Colorado SB24-205 AI Consumer Protection Act Takes Effect February 2026, USA

Colorado Governor Jared Polis signed SB24-205 (Consumer Protections for Artificial Intelligence) on May 17, 2024. The act's operative obligations for developers and deployers of high-risk AI systems took effect on February 1, 2026. Colorado is the first U.S. state to enact a broadly applicable consumer protection statute governing high-risk AI systems.

The controlling authority is Colorado Revised Statutes §§ 6-1-1701 through 6-1-1711, as enacted by SB24-205, Colo. Session Laws 2024, Chapter 198. The act defines "high-risk artificial intelligence system" as one that makes or substantially contributes to a consequential decision affecting a consumer in education, employment, financial services, or housing, among other enumerated domains. Developers bear duties of disclosure, technical documentation, and risk notification to deployers. Deployers must maintain a written risk management policy, conduct algorithmic impact assessments, complete annual reviews, provide consumers with notice of high-risk AI use in consequential decisions, and offer a meaningful opportunity to correct data inputs and appeal adverse outcomes.

Developers and deployers operating in Colorado must audit their AI systems to determine whether any system meets the "high-risk" definition. Where a system qualifies, developers must disclose known risks of algorithmic discrimination to deployers within 90 days of discovery. Deployers must publish a clear public statement describing the types of high-risk AI systems in use. Entities that deploy high-risk AI to issue consequential decisions must build consumer-facing correction and appeal mechanisms into their workflows.

The act provides several exemptions: entities subject to examination by a state or federal prudential regulator under published AI-specific guidance (including banks and credit unions) may qualify for safe harbor; insurers subject to applicable state insurance commissioner regulations on algorithmic models are similarly carved out. An affirmative defense is available to deployers that substantially comply with a nationally or internationally recognized AI risk management framework. The Colorado Attorney General holds exclusive enforcement authority; violations are treated as deceptive trade practices under the Colorado Consumer Protection Act, C.R.S. § 6-1-105.

Source: Colorado General Assembly, SB24-205 Consumer Protections for Artificial Intelligence, Colo. Session Laws 2024, Chapter 198 (signed May 17, 2024; operative Feb. 1, 2026). Available at: https://leg.colorado.gov/bills/sb24-205. Confirmed: March 6, 2026.

The information provided is not legal, tax, investment, or accounting advice and should not be used as such. It is for discussion purposes only. Seek guidance from your own legal counsel and advisors on any matters. The views presented are those of the author and not any other individual or organization. Some parts of the text may be automatically generated. The author of this material makes no guarantees or warranties about the accuracy or completeness of the information.