Colorado Artificial Intelligence Act (SB 24-205, rewritten by SB 26-189)
Colorado · C.R.S. § 6-1-1701 et seq. as repealed and reenacted by SB 26-189 (signed May 14, 2026) · effective 2027-01-01 · Applies to consequential decisions made on or after Jan 1, 2027. AG rules are due by that date. Until Jan 1, 2030, the AG must give notice and 60 days to cure if a cure is possible, unless the violation is knowing or repeated.
Summary
A deployer using automated decision-making technology to materially influence a consequential decision (education, employment, housing, lending, insurance, health care, essential government services) must give notice first. A prominent public notice at points of consumer interaction meets that duty. After an adverse outcome it must explain the technology's role within 30 days and offer correction of data and meaningful human review. Developers must give deployers documentation. The 2024 duty to tell consumers they are interacting with AI is not in the rewritten act.
Who must comply
Developers and deployers of automated decision-making technology that materially influences consequential decisions about Colorado consumers.
What you must disclose
A clear and conspicuous notice that the technology is or will be used in a consequential decision, and how to get more information. After an adverse outcome, a plain-language description of its role and of the consumer's rights.
When: Before the technology is used in the decision; within 30 days after an adverse outcome.
Other duties
- Keep records for at least three years after the decision.
- Offer correction of factually incorrect personal data and meaningful human review after an adverse outcome.
- Developers: give deployers documentation on intended uses, training data, limitations and human review.
Exemptions
- Low-stakes or routine decisions, including scheduling, customer service triage and communicating decisions.
- Advertising, marketing, product recommendations, search and content moderation.
- HIPAA covered entities and their business associates, except for employment decisions. They must still give patients a general notice.
- Insurers subject to C.R.S. § 10-3-1104.9, in the practice of insurance.
- FDA-overseen medical devices and related research.
Penalties
A deceptive trade practice under the Colorado Consumer Protection Act: civil penalties up to $20,000 per violation, or $50,000 if committed against an elderly person.