Colorado AI Act compliance · Free audit · No signup

Colorado AI Act (SB 24-205) Compliance Audit

Colorado's AI Act is the first comprehensive U.S. state law on algorithmic discrimination — effective 1 February 2026. Grade your AI governance, impact assessment, and consumer notice policies against the developer + deployer duties in C.R.S. §§6-1-1702 to 1704: reasonable care to prevent algorithmic discrimination, annual impact assessments, pre-decision consumer disclosure, and post-decision right to appeal.

Run free Colorado AI Act audit
Colorado Senate Bill 24-205 — Consumer Protections for Artificial Intelligence (C.R.S. §§6-1-1701 to 1707) · Any developer or deployer doing business in Colorado that produces or uses a 'high-risk artificial intelligence system' making consequential decisions about Colorado consumers

What Colorado AI Act non-compliance actually costs

Up to $20,000 per violation
Per-violation civil penalty (Colorado AG enforcement)
C.R.S. §6-1-112(1)(a) via §6-1-1706 (CCPA enforcement)
Up to $50,000 per violation
Per-violation if victim is elderly (60+)
C.R.S. §6-1-112(3)
Treated as separate deceptive trade practice
Failure to provide impact assessment to AG on request
C.R.S. §6-1-1704(7)
Uncapped — equitable relief
Class-wide injunctive relief + restitution
C.R.S. §6-1-110

Who must comply with Colorado AI Act?

What this audit checks

12 required clauses, scored as Present / Partial / Missing with the exact regulatory citation and suggested fix.

1
Reasonable care duty to avoid algorithmic discrimination (§1702 / §1703)
Affirmative defence requires documented compliance with NIST AI RMF or ISO 42001 framework + the statute's specific duties
2
Risk management policy + program (§1703(2))
Iterative, regularly reviewed; documents principles, processes, personnel — must reasonably consider NIST AI RMF or ISO/IEC 42001 or comparable
3
Annual impact assessment (§1703(3))
For each high-risk AI system + within 90 days of any intentional substantial modification — purpose, benefits, data categories, performance metrics, transparency measures, post-deployment monitoring
4
Consumer pre-decision notice (§1703(4))
Notify consumer that high-risk AI system is being used to make / be a substantial factor in a consequential decision concerning them — at or before time of decision
5
Plain-language explanation when adverse decision is made (§1703(4)(b))
Principal reason(s) including degree + manner of contribution of the AI; type of personal data processed; sources of personal data
6
Right to correct + right to appeal (§1703(4)(c))
Opportunity to correct any incorrect personal data the AI processed; opportunity for human review of adverse consequential decision (where technically feasible)
7
Public statement on website (§1703(5))
Summary of types of high-risk AI systems currently deployed, how risks of algorithmic discrimination are managed, nature/source/extent of information collected and used
8
Disclosure of algorithmic discrimination to AG (§1703(7))
Within 90 days of discovery — required disclosure to the Colorado Attorney General + affected consumers
9
Developer duty: provide deployer documentation (§1702(2))
Statement on intended uses, known + reasonably foreseeable harmful uses, training data summary, evaluation/mitigation of bias, performance metrics, intended outputs, governance
10
Developer post-market monitoring + disclosure to AG (§1702(5))
Within 90 days of discovering algorithmic discrimination — written notice to AG + all known deployers
11
AI-interaction disclosure to consumers (§1705)
Any deployer using AI to interact with a consumer must disclose AI interaction unless obvious to a reasonable person (separate from §1704 high-risk regime)
12
Recordkeeping — impact assessments retained 3 years after final deployment (§1704)
Available to AG on request; document any 'intentional and substantial modification' requiring re-assessment
Audit my policy now
Results in 20 seconds · 3 free per day · No signup

Why Colorado AI Act audits actually fail

Confusing 'consequential decision' with 'high-risk'
All high-risk AI systems make consequential decisions, but a 'consequential decision' is specifically about education enrolment, employment, financial/lending, essential gov service, healthcare, housing, insurance, or legal services (§1701(3)). HR / lending / insurance + healthcare + housing are the four most common Colorado scope traps.
Assuming the small-deployer carve-out fully exempts you
<50 FTE + no own-data training + intended use = exempt from §1703(2) risk management program AND §1703(3) impact assessment AND §1703(5) public statement — but NOT from consumer notice duties (§1703(4)) or AG disclosure duties (§1703(7)). Most startups are in this 'middle' zone and don't realise it.
Using a third-party HR or credit AI without provider documentation
Deployers must perform an impact assessment that depends on developer-supplied information (training data, foreseeable misuse, performance). If your vendor refuses to provide the §1702(2) statement, you cannot complete §1703(3) — and you become liable for the gap. Procurement agreements need an AI-Act-style flow-down.
Substantial modification triggers full re-assessment
Fine-tuning, prompt engineering that materially changes outputs, or changing the input data significantly = 'intentional and substantial modification' under §1701(7). Re-assessment within 90 days. Many SaaS companies layer prompts over GPT/Claude weekly without realising each material change resets the clock.

Colorado AI Act FAQ

Is the Colorado AI Act in effect today?
Yes — the operative date is 1 February 2026. The Colorado AG has rulemaking authority (§1707) and is expected to issue interpretive rules in 2026; certain technical details may shift, but the core developer + deployer duties are in force now.
Does it preempt or align with the EU AI Act?
Neither — Colorado borrowed concepts (risk-based, impact assessments, transparency) but the scope is narrower (consequential decisions only, no biometric ID category) and the enforcer is the Colorado AG via the Colorado Consumer Protection Act, not a notified body. A single AI Act + NIST AI RMF program will largely satisfy Colorado, but the Colorado-specific consumer notices (§1703(4)) are unique.
How does this interact with EEOC guidance and federal law?
Federal anti-discrimination law (Title VII / ADA / ADEA / ECOA / FHA) still applies on top of Colorado. Colorado AI Act creates a state-law affirmative defence where the deployer documents reasonable care under NIST AI RMF or ISO 42001 — this does NOT defend against federal Title VII disparate impact claims. Build for both.

Grade your policy in 20 seconds

Paste your existing document. Get a 12-clause Colorado AI Act scorecard. Generate a fully compliant version for $9 if you don't want to fix it manually.

Run free Colorado AI Act audit