Colorado AI Act Takes Effect for High-Risk Systems

For most ML and data teams, the binding constraint on a deployed model has been accuracy, latency, and cost. Colorado's AI Act adds a fourth axis that is now legally enforceable: demonstrable care against discriminatory outcomes in high-risk decisions. If a system contributes to a consequential decision about employment, lending, housing, healthcare, education, insurance, or legal services, the law treats model governance, documentation, and impact assessment as compliance artifacts rather than optional hygiene. That reframes work that data scientists often defer, such as bias testing, data-provenance records, and model cards, into deliverables with a regulator attached.

Senate Bill 24-205, the Consumer Protections for Artificial Intelligence Act, became effective on June 30, 2026 after Colorado Governor Jared Polis signed SB 25B-004 in 2025 to postpone the original February 1, 2026 start date. Per the Colorado General Assembly bill text, the law requires a developer of a high-risk AI system to use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination, and imposes a parallel duty on deployers that put those systems into use. A high-risk system is defined by its role in making, or being a substantial factor in making, a consequential decision affecting a consumer.

Developers are expected to give deployers the documentation needed to complete impact assessments, including intended uses, known limitations, and data governance summaries. Deployers are expected to maintain risk-management programs, run impact assessments, notify consumers when a high-risk system is used in a consequential decision, and offer avenues to correct data or appeal adverse outcomes. The Colorado Attorney General holds enforcement authority, and the statute frames violations as unfair trade practices rather than creating a broad private right of action.

Colorado is already rewriting this framework. Governor Polis signed SB 26-189 in 2026, which substantially revises the state's AI rules and is set to take effect January 1, 2027, effectively superseding much of SB 24-205. Practitioners should therefore treat the current obligations as live but transitional, and watch the 2027 framework for changed definitions and duties.

Colorado is the first US state to switch on comprehensive high-risk AI obligations, and other states have watched its drafting closely. Even teams with no Colorado footprint should expect the document-your-model expectations modeled here, such as impact assessments and discrimination testing, to propagate into other jurisdictions and into enterprise procurement requirements.