrimination, the developer must disclose this information to:

• The Colorado Attorney General
• All known deployers of the system

This disclosure must be made within 90 days of the discovery. The 90-day clock begins when the developer has "actual knowledge" or "reasonably should have known" of the discrimination risk — a standard that incentivises proactive monitoring rather than wilful ignorance.

3. Public statement about high-risk systems

Developers must make publicly available, on their website or through other easily accessible means, a statement describing:

• The types of high-risk AI systems they have developed or intentionally and substantially modified.
• How those systems manage known or reasonably foreseeable risks of algorithmic discrimination.

This public transparency requirement goes beyond what most US laws require and is comparable to the transparency obligations under Article 50 of the EU AI Act.

4. Duty of care in design and documentation

While SB 205 does not prescribe specific technical standards for AI development, it establishes a general duty of care — developers must use "reasonable care" to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. This duty is assessed in light of the developer's role, the system's intended use, and the developer's ability to influence the system's operation once deployed.

Deployer obligations under Colorado SB 205

Deployers — the organisations that actually use high-risk AI systems to make or substantially influence consequential decisions — face the most detailed and operationally demanding set of obligations under SB 205.

1. Risk management policy

Every deployer of a high-risk AI system must implement and maintain a risk management policy that governs its use of AI in consequential decisions. The policy must be reasonably designed to:

• Identify and mitigate known or reasonably foreseeable risks of algorithmic discrimination.
• Be proportionate to the size and complexity of the deployer's organisation, the nature of the AI system, and the sensitivity of the data processed.

This is a principles-based requirement — SB 205 does not prescribe a specific risk management methodology, but the NIST AI Risk Management Framework and the ISO 42001 standard are explicitly referenced as frameworks that, if followed, can provide an affirmative defense.

2. Annual impact assessments

Deployers must complete an impact assessment for each high-risk AI system they use. These assessments must be:

• Completed before the system is deployed for the first time.
• Updated annually or whenever a significant modification is made to the system.
• Retained for at least three years after the last deployment of the system.

Each impact assessment must include:

These impact assessments are comparable in structure to the Fundamental Rights Impact Assessments (FRIAs) required under the EU AI Act — and organisations subject to both regimes can achieve significant efficiency by harmonising their assessment processes.

3. Consumer notification requirements

SB 205's consumer notification provisions are among the most prescriptive of any US AI law. When a deployer uses a high-risk AI system to make or substantially influence a consequential decision that is adverse to a consumer, the deployer must provide the consumer with:

• A statement that an AI system was used to make or substantially influence the decision.
• A description of the AI system's role in the decision, in plain language.
• Contact information for the deployer, so the consumer can request more information.
• An opportunity to correct any incorrect personal data that the AI system processed.
• An opportunity to appeal the adverse decision and obtain human review.

The notification must be provided at or before the time the adverse decision is communicated. Deployers should build these disclosures into existing customer-facing decision workflows.

4. Attorney General reporting

If a deployer discovers that a high-risk AI system it uses has caused algorithmic discrimination, it must notify the Colorado Attorney General within 90 days of the discovery. The report must include the nature of the discrimination, the system involved, the number of consumers affected (if known), and the steps taken to mitigate the harm.

The NIST/ISO affirmative defense

One of SB 205's most notable provisions is its affirmative defense — a legal mechanism that allows developers and deployers to avoid liability if they can demonstrate that they followed recognised AI governance frameworks.

Requirements for the defense

To invoke the affirmative defense, an organisation must prove three things:

1. Framework compliance: The organisation has adopted and complied with the NIST AI Risk Management Framework (AI RMF 1.0) and ISO/IEC 42001:2023 (the international standard for AI management systems), or frameworks that are substantially equivalent in rigour and scope.

2. Discovery and cure process: The organisation has implemented a process to discover and cure any violations of the law, including ongoing monitoring and testing for algorithmic discrimination.

3. Good faith remediation: When a violation is discovered through this process, the organisation has taken timely and reasonable corrective action to address it.

What this means in practice

The affirmative defense is not a safe harbour — it does not immunise organisations from investigation. Rather, it is a defense raised after the Attorney General has initiated an enforcement action. Organisations that invest in structured AI governance gain a defensible legal position if problems arise.

For organisations building compliance programmes from scratch, the defense provides a clear roadmap:

1. Implement NIST AI RMF — map your AI systems through the four core functions: Govern, Map, Measure, and Manage. See our AI governance framework guide for step-by-step instructions.
2. Certify to ISO 42001 — or implement its requirements substantively, even without formal certification. Our ISO 42001 certification guide covers the process in detail.
3. Establish ongoing monitoring — deploy bias testing, drift detection, and fairness auditing tools on a continuous or periodic basis. See our bias testing guide for methodologies.
4. Document remediation efforts — when issues are found, document the finding, the root cause analysis, the corrective action taken, and the outcome. This paper trail is what makes the defense credible.

For organisations already pursuing EU AI Act compliance, the overlap is significant — EU harmonised standards draw heavily from ISO 42001 and align with NIST AI RMF principles. Building a single governance framework to satisfy both regimes is the recommended approach.

Penalties and enforcement

Fine structure

The Colorado Attorney General may pursue civil enforcement actions for violations of SB 205, with penalties structured as follows:

Each individual consumer affected counts as a separate violation, meaning that a single discriminatory AI system deployed at scale could generate penalty exposure in the millions of dollars.

Attorney General exclusive enforcement

Critically, SB 205 does not create a private right of action. Individual consumers cannot sue developers or deployers directly under the Colorado AI Act. Enforcement authority rests exclusively with the Colorado Attorney General, who can investigate potential violations, issue civil investigative demands, and file enforcement actions in state court.

While this means individual lawsuits are not a direct risk, an AG enforcement action carries significant reputational risk and can result in consent decrees and mandatory compliance programmes.

SME partial exemption

SB 205 includes a partial exemption for small and medium enterprises. Organisations with fewer than 50 full-time employees are exempt from certain requirements, including some of the more burdensome annual impact assessment and risk management policy obligations. However, the exemption is partial — SMEs remain subject to the core prohibition on algorithmic discrimination and the consumer notification requirements.

SME deployers must still:

• Provide consumer notification for adverse AI-influenced decisions
• Report known algorithmic discrimination to the AG within 90 days
• Refrain from using AI systems in a manner that causes unlawful discrimination

For startups and smaller companies navigating AI compliance more broadly, see our EU AI Act compliance guide for startups and SMEs for additional strategies.

Other key US state AI laws

While Colorado SB 205 is the most comprehensive, several other states have enacted or are advancing significant AI legislation that organisations must track.

California SB 53 — Frontier AI safety testing and reports

California SB 53 (signed into law in 2025) targets frontier AI models — large-scale models with capabilities that exceed defined compute thresholds. The law requires developers of covered models to conduct pre-deployment safety testing (including red-teaming for catastrophic risk scenarios), publish safety reports, implement kill switch mechanisms for rapid shutdown, and maintain incident reporting processes. SB 53 is narrower than Colorado SB 205 — it applies only to frontier model developers, not deployers — but California's influence on the tech industry means its requirements are likely to become de facto national standards.

New York RAISE Act

New York's Responsible AI Safety and Education (RAISE) Act is a proposed comprehensive AI accountability bill that would establish a state AI registry, algorithmic impact assessments before deployment, consumer notification rights similar to Colorado's, and — critically — a private right of action allowing individuals to sue directly. As of early 2026, the RAISE Act remains under committee review, but if enacted, its private right of action would make it the most plaintiff-friendly AI law in the country.

Illinois AI Video Interview Act (AIVIRA)

Illinois was an early mover with the Artificial Intelligence Video Interview Act (820 ILCS 42/), effective 1 January 2020. The law requires employers using AI to analyse video interviews to notify each applicant, explain what the AI evaluates, obtain written consent, limit video distribution to qualified reviewers, and destroy recordings within 30 days of an applicant's request. AIVIRA is narrowly focused on video interviews, but it established the template for AI consent-and-disclosure requirements that subsequent state laws have built upon.

Texas, Connecticut, and other emerging bills

Comparison table: Key US state AI laws

EU AI Act vs Colorado AI Act comparison

For organisations subject to both regimes, understanding the overlap and divergence between the EU AI Act and Colorado SB 205 is essential for building an efficient, unified compliance programme.

How to comply with both simultaneously

The good news is that an organisation compliant with the EU AI Act will already meet the majority of Colorado SB 205's requirements. The key additions for dual compliance are:

1. Consumer notification: The EU AI Act's transparency requirements (Article 50) focus on disclosure that AI is being used, but Colorado's requirements are more prescriptive — you must disclose the AI's role, provide contact information, and offer appeal and data correction rights specifically for adverse decisions.

2. AG reporting: The EU AI Act requires reporting to national competent authorities; Colorado requires separate reporting to the state Attorney General within 90 days. Build this into your incident response process as a parallel notification workflow.

3. NIST AI RMF alignment: If you are primarily using EU harmonised standards, map them to the NIST AI RMF to ensure the affirmative defense is available. Our guide on building an AI governance framework covers the crosswalk between NIST, ISO 42001, and the EU AI Act's requirements.

4. Impact assessment harmonisation: Use the EU FRIA as the base template and extend it with Colorado-specific fields (discrimination risk analysis across the eight covered domains, remediation documentation for the affirmative defense). See our FRIA guide for the base template.

Implementation roadmap

For organisations preparing for Colorado SB 205 compliance by the 30 June 2026 effective date, the following phased roadmap provides a structured approach.

Phase 1: Discovery and scoping (now – Q2 2026)

• Inventory all AI systems that make or substantially influence decisions about Colorado residents. See our AI systems inventory guide for methodology.
• Classify each system as high-risk (consequential decision in one of the eight domains) or out of scope.
• Identify your role for each system: developer, deployer, or both.
• Map existing compliance assets — if you have EU AI Act documentation, NIST AI RMF mappings, or ISO 42001 certifications, catalog what already satisfies Colorado requirements.

Phase 2: Governance framework (Q2 2026)

• Adopt or update your risk management policy to explicitly address algorithmic discrimination in the eight covered domains.
• Align to NIST AI RMF and ISO 42001 to establish the affirmative defense. If you are already certified to ISO 42001, document the alignment. If not, begin the implementation process — see our ISO 42001 guide.
• Designate accountable roles — assign individuals responsible for AI governance, impact assessments, AG reporting, and consumer notification.

Phase 3: Impact assessments and testing (Q2 2026)

• Complete initial impact assessments for all high-risk AI systems before the effective date.
• Conduct algorithmic discrimination testing across all protected characteristics. Document methodology, results, and mitigation steps. See our bias testing guide.
• Establish ongoing monitoring schedules — define the cadence for re-testing (at minimum annually, per the statute).

Phase 4: Consumer-facing processes (Q2 2026)

• Build consumer notification workflows into every process where AI makes or substantially influences adverse consequential decisions.
• Implement appeal and human review mechanisms — ensure that consumers can contest adverse AI-influenced decisions and have them reviewed by a human.
• Create data correction processes — consumers must be able to correct inaccurate personal data used by AI systems.

Phase 5: Reporting and documentation (ongoing from 30 June 2026)

• Establish AG reporting procedures — define the internal process for identifying reportable incidents and filing with the Colorado AG within 90 days.
• Publish public statements (developers) about high-risk AI systems and discrimination risk management.
• Archive impact assessments — retain all assessments for at least three years.
• Schedule annual reassessments — set calendar reminders for annual impact assessment updates and risk management policy reviews.

Quick-start: Assess your AI risk exposure

Not sure whether your AI systems fall within the scope of Colorado SB 205 or the EU AI Act? Use our free AI Act risk classification tool to evaluate your systems in under five minutes and get an initial compliance roadmap.

Does Colorado SB 205 apply to my company if we're not based in Colorado?

Yes, if your AI system makes or substantially influences consequential decisions about Colorado residents. Like many consumer protection statutes, SB 205 applies based on the location of the affected consumer, not the location of the company. If you deploy an AI-powered hiring tool that evaluates applications from Colorado residents, you are a deployer subject to SB 205 — regardless of whether your company is headquartered in California, New York, or anywhere else.

How does "algorithmic discrimination" differ from traditional employment discrimination?

The legal standard is the same — the discrimination must be unlawful under existing anti-discrimination law. What SB 205 adds is a proactive framework: rather than litigating after the fact, developers and deployers must test for, monitor, disclose, and mitigate algorithmic discrimination before and during deployment. The impact assessments, consumer notification, and AG reporting create a continuous compliance cycle that traditional anti-discrimination law lacks.

Can I satisfy Colorado requirements by complying with the EU AI Act?

Substantially, yes — but not entirely. EU AI Act compliance covers most governance, documentation, and risk management requirements. However, Colorado adds specific requirements: the consumer notification format for adverse decisions (including appeal and data correction rights), the 90-day AG reporting obligation, and the NIST AI RMF/ISO 42001 affirmative defense. Layer these on top of your EU programme. See our EU AI Act compliance checklist for the base framework.

What qualifies as an "adverse" consequential decision?

SB 205 does not provide an exhaustive definition, but the legislative intent is clear: an adverse decision is one that negatively affects the consumer — a denied loan, a rejected job candidacy, a higher insurance premium, or a denied benefits claim. When in doubt, err on the side of notification — the cost of providing notice is minimal compared to the enforcement risk of failing to do so.

Do open-source AI developers have obligations under SB 205?

Potentially, yes. SB 205's developer obligations apply to entities that "design, code, or substantially modify" high-risk AI systems. If an open-source developer creates a model specifically intended for consequential decisions — such as a credit scoring model — the developer obligations apply. However, a developer of a general-purpose open-source model not specifically designed for consequential decisions is less likely to be in scope. The distinction turns on intended use and foreseeability.

How does Colorado SB 205 interact with federal AI regulation?

SB 205 explicitly provides that it does not preempt or limit any federal law. Federal agencies retain full enforcement authority in their respective domains, meaning a single AI system could simultaneously be subject to Colorado SB 205, federal sector-specific regulations, and other state laws. This reinforces the case for building a unified AI governance framework that satisfies the strictest applicable standard.

Next steps

The Colorado AI Act represents a watershed moment in US AI regulation — the first comprehensive, cross-sector state law that imposes detailed governance, transparency, and anti-discrimination obligations on both AI developers and deployers. With the 30 June 2026 effective date approaching, organisations should act now to:

1. Audit your AI systems against the eight consequential decision domains.
2. Build or extend your AI governance framework around NIST AI RMF and ISO 42001.
3. Conduct bias testing and document the results.
4. Implement consumer notification and appeal processes for adverse AI-influenced decisions.
5. Establish AG reporting workflows for discovered discrimination.

The organisations that prepare early will not only avoid enforcement risk — they will build the governance muscle needed to navigate the expanding patchwork of US state AI laws and the EU AI Act.

Ready to assess your compliance posture? Start with our free AI Act risk assessment tool or explore our EU AI Act compliance checklist.

This article is for informational purposes only and does not constitute legal advice. Consult qualified legal counsel for advice specific to your circumstances. For a global perspective, see our AI Regulation Compared: EU, US, UK, China guide.