Colorado AI Act (SB 24-205, now SB 26-189)

• SB 24-205 (2024), often called the Colorado AI Act or CAIA, was the first broad US state law on "high-risk" AI. It required developers and deployers to use reasonable care against algorithmic discrimination, with risk programs, impact assessments, notices, appeals and reports to the Attorney General (AG).
• Its start date moved twice: from 1 Feb 2026 to 30 Jun 2026 (SB 25B-004, Aug 2025 special session), and then the whole framework was repealed and reenacted by SB 26-189, signed 14 May 2026.
• SB 26-189 is the law that matters now. It replaces "high-risk AI" with covered ADMT: technology that uses personal data to produce scores, rankings or recommendations that materially influence a consequential decision (jobs, education, housing, lending, insurance, health care, government benefits).
• The new law is mostly about transparency and redress: developer documentation, a notice before use, a plain explanation within 30 days of an adverse outcome, data correction, meaningful human review, and 3-year record keeping.
• It drops the duty of care, the risk management program, impact assessments, AG reporting of discovered discrimination and the NIST / ISO affirmative defense.

• Developers: anyone doing business in Colorado who builds, sells, licenses or substantially modifies a covered ADMT, or builds a component marketed for use in one (6-1-1701(8)). Developer duties only bite where the tool was marketed, configured or contracted for consequential decisions (6-1-1702(3), (5)).
• Deployers: anyone doing business in Colorado who uses a covered ADMT (6-1-1701(7)).
• Consumers protected: Colorado residents, including employees and Colorado-resident job applicants, plus anyone whose access to an opportunity in Colorado is evaluated by a business operating there (6-1-1701(4)).
• Extraterritorial: yes. The test is "doing business in Colorado", not where the company is based. An Indian vendor whose hiring or lending tool is used on Colorado residents is a developer under this law.
• Carve-outs and safe routes: insurers already under C.R.S. 10-3-1104.9 are treated as compliant for insurance practice; HIPAA covered entities are mostly exempt except for employment decisions (they owe a general patient notice); FDA-regulated medical devices are out; ECOA / FCRA adverse action notices can satisfy the notice duties for credit; FERPA processes satisfy education duties (6-1-1704(6), (9); 6-1-1708).
• Not covered ADMT: security tools, spreadsheets without ML, tools that only summarise or route information for a human, chatbots that are contractually barred from consequential decisions, and low-stakes uses like scheduling, marketing and fraud or AML screening (6-1-1701(2)(b), (3)(b)).

• Who enforces: the AG only, through the Colorado Consumer Protection Act (6-1-1706(1)). A violation is a deceptive trade practice (new 6-1-105(1)(uuuu)).
• Amounts: not stated in SB 26-189 or SB 24-205. They come from the general Consumer Protection Act; secondary sources quote up to USD 20,000 per violation, not verified here against C.R.S. 6-1-112.
• Cure period: before acting, the AG must send a notice of violation where a cure is possible and wait 60 days. No cure period for knowing or repeated violations. A cure within 60 days can still reduce penalties in court. This clause lapses on 2030-01-01 (6-1-1706(3)).
• No new private lawsuits (6-1-1706(4), 6-1-1709), but existing anti-discrimination claims still apply, and 6-1-1707 now says how fault is split between developer and deployer in those claims. Contract clauses that make the other party indemnify you for your own discrimination are void (6-1-1707(7)).
• AG rulemaking: rules on adverse outcome disclosures and consumer rights are due by 2027-01-01 (6-1-1704(4)(b), 6-1-1705(3)). The interim draft (6 Oct 2026) presumes "material influence" in some cases (draft Rule 6.1, per secondary summary) and expects notices in the languages the business normally uses (draft Rule 3.2(A)).

• HR-tech and assessment SaaS (resume screening, video interview scoring, test scoring) sold to US employers with Colorado staff or applicants: you are a developer. From 1 Jan 2027 you must hand each customer documentation on intended and harmful uses, training data categories, limits and human review instructions, and tell them about material updates. Keep version IDs and changelogs for 3 years.
• Lending, insurance and fintech scoring engines used by US lenders: same developer duties. Your customer may lean on ECOA adverse action notices, but will still need your inputs to explain the ADMT's role.
• IT services firms building custom models for US clients: if you "intentionally and substantially modify" a tool so it becomes covered ADMT, you can become the developer.
• If you employ people in Colorado (for example a US subsidiary) and use AI in hiring or promotion, you are a deployer: notice, 30-day explanation, correction and human review.
• Contracts: expect US customers to rewrite AI clauses. Mutual indemnities for your own discriminatory outputs are void in Colorado, and fault is split by relative blame.
• Do not throw away NIST / ISO work. The legal safe harbour disappeared with SB 24-205, but ISO/IEC 42001 and NIST AI RMF and GenAI Profile artefacts are still the easiest way to produce the documentation and records this law asks for.

Current law: SB 26-189, applying to consequential decisions made on or after 2027-01-01. References are to C.R.S. Title 6, Article 1, Part 17 as reenacted.

• ADMT inventory showing each tool, its decision domain, whether it is "covered" and why any exclusion applies.
• Developer documentation pack delivered to each deployer, with dates and the version it describes.
• Material update notices or release notes, with proof of direct notice to each deployer.
• Record retention schedule showing at least 3 years for version IDs, changelogs and decision records.
• Copy and placement of the pre-use notice (job posting, application page, loan form) with screenshots.
• Adverse outcome notice template, plus a log proving notices went out within 30 days.
• Request handling log for data access, correction and human review requests, with outcomes.
• Human reviewer training records and a written review procedure showing reviewers can override.
• Accessibility and translation checks on notices.
• Contract clauses with vendors or customers on documentation, updates and liability allocation.
• A watch note on the AG's 4 CCR 904-6 rules and the changes made after they are final.

• Building a full SB 24-205 program (impact assessments, AG reporting) and calling it "Colorado compliance", while missing the 30-day explanation and human review steps that SB 26-189 actually requires.
• SB 26-189 replaced SB 24-205 in the same part of the statute book.
• Assuming a company based outside Colorado is out of scope. "Doing business in Colorado" is enough.
• Assuming the vendor carries the risk. The deployer owns the notices and human review; indemnities for your own discrimination are void.
• Giving reviewers a "rubber stamp" role. The law requires a reviewer who does not default to the system's output.
• Forgetting that the AG's final rules may add detail to notices; templates written in 2026 will need a refresh.

• ADMT (automated decision-making technology): software that uses personal data and computation to produce scores, rankings, predictions or recommendations used in decisions about a person.
• Covered ADMT: ADMT that materially influences a consequential decision.
• Consequential decision: a decision about access to, eligibility for, or price of education, jobs, housing, lending, insurance, health care or government services.
• Materially influence: the output is a more than trivial factor and actually changes how the decision is made.
• Adverse outcome: a denial, cut, or noticeably worse terms compared with similar people.
• Meaningful human review: review by a trained person with power to change the decision, who weighs real evidence instead of copying the system output.
• Algorithmic discrimination: unlawful unequal treatment caused by an AI system (the core concept of SB 24-205).
• Cure period: time the regulator must give you to fix a problem before suing.
• Deceptive trade practice: conduct the Colorado Consumer Protection Act treats as unlawful, enforceable by the AG.

• SB 24-205 never got enforced. SB 26-189 repealed and reenacted it; plan for 1 Jan 2027.
• The new law is a notice-and-redress law: documentation, pre-use notice, 30-day explanation, data correction, human review, 3-year records.
• Reach is wide: any business doing business in Colorado, including Indian vendors whose tools are used on Colorado residents.
• No NIST / ISO safe harbour any more, but ISO 42001 and NIST AI RMF evidence still makes compliance much cheaper.

• SB26-189 Automated Decision-Making Technology, bill page, accessed 2026-10-19
• SB26-189 signed act (PDF), accessed 2026-10-19
• SB24-205 Consumer Protections for Artificial Intelligence, bill page, accessed 2026-10-19
• SB24-205 signed act (PDF), accessed 2026-10-19
• SB25B-004 Increase Transparency for Algorithmic Systems, bill page, accessed 2026-10-19
• Colorado AG, ADMT and Chatbot Safety Rulemaking page, accessed 2026-10-19
• Secondary, for the xAI court order only: McDermott Will and Schulte, "Colorado AI law in flux", accessed 2026-10-19