What is a high-risk AI system under Colorado law?

Last verified: March 24, 2026
Colorado SB 24-205 defines a high-risk AI system as one that makes or substantially influences consequential decisions affecting Colorado residents in the domains of employment, education, financial services, housing, or insurance. The system must be the proximate cause of a consequential decision — meaning it produces an output such as a recommendation, score, or classification that a human deployer then uses to make the final call.

Applicable Regulations

SB-24-205

Colorado AI Act (Consumer Protections for Artificial Intelligence)

enacted

First comprehensive US state law governing high-risk AI systems. Signed May 17, 2024; compliance deadline extended to June 30, 2026 by SB 25B-004. Imposes obligations on both developers and deployers of AI systems that make or substantially influence consequential decisions affecting consumers.

Key Requirements

Impact Assessment Complete documented impact assessments annually and within 90 days of substantial modifications, covering discrimination risks, data inputs/outputs, and mitigation measures
Consumer Notice Notify consumers when a high-risk AI system makes or substantially influences a consequential decision about them
Correction & Appeal Rights Allow consumers to correct inaccurate personal data and appeal adverse decisions through human review where technically feasible
Developer Disclosure Developers must publish statements describing high-risk systems and discrimination risk management, and supply deployers documentation for impact assessments
Effective: 2026-06-30 Penalties: Enforcement by Colorado Attorney General. Violations treated as deceptive trade practices under the Colorado Consumer Protection Act.

Start Your AI Risk Assessment

Get a personalized analysis of how these regulations affect your organization.

Start Your AI Risk Assessment

Related Questions

  • Does Colorado require AI impact assessments? Yes. Colorado SB 24-205 requires deployers of high-risk AI systems to complete impact assessments before deployment and annually thereafter.
  • What are the Colorado AI Act consumer notice requirements? Under Colorado SB 24-205, deployers of high-risk AI systems must notify consumers when an AI system is the proximate cause of a consequential decision affecting them. The notice must be delivered before or at the time of the decision, explain that AI was used, describe the type of data processed, and inform the consumer of their right to appeal or request a human review.