Colorado · statute
Colorado AI Act: what it requires, and the records to keep
Colorado's 2024 AI Act, the first comprehensive US state AI statute, was delayed twice and then repealed and reenacted in May 2026 as a narrower notice-and-transparency law for automated decision-making technology (ADMT). The original risk-management programs and annual impact assessments are gone; the new duties apply from 1 January 2027, with Attorney General rules still in draft.
01 / What it requires
What Colorado AI Act requires
Developers and deployers of automated decision-making technology that materially influences consequential decisions about Colorado consumers in education, employment, housing, lending, insurance, health care or government services.
- 01Developers: give deployers documentation on intended uses, training-data categories, known limitations, and instructions for appropriate use and human review.
- 02Developers: notify deployers of material updates or modifications to covered ADMT.
- 03Deployers: give consumers clear, conspicuous notice at the point of interaction with covered ADMT.
- 04Deployers: within 30 days of an adverse consequential decision, give a plain-language description of the ADMT's role.
- 05Let consumers access and correct personal data used, and request meaningful human review and reconsideration of adverse decisions.
- 06Developers and deployers: keep records needed to show compliance for at least three years.
02 / AI work
Where it touches AI work
Targets AI and other computational systems that produce predictions, scores, rankings or recommendations used to make or guide consequential decisions about individuals. It no longer imposes the 2024 Act's general duty of care against algorithmic discrimination.
03 / Dates
The dates that matter
SB 24-205 signed; original effective date 1 February 2026
SB 25B-004 signed in special session, delaying duties to 30 June 2026
SB 26-189 signed, repealing and reenacting the Act as ADMT law
Attorney General publishes draft ADMT and Conversational AI Service rules
Interim revised draft rules released; hearing scheduled 26 October 2026
SB 26-189 developer and deployer duties apply
04 / Enforcement
Who enforces it
Colorado Attorney General only, under the Colorado Consumer Protection Act (violation is a deceptive trade practice); 60-day notice and cure before actions filed before 2030-01-01; no new private right of action.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Developer technical documentation package delivered to each deployer
- 02Point-of-interaction consumer notice text and placement records
- 03Adverse-decision explanations sent, with dates within 30 days
- 04Human review and data-correction request logs, kept three years
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
Is the Colorado AI Act still in effect?+
Not in its original form. SB 24-205, signed in May 2024, never took effect: its start was delayed to 30 June 2026, and on 14 May 2026 SB 26-189 repealed and reenacted it as a narrower law on automated decision-making technology. The new law is enacted, but its developer and deployer duties apply from 1 January 2027. It drops the 2024 Act's risk-management programs and impact assessments in favour of developer documentation, consumer notice, explanations of adverse decisions, data correction and human review. Read the full answer
When does the Colorado AI Act take effect?+
The current version applies from 1 January 2027. SB 26-189, signed on 14 May 2026, became law on signing but sets 1 January 2027 as the start date for its duties: developer documentation, notice to consumers, a plain-language explanation within 30 days of an adverse decision, and human review on request. The Attorney General must adopt rules on adverse-outcome disclosures by the same date. The Attorney General alone enforces the law and, for actions filed before 2030, must first give 60 days' notice and a chance to cure. Read the full answer
Which states have comprehensive AI laws?+
Colorado, Texas, Utah and California are the states usually cited, but their laws differ widely. Colorado's 2024 AI Act was narrowed by SB 26-189 to notice and transparency duties for automated decision-making, applying from 1 January 2027. Texas's TRAIGA, in force since 1 January 2026, bans a short list of intentional harmful uses and requires AI disclosures by government agencies and health care providers. Utah requires generative AI disclosure. California uses separate laws: AB 2013, SB 942, SB 53 and the CCPA ADMT regulations. Illinois and New York City regulate AI in hiring. Read the full answer
Will federal law preempt state AI laws?+
Not through the executive order alone. Executive Order 14365, signed on 11 December 2025, sets up a Justice Department task force to challenge state AI laws, asks Commerce to list 'onerous' state laws, ties some broadband funds to state AI policy, and calls for a federal framework that would preempt conflicting state laws. An executive order cannot itself preempt state law; that takes an Act of Congress, a valid federal rule or a court ruling. Until one of those applies, state AI laws remain enforceable. Read the full answer
SOURCES
Go back to the source
Colorado General Assembly
Colorado General Assembly
Colorado General Assembly
Colorado Department of Law
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: FSMB AI / state boards · State Bar AI Opinions · SOPIPA · NYC Local Law 144 · Texas TRAIGA · Utah AI Policy Act