The Colorado AI Act: New obligations for both deployers and developers

Colorado is the latest U.S. state to enact a law governing the organizational use of AI with the intention of tackling bias and other associated risks which impact Colorado consumer residents. S.B. 24-205, referred to as the Colorado Artificial Intelligence Act (CAIA), imposes risk management obligations on “developers” and “deployers” of “high risk artificial intelligence systems” doing business in the state.The Act is modeled on the risk-based principles enshrined in the recently enacted EU AI Act.

The Act takes effect on February 1, 2026 and specifically targets “consequential decisions” affecting consumers, in identified areas such as employment practices including hiring, housing, insurance and healthcare, among others. With some exemptions, the Act imposes obligations including conducting impact assessments, monitoring, retention requirements and disclosures, with the purpose of the avoidance of automated decision-making without appropriate oversight.

This Act is the latest in AI governance legislation in U.S. states either separately promulgated or incorporated within other privacy legislation. Activity in this area has escalated since 2018 and is set to continue in data privacy, cybersecurity and AI specifically, with California, Virginia and Colorado having first blazed the trail in data privacy law.

Organizations as deployers will need to think carefully about how to implement processes that meet these requirements if they have customers in the increasing number of affected states.The extra-territoriality of these provisions challenge even businesses located in different states to develop policy and a governing platform architecture. In this way, legal developments may be communicated efficiently, use cases can be leveraged with secure permissions, logs kept, and human-in-the loop decision-making can be preserved.