--- title: "The Colorado AI Act (SB 24-205): A Compliance Guide for 2026" description: "Colorado's SB 24-205 is the first comprehensive, risk-based US state AI law, imposing a duty of care against algorithmic discrimination in high-risk AI systems." url: "https://sonomos.ai/blog/colorado-ai-act-compliance-2026/" source: "https://sonomos.ai/blog/colorado-ai-act-compliance-2026/" --- [Back to Blog](https://sonomos.ai/blog/) June 4, 20267 min read Colorado AI Act AI Regulation AI Compliance US State Laws AI Governance Algorithmic Discrimination # The Colorado AI Act (SB 24-205): A Compliance Guide for 2026 S [Sonomos Research](https://sonomos.ai/team/) · Sonomos The Sonomos research team writes about AI privacy, data protection, and how to use generative AI safely at work. **Short answer:** The Colorado Artificial Intelligence Act (SB 24-205) is the first comprehensive, risk-based US state AI law. It imposes a duty of reasonable care to protect consumers from **algorithmic discrimination** in "high-risk" AI systems — those that make, or are a substantial factor in, _consequential decisions_ about things like employment, lending, housing, healthcare, insurance, education, and essential services. After a legislative delay, the Act now takes effect on **June 30, 2026.** It places concrete obligations on both **developers** and **deployers** of high-risk systems, including risk-management programs, impact assessments, consumer notices, and disclosures to the Colorado Attorney General. Enforcement is exclusively by the AG; there is no private right of action. This guide explains who is covered and what to do. ## What the Colorado AI Act is Signed in May 2024, Colorado's SB 24-205 — "Consumer Protections for Artificial Intelligence" — was the first US state law to regulate AI across industries on a risk basis, rather than targeting a single sector or a list of prohibited acts. Its model is closer to the EU AI Act than to Texas's intent-based TRAIGA: it regulates **high-risk AI systems** and imposes a **duty of care** to avoid discriminatory outcomes. **Effective date.** The Act was originally set to take effect February 1, 2026. During a 2025 special session, the Colorado legislature **delayed the effective date to June 30, 2026** and made targeted refinements. Organisations should plan to the June 30, 2026 date and watch for any further amendments before it lands. ## Key definitions - **High-risk AI system.** An AI system that, when deployed, makes or is a substantial factor in making a _consequential decision._ - **Consequential decision.** A decision with a material legal or similarly significant effect on a consumer's access to, or the cost or terms of: employment or an employment opportunity; education enrolment or opportunity; financial or lending services; an essential government service; healthcare services; housing; insurance; or legal services. - **Algorithmic discrimination.** Unlawful differential treatment or impact that disfavours individuals on the basis of a protected characteristic. Notably — and unlike Texas — Colorado's standard is **not** limited to intentional discrimination; it reaches discriminatory _impact_, which is why a documented risk-management process matters. - **Developer** vs **Deployer.** A developer builds or substantially modifies a high-risk system; a deployer uses one to make consequential decisions. Many organisations are deployers (for example, an employer using an AI hiring tool). ## Deployer obligations If you _use_ a high-risk AI system to make consequential decisions about Colorado consumers, the Act requires you to: 1. **Maintain a risk-management policy and program** to govern the system — explicitly contemplated to align with recognised frameworks such as the **NIST AI Risk Management Framework** or **ISO/IEC 42001.** 2. **Complete impact assessments** for the high-risk system, reviewed periodically and after significant modifications. 3. **Notify consumers** when a high-risk system is used to make a consequential decision about them, describe the system's purpose, and — where a decision is adverse — provide an explanation and an opportunity to correct data and to appeal for human review. 4. **Publish a public statement** summarising the high-risk systems you deploy and how you manage discrimination risk. 5. **Disclose to the Colorado Attorney General** any discovered algorithmic discrimination, within a set timeframe. ## Developer obligations If you _build_ or substantially modify a high-risk system, you must: 1. **Provide documentation to deployers** sufficient for them to understand the system's intended uses, known limitations, the data used to train it at a high level, and how it was evaluated for discrimination. 2. **Publish a public statement** describing the types of high-risk systems you make available and how you manage known discrimination risks. 3. **Disclose known risks** of algorithmic discrimination to the Attorney General and to deployers. ## Enforcement and penalties - **Exclusive enforcement by the Colorado Attorney General.** There is **no private right of action.** - Violations are treated as **unfair or deceptive trade practices** under Colorado law. - The Act includes a **rebuttable presumption** of reasonable care for organisations that comply with its specified duties and a recognised risk-management framework — which is the practical incentive to adopt NIST AI RMF or ISO 42001 and document it. ## Colorado AI Act vs Texas TRAIGA vs the EU AI Act | Dimension | Colorado SB 24-205 | Texas TRAIGA | EU AI Act | | --- | --- | --- | --- | | Model | Risk-based duty of care | Intent-based prohibitions | Risk-based, tiered | | Effective date | June 30, 2026 | January 1, 2026 | Phased through 2026–2027 | | Discrimination standard | Impact (not just intent) | Intent required | Varies by risk tier | | Core deployer duty | Risk program, impact assessments, notices | Avoid prohibited uses | Conformity, oversight, documentation | | Enforcement | Colorado AG, no private right | Texas AG, 60-day cure | National authorities, large fines | ## How to prepare for June 30, 2026 1. **Inventory and classify.** Identify AI systems that influence consequential decisions about Colorado consumers and flag them as high-risk. 2. **Adopt a recognised framework.** Stand up a risk-management program aligned to the [NIST AI RMF](https://sonomos.ai/blog/nist-ai-rmf-governance-2026/) or ISO/IEC 42001 to qualify for the reasonable-care presumption. 3. **Run impact assessments.** Document intended use, data, evaluation for discrimination, and mitigations — and refresh after material changes. 4. **Build the consumer-notice and appeal flow.** Notify affected consumers, explain adverse decisions, and provide correction and human-review paths. 5. **Clarify developer–deployer roles.** Get the documentation you're owed if you deploy a third-party system; produce it if you build one. 6. **Don't overlook the data layer.** High-risk AI systems run on consumer personal data. Detecting and minimising the sensitive data that flows into and around these systems supports your impact assessments and reduces breach exposure — the same control that helps with GDPR, HIPAA, and the rest of your program. ## Frequently asked questions ### When does the Colorado AI Act take effect? June 30, 2026. The original February 1, 2026 date was pushed back by the legislature in 2025. Confirm the current date before you finalise timelines, as further amendments remain possible. ### Does the Colorado AI Act apply to my business if I'm not in Colorado? It applies to developers and deployers doing business in Colorado whose high-risk systems make consequential decisions about Colorado residents. A Colorado location is not required if you affect Colorado consumers. ### Is intent required to violate the Act? No — and this is the key contrast with Texas TRAIGA. Colorado's algorithmic-discrimination standard reaches discriminatory _impact_, not just intentional discrimination. That is why a documented risk-management process and impact assessments are central to compliance. ### What is a "consequential decision"? A decision with a material legal or similarly significant effect on access to, or the cost or terms of, employment, education, lending, housing, healthcare, insurance, essential government services, or legal services. ### How does the Act interact with NIST AI RMF and ISO 42001? Compliance with a recognised risk-management framework, alongside the Act's specified duties, supports a rebuttable presumption that you exercised reasonable care. Adopting NIST AI RMF or ISO/IEC 42001 is therefore the practical path to demonstrating compliance. ## The bottom line Colorado's AI Act is the most consequential US state AI law for organisations that use AI in decisions about people, and its June 30, 2026 effective date makes 2026 the year to operationalise it. The work is concrete: inventory high-risk systems, adopt a recognised risk-management framework, run impact assessments, build consumer notice-and-appeal flows, and keep the underlying personal data tightly governed. Paired with Texas TRAIGA taking effect in January, multi-state AI compliance is now a 2026 reality. ## Related guides - [Texas TRAIGA: The Responsible AI Governance Act Compliance Guide (2026)](https://sonomos.ai/blog/texas-traiga-ai-compliance-2026/) - [US State AI Privacy Laws in 2026: The Landscape for AI Users](https://sonomos.ai/blog/us-state-ai-privacy-laws-2026/) - [NIST AI RMF: Governing Generative AI in 2026](https://sonomos.ai/blog/nist-ai-rmf-governance-2026/) - [AI in Hiring 2026: EEOC, NYC LL144, the EU AI Act, and the Controls That Hold Up](https://sonomos.ai/blog/ai-hiring-eeoc-nyc-ll144-eu-ai-act-2026/) - [EU AI Act Compliance Checklist for Enterprise Deployers (2026)](https://sonomos.ai/blog/eu-ai-act-compliance-checklist-2026/) ### Protect your data while using AI Locke detects and masks sensitive information on your device, before it reaches an AI model. [Download Locke](https://sonomos.ai/downloads/) This article is general information about privacy and AI, not legal advice, and reading it does not create a solicitor–client or attorney–client relationship. Regulatory requirements turn on your specific facts and jurisdiction and change over time. Consult qualified counsel before relying on anything here, and check the publication and last-reviewed dates above. We may revise posts, but we do not undertake to keep any post current as the law changes. ## Reference pages for this post - [Compliance reports in LockeProduct](https://sonomos.ai/compliance/) ## Related Articles September 1, 2026•Sonomos Research ### The Anthropic DPA Explained: Claude Data Processing Agreement Guide (2026) Anthropic offers a DPA on Claude Team, Enterprise, and the API — not on Claude.ai Free or Pro. Here is what the Anthropic DPA covers, how it handles EU-US transfers via SCCs and the DPF, what to verify before signing, and where a DPA stops. Claude DPA GDPR +2 September 1, 2026•Sonomos Research ### Claude EU Data Residency in 2026: What Anthropic Offers, and What European Teams Do Instead Anthropic does not currently offer EU data residency for Claude — every prompt is processed on US infrastructure and constitutes an EEA-to-US transfer. Here is how that compares to OpenAI, Microsoft, and Google, what the EU-US Data Privacy Framework does and does not cover, and the supplementary-measure stack European teams deploy instead. Claude Data Residency Europe +2 September 1, 2026•Sonomos Research ### Can My Employer See My Claude Chats? What's Visible in 2026 (and What Isn't) Whether your employer can see your Claude chats depends on the account (personal Claude.ai vs. work-managed Team/Enterprise), the device, and the network. Here is what is visible in each scenario — including Claude Code — and what deleting a chat actually does. Claude Workplace Privacy AI Privacy +1