ColoradoAI regulation

Regulation Status

• Colorado is one of the most active US states on AI regulation and was the first to enact a cross-sector algorithmic-discrimination statute. Its original centerpiece, the Colorado AI Act (SB 24-205), was signed by Governor Jared Polis in May 2024 to impose duty-of-care, risk-management and impact-assessment obligations on developers and deployers of high-risk AI systems used in consequential decisions. Its February 1, 2026 effective date was postponed to June 30, 2026 by SB 25B-004 (signed August 28, 2025), and before it ever took effect the framework was repealed and replaced by SB 26-189, signed May 14, 2026 and effective January 1, 2027, which drops the high-risk classification, duty of care and mandatory impact assessments in favor of transparency, disclosure and consumer-notice duties for covered automated decision-making technology (ADMT) that materially influences consequential decisions.
• SB 26-189 requires developers to provide deployers with information on intended and known harmful uses, training data, limitations, appropriate use, monitoring and meaningful human review, and requires deployers to give pre-use consumer disclosures and adverse-outcome notices explaining the ADMT’s role and rights to access, correction and meaningful human review. It also clarifies that developers or deployers may be liable under state anti-discrimination laws for consequential decisions materially influenced by covered ADMT, with enforcement penalties of up to $20,000 per violation.
• Beyond the AI Act, Colorado regulates automated processing through the Colorado Privacy Act (SB 21-190, effective July 1, 2023), which grants an opt-out of profiling in furtherance of solely automated decisions producing legal or similarly significant effects and can require data-protection assessments, and through SB 21-169 (effective July 6, 2021), which bars insurers from using algorithms and predictive models that unfairly discriminate against protected classes and requires rulemaking by the Commissioner of Insurance. Colorado also addresses synthetic media via the Candidate Election Deepfake Disclosures Law (HB 24-1147, effective July 1, 2024), which restricts AI-generated election-candidate deepfakes with a disclaimer safe harbor, and the Preventing Unauthorized Disclosure of Intimate Digital Depictions Act (SB 288, effective August 6, 2025), which extends child-sexual-exploitation and intimate-image liability to AI-generated depictions and authorizes civil relief for nonconsensual intimate digital depictions.
• In its 2026 session Colorado enacted a cluster of health-care and consumer AI laws effective January 1, 2027 (with the psychotherapy statute effective August 12, 2026): HB 26-1195 restricting AI in psychotherapy services and barring representations that AI is equivalent to a licensed psychotherapy professional or offers therapist-like confidentiality; HB 26-1139 governing AI use in health-care utilization review, including documentation, governance, anti-discrimination, disclosure and human-review requirements for medical-necessity denials; and HB 26-1263 imposing age-estimation, AI disclosure, self-harm response, professional-equivalence, minor-protection and annual reporting duties on operators of conversational AI services. Enforcement runs through the Colorado Consumer Protection Act, the Attorney General, and the Division of Insurance depending on the statute.