Colorado AI Act (SB 24-205), repealed

Applies To

Overview

Status: repealed before it took effect. SB 26-189, signed on 14 May 2026, repealed and replaced this law; the replacement takes effect on 1 January 2027. The rest of this entry describes SB 24-205 as enacted, for reference. Senate Bill 205, signed into law by Governor Jared Polis on May 17, 2024, made Colorado the first US state to enact a comprehensive, risk-based AI governance statute. It was due to take effect on 1 February 2026, and a special session in August 2025 moved that to 30 June 2026. Modeled in part on the EU AI Act's approach of scaling obligations to the level of risk, SB 205 focuses on 'high-risk artificial intelligence systems', defined as AI systems that make or substantially influence 'consequential decisions' affecting Colorado consumers in areas such as education, employment, financial services, essential government services, healthcare, housing, insurance, and legal services. The legislation imposes obligations on both 'developers' (those who create or substantially modify high-risk AI) and 'deployers' (those who use high-risk AI to make consequential decisions about consumers). Developers must provide deployers with documentation, use-case guidance, and risk information. Deployers must implement AI risk management policies, conduct annual impact assessments (documented reviews of a system's risks to consumers, including discrimination), provide pre-adverse-action notices (warnings given before a decision goes against a consumer), and offer consumers a meaningful opportunity to appeal or seek human review of adverse consequential decisions. The Attorney General of Colorado holds exclusive enforcement authority; the statute explicitly states it does not create a private right of action. Governor Polis's signing statement expressed concerns about the Act's breadth and signaled support for legislative amendments before the effective date to address compliance complexity for small businesses and startups. The 2026 session replaced it with SB 26-189 instead of amending it.

Key Requirements

• •Repealed in May 2026 by SB 26-189 before taking effect. The items below describe SB 24-205 as enacted.
• •Developers of high-risk AI must provide deployers with: intended uses, known limitations, documentation of training data, evaluation metrics, and risk mitigation guidance
• •Deployers must adopt and implement a written AI risk management policy aligned to a recognized framework (e.g., NIST AI RMF)
• •Annual algorithmic impact assessments required for each high-risk AI system, with results retained and available to the Attorney General upon request
• •Notice to consumers before or when a high-risk system is used in a consequential decision; after an adverse decision, a statement of the principal reasons, the system's role, and the data used
• •Consumers have the right to appeal adverse consequential decisions and to request human review
• •Any developer or deployer of an AI system meant to interact with consumers must disclose that it is AI, unless that is obvious
• •A duty of reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination
• •Developers and deployers must publicly disclose high-risk AI systems on their websites
• •Record retention obligations for impact assessments and related documentation
• •Exclusive enforcement by the Colorado Attorney General; no private right of action

What Your Organization Must Do

• →Stop building compliance programs against SB 24-205, which Colorado repealed in May 2026 before it ever applied.
• →Redirect planning to SB 26-189, the narrower automated decision-making law covering decisions made from 1 January 2027.
• →Review the SB 26-189 text to confirm which of your systems and decisions fall inside its narrower scope.
• →Keep documentation already built for high-risk AI, since impact assessments and vendor disclosures remain useful evidence.
• →Tell business owners that no Colorado AI duties apply today, to avoid wasted spend on a repealed statute.
• →Track Colorado Attorney General guidance on the replacement law before setting internal deadlines for 2027.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Governance Controls

Operational controls that implement requirements from this regulation.

Frequently Asked Questions

When does the Colorado AI Act SB 205 take effect and are amendments still possible before then?

It never took effect. A 2025 special session moved its start date from 1 February 2026 to 30 June 2026, and SB 26-189, signed on 14 May 2026, repealed and replaced it before that date. Plan compliance against SB 26-189, which applies to decisions made from 1 January 2027.

Which AI systems qualify as high-risk under Colorado SB 205?

An AI system is high-risk if it makes or substantially influences consequential decisions affecting Colorado consumers in education, employment, financial services, essential government services, healthcare, housing, insurance, or legal services. Systems that merely assist humans without substantially influencing outcomes may fall outside the definition, but that line requires careful legal analysis.

Does Colorado SB 205 apply to companies headquartered outside Colorado?

Yes. The Act applies to any developer or deployer whose AI systems make consequential decisions affecting Colorado consumers, regardless of where the company is incorporated or headquartered. Multinational enterprises and out-of-state vendors serving Colorado residents are within scope.

What is the difference between a developer's obligations and a deployer's obligations under SB 205?

Developers must supply deployers with documentation covering intended uses, known limitations, training data, evaluation metrics, and risk mitigation guidance, and must publicly disclose high-risk systems on their websites. Deployers must adopt a written AI risk management policy, conduct annual impact assessments, deliver pre-adverse-action notices, and provide consumers with appeal and human review rights.

Who enforces Colorado SB 205 and can consumers sue companies directly?

Enforcement is exclusive to the Colorado Attorney General. SB 205 explicitly does not create a private right of action, so individual consumers cannot bring civil suits against developers or deployers for violations. However, companies remain exposed to AG investigations and potential enforcement actions.

How does Colorado SB 205 compare to the EU AI Act for compliance teams already working on EU obligations?

Both laws use a risk-stratified approach focused on high-risk AI in similar sectors and require impact assessments, transparency, and human oversight. Key differences include SB 205's exclusive reliance on state AG enforcement rather than a dedicated regulator, no tiered fine structure published in the statute, and a narrower geographic trigger limited to decisions affecting Colorado consumers rather than EU market placement.