UPDATE — JULY 2025: Colorado’s AI consumer protection law—Senate Bill 24-205 (Colorado Artificial Intelligence Act)—was signed in May 2024. As of mid-2025, the law is still under review.
It is scheduled to take effect on February 1, 2026. However, Governor Jared Polis and state leaders have urged a delay until January 2027. Lawmakers introduced a follow-up bill (SB 25-318) to push back the effective date and ease compliance requirements. That measure failed in May 2025, leaving the original law intact.
The Colorado Attorney General will enforce the law. It creates the nation’s first compliance obligations for developers and deployers of high-risk AI systems.
Industry groups continue to lobby for adjustments through rulemaking and regulatory guidance before enforcement begins. The measure has become a national model for algorithmic fairness and AI accountability, even as its future depends on ongoing negotiations and public input.
ORIGINAL NEWS STORY:
Colorado Lawmakers Pass Bill on Consumer Protection from AI
State lawmakers in Colorado have passed a bill that would protect customers from artificial intelligence (AI). The bill, titled “Concerning Consumer Protections in Interactions with Artificial Intelligence Systems”, establishes regulations and requirements for developers and deployers of high-risk AI systems in Colorado to protect consumers from algorithmic discrimination.
Defining Algorithmic Discrimination and High-Risk AI
The law defines algorithmic discrimination as unlawful differential treatment or harmful impact based on traits such as race, gender, or age. High-risk AI includes any system that makes, or heavily influences, consequential decisions. These decisions affect critical areas like education, employment, finance, healthcare, and housing. The law creates separate requirements for developers, who build or significantly modify AI systems, and deployers, who use them in practice.
Requirements for Developers
Developers must exercise reasonable care to avoid discrimination from intended system uses. They must also provide deployers with documentation describing:
-
system capabilities and limits
-
intended purposes and uses
-
training data and evaluation methods
-
discrimination risk assessments
Developers must publicly disclose the high-risk AI systems they create and their risk management practices. They must report known discrimination risks to the Colorado Attorney General and to deployers within 90 days of discovery.
Requirements for Deployers
Deployers must also use reasonable care and create a risk management program to mitigate discrimination. They must conduct annual impact assessments of all high-risk AI systems they deploy. When a system makes consequential decisions about consumers, deployers must provide notice. If the decision is adverse, consumers must receive the reasons, plus an opportunity to correct data or appeal. Deployers must publicly disclose the systems they use and their strategies for managing discrimination risks. They must also notify the Attorney General within 90 days of discovering algorithmic discrimination.
Enforcement and Exemptions
The law allows exemptions for national security, research, compliance with other laws, and regulated financial institutions with equivalent frameworks. The Attorney General will enforce the law as an unfair trade practice. During the first year, violators may correct issues after receiving notice. Developers and deployers may use affirmative defenses if they follow designated AI risk management frameworks and correct violations through testing, feedback, or internal review. The Attorney General may require documentation and create rules for notices, impact assessments, and rebuttable presumptions.
Need Help?
If you’re wondering how Colorado’s bill, or any other AI bill around the world, could impact you, don’t hesitate to reach out to BABL AI. Their Audit Experts are ready to provide valuable assistance while answering your questions and concerns.
