Colorado AI Act
Enacted Colorado · In force Jan 1, 2027 · next deadline Jan 1, 2027 (in 3 months)
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Colorado's 2024 high-risk AI law (risk-management programs, impact assessments) never took effect: it was delayed to June 30, 2026 and then repealed and reenacted by SB 26-189, signed May 14, 2026, as a narrower automated decision-making technology (ADMT) law. From January 1, 2027, developers must give deployers technical documentation (intended uses, training data categories, limitations) and deployers must notify consumers at the point of interaction, explain ADMT's role within 30 days after an adverse outcome, and offer data correction and meaningful human review. Impact-assessment and risk-management-program mandates were dropped; 3-year record retention remains.
- Who it applies to
- Developers and deployers of covered ADMT that processes personal data to materially influence consequential decisions about Colorado consumers in education, employment, housing, financial/lending services, insurance, health care and essential government services. No revenue or volume threshold identified. SB 26-189 removed the federally-regulated-entity exemptions in SB 24-205.
- Penalties
- Violations are deceptive trade practices under the Colorado Consumer Protection Act (civil penalties under C.R.S. 6-1-112). No private right of action. Until January 1, 2030 the AG must give a 60-day notice and opportunity to cure where a cure is possible.
- Enforced by
- Colorado Attorney General (exclusive)
- Official name
- Colorado SB 24-205 (Consumer Protections for Artificial Intelligence), as delayed by SB 25B-004 and repealed and reenacted by SB 26-189 (Automated Decision-Making Technology)
- Citation
- SB 24-205 (2024); SB 25B-004 (2025 1st Extraordinary Session); SB 26-189 (2026); C.R.S. Title 6, Art. 1, Part 17
- Topics
- ai, privacy
Research notes
SB 24-205's high-risk AI obligations never became operative. SB 26-189 was signed May 14, 2026, which is why the June 30, 2026 date never took effect. Specific Colorado AG rulemaking hearing dates under SB 26-189 were not verified. The per-violation civil penalty amount comes from the general Colorado CPA and is not restated in SB 26-189.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado Privacy Act (CPA)Questions about Colorado AI Act
- What are the Colorado AI Act compliance deadlines?
- May 17, 2024: SB 24-205 signed. Aug 28, 2025: SB 25B-004 delays the act. Feb 1, 2026: Original effective date (superseded). May 14, 2026: SB 26-189 signed (repeal and reenact). Jun 30, 2026: Delayed effective date (superseded). Jan 1, 2027: ADMT obligations apply. Jan 1, 2027: AG rules due. Jan 1, 2030: Mandatory cure period ends.
- When does Colorado AI Act take effect?
- Colorado AI Act takes effect on Jan 1, 2027. The next milestone is Jan 1, 2027: ADMT obligations apply.
- Who does Colorado AI Act apply to?
- Developers and deployers of covered ADMT that processes personal data to materially influence consequential decisions about Colorado consumers in education, employment, housing, financial/lending services, insurance, health care and essential government services. No revenue or volume threshold identified. SB 26-189 removed the federally-regulated-entity exemptions in SB 24-205.
- What are the penalties under Colorado AI Act?
- Violations are deceptive trade practices under the Colorado Consumer Protection Act (civil penalties under C.R.S. 6-1-112). No private right of action. Until January 1, 2030 the AG must give a 60-day notice and opportunity to cure where a cure is possible.