Colorado AI Act (SB24-205)

The Colorado AI Act, formally SB24-205, requires developers and deployers of "high-risk" AI systems — including those used in employment decisions — to implement safeguards against algorithmic discrimination. Signed May 17, 2024, it's currently set to take effect February 1, 2026, and gives Colorado's attorney general exclusive enforcement authority.

What Makes an Employment AI System "High-Risk" Under This Law?

An AI system is high-risk if it makes, or is a substantial factor in making, a "consequential decision" — and employment decisions like hiring, compensation, promotion, or termination are explicitly listed as consequential. This mirrors the logic behind the EU AI Act's high-risk classification for workplace AI, even though the two laws use different compliance mechanics.

What Do Deployers Have to Do?

Employers deploying a high-risk AI system must complete an impact assessment before deployment and annually afterward, use reasonable care to protect consumers from known or foreseeable risks of algorithmic discrimination, and notify affected individuals when the AI plays a role in a consequential decision about them.

What Do Developers Have to Do?

Companies that build the AI system — often HR tech vendors — must provide deployers with documentation describing the system's intended uses, known limitations, and risks of discriminatory outcomes. This shifts real compliance burden upstream to vendors, but employers still can't fully outsource responsibility, since the deployer obligations apply regardless of what the developer discloses.

How Does This Compare to NYC's Approach?

Unlike NYC Local Law 144's narrow focus on bias audits for AEDTs, the Colorado AI Act uses a broader risk-management framework closer to the EU model — impact assessments, documented risk mitigation, and consumer notification, rather than a single audit-and-publish requirement.

What Are the Penalties?

Violations are treated as deceptive trade practices under Colorado's existing consumer protection law, enforced exclusively by the attorney general — there's no private right of action, which is a meaningful distinction from laws that expose employers to individual lawsuits.

How Should Employers Prepare Before the Effective Date?

Start the impact assessment process well before February 1, 2026, since assessments require input from the AI vendor and internal review of how the system factors into consequential decisions. AI HR compliance software that tracks jurisdiction-specific effective dates helps employers avoid discovering a gap only after enforcement begins.

Discover how our HR solutions streamline onboarding, boost employee engagement, and simplify HR management

Request a Demo

Frequently Asked Questions

Q: What is the actual bill number for the Colorado AI Act?
A: SB24-205, signed into law May 17, 2024.

Q: When does the Colorado AI Act take effect?
A: February 1, 2026, as currently set.

Q: Who enforces the Colorado AI Act?
A: The Colorado attorney general has exclusive enforcement authority; there is no private right of action.

Q: What counts as a "consequential decision" under this law?
A: Decisions with material legal or similarly significant effects, explicitly including employment decisions like hiring, pay, and termination.

Q: Do employers need an impact assessment for every AI tool they use?
A: Only for tools classified as high-risk, meaning they make or substantially factor into a consequential decision.

Q: How is this different from the EU AI Act?
A: Both classify employment AI as high-risk, but Colorado's law uses state consumer-protection enforcement, while the EU AI Act uses conformity assessments and EU-wide regulatory bodies.