UPDATE – FEBRUARY 2026:
Colorado’s Artificial Intelligence Act (SB 24-205) officially took effect on February 1, 2026, after efforts to delay implementation failed. The Colorado Attorney General’s Office has begun implementation through preliminary guidance and public rulemaking processes aimed at clarifying key provisions such as “high-risk AI,” impact assessments, and reasonable care standards. Early 2026 is being treated largely as a transition and compliance-education period, with formal enforcement expectations and detailed rules still under development. Industry groups continue to push for refinements and alignment with broader AI governance frameworks, while lawmakers and regulators gather feedback that may shape future amendments or additional guidance later in 2026.
ORIGINAL NEWS STORY:
Colorado Lawmakers Pass Bill on Consumer Protection from AI
State lawmakers in Colorado have passed a bill that would protect customers from artificial intelligence (AI). The bill, titled “Concerning Consumer Protections in Interactions with Artificial Intelligence Systems”, establishes regulations and requirements for developers and deployers of high-risk AI systems in Colorado to protect consumers from algorithmic discrimination.
Defining Algorithmic Discrimination and High-Risk AI
The law defines algorithmic discrimination as unlawful differential treatment or harmful impact based on traits such as race, gender, or age. High-risk AI includes any system that makes, or heavily influences, consequential decisions. These decisions affect critical areas like education, employment, finance, healthcare, and housing. The law creates separate requirements for developers, who build or significantly modify AI systems, and deployers, who use them in practice.
Requirements for Developers
Developers must exercise reasonable care to avoid discrimination from intended system uses. They must also provide deployers with documentation describing:
-
system capabilities and limits
-
intended purposes and uses
-
training data and evaluation methods
-
discrimination risk assessments
Developers must publicly disclose the high-risk AI systems they create and their risk management practices. They must report known discrimination risks to the Colorado Attorney General and to deployers within 90 days of discovery.
Requirements for Deployers
Deployers must also use reasonable care and create a risk management program to mitigate discrimination. They must conduct annual impact assessments of all high-risk AI systems they deploy. When a system makes consequential decisions about consumers, deployers must provide notice. If the decision is adverse, consumers must receive the reasons, plus an opportunity to correct data or appeal. Deployers must publicly disclose the systems they use and their strategies for managing discrimination risks. They must also notify the Attorney General within 90 days of discovering algorithmic discrimination.
Enforcement and Exemptions
The law allows exemptions for national security, research, compliance with other laws, and regulated financial institutions with equivalent frameworks. The Attorney General will enforce the law as an unfair trade practice. During the first year, violators may correct issues after receiving notice. Developers and deployers may use affirmative defenses if they follow designated AI risk management frameworks and correct violations through testing, feedback, or internal review. The Attorney General may require documentation and create rules for notices, impact assessments, and rebuttable presumptions.
Need Help?
If you’re wondering how Colorado’s bill, or any other AI bill around the world, could impact you, don’t hesitate to reach out to BABL AI. Their Audit Experts are ready to provide valuable assistance while answering your questions and concerns.
