The Colorado AI Act — Complete Plain-Language Guide

A company uses an AI-powered tool to screen resumes and rank job candidates. No impact assessment has ever been completed. There is no documentation of training data, known bias risks, or discrimination mitigation strategies.

Under SB 24-205: Deployers must complete an impact assessment before deployment and annually thereafter. The assessment must document the system's purpose, nature of consequential decisions it influences, known discrimination risks, training data categories, and mitigation strategies. Complete absence of documentation is a violation on day one of enforcement.

A lending platform uses an AI model to make instant approval and denial decisions. Applicants who are denied receive a generic rejection notice with no mention that an AI made the decision and no mechanism to request human review.

Under SB 24-205: Two separate violations. Consumers must be notified before or at the time a high-risk AI system makes a consequential decision about them. Additionally, consumers must be given the opportunity to appeal adverse decisions and request human review where technically feasible.

A property management company deploys an AI tool that scores prospective tenant applications and outputs approval or rejection recommendations. The company has no written AI governance policy, no risk management program, and has never assessed whether the system produces discriminatory outcomes.

Under SB 24-205: Deployers must implement a documented risk management policy and program specifying the principles, processes, and personnel used to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination. It must be an iterative process that is regularly reviewed and updated. A system screening tenants with zero governance documentation is a direct violation.

A company subscribes to a workforce management SaaS product that uses AI to recommend performance ratings and surface termination candidates. The company assumes the software vendor is responsible for compliance. No internal assessments, disclosures, or governance documentation exist.

Under SB 24-205: The law places compliance obligations on the deployer — the company using the AI — regardless of who built it. Buying a third-party AI tool does not transfer your legal obligations to the vendor. You are responsible for the impact assessments, consumer disclosures, governance policies, and appeal mechanisms.

A company develops and licenses an AI clinical decision support tool used by hospitals. The company's website has no publicly available statement describing the types of high-risk AI systems they offer or how they manage known risks of algorithmic discrimination.

Under SB 24-205: Developers must publish a clear and readily available public statement on their website — or in a public use case inventory — summarizing the types of high-risk systems they make available and how they manage discrimination risks. The statement must be updated within 90 days of any intentional and substantial modification.

An insurance company deployed an AI underwriting model three years ago. An initial risk assessment was completed at launch. The model has since been updated multiple times. No annual review has ever been conducted.

Under SB 24-205: At least annually, deployers must review each high-risk AI system to ensure it is not causing algorithmic discrimination. Additionally, a new impact assessment is required within 90 days of any intentional and substantial modification to the system. A stale initial assessment on an actively updated model does not satisfy the law.

A company deploys a customer service chatbot that handles insurance claim inquiries and eligibility determinations. The bot responds in natural language and is not identified anywhere as an AI system. Consumers interact with it believing they are communicating with a human.

Under SB 24-205: Any person doing business in Colorado that deploys an AI system intended to interact with consumers must ensure each consumer is told they are interacting with an AI system. Disclosure is not required only where it would be obvious to a reasonable person that they are interacting with AI. (§ 6-1-1704(2))