Colorado AI Act (SB 24-205): what it requires and where it stands

The short answer

The Colorado AI Act is Colorado Senate Bill 24-205, titled Consumer Protections for Artificial Intelligence. Governor Jared Polis signed it on May 17, 2024. It mainly regulates developers and deployers of high-risk AI systems, meaning systems that make or are a substantial factor in making consequential decisions about people, such as in hiring, lending, housing, insurance and health care. A shorter section, C.R.S. 6-1-1704, requires some businesses to tell consumers when they are interacting with an AI system.

The duties did not start on the original date of February 1, 2026. SB 25B-004, signed August 28, 2025, moved the start date to June 30, 2026, including for the AI-interaction disclosure. SB 26-189, signed May 14, 2026, repeals and reenacts the same part of the statute effective January 1, 2027, with new requirements for automated decision-making technology and without the general AI-interaction disclosure. On April 27, 2026, a federal court order in X.AI LLC v. Weiser recorded the Attorney General's agreement not to start enforcement of SB 24-205, or of replacement or amending 2026 legislation, for conduct through 14 days after the court rules on a planned preliminary-injunction motion.

This guide is not legal advice. Whether the law covers a particular business is a legal question.

Date history

• May 17, 2024: Governor Polis signed SB 24-205 (Chapter 198, Session Laws of Colorado 2024). As enacted, most duties applied on and after February 1, 2026.
• May 5, 2025: The Governor, Attorney General Phil Weiser, Mayor Johnston and members of Colorado's congressional delegation released a letter urging the General Assembly to delay implementation until January 2027.
• August 28, 2025: The Governor signed SB 25B-004 from the special session. It replaced February 1, 2026 with June 30, 2026 in the developer, deployer and consumer-disclosure sections (sections 6-1-1702, 6-1-1703 and 6-1-1704).
• April 9, 2026: xAI sued the Colorado Attorney General in federal court. On April 27, 2026 the court entered an order recording the Attorney General's agreement not to start enforcement (see below).
• May 14, 2026: The Governor signed SB 26-189, Automated Decision-Making Technology (Chapter 131, Session Laws of Colorado 2026). Its sponsors were Sens. Robert Rodriguez and James Coleman and Reps. Monica Duran and Jennifer Bacon.
• June 30, 2026: The start date that SB 25B-004 set for SB 24-205, including the AI-interaction disclosure.
• January 1, 2027: SB 26-189 repeals and reenacts part 17 of article 1 of title 6. Developer documentation duties under the new law start, and the Attorney General's rules on adverse-outcome disclosures are due.

Current status as of October 31, 2026

Under the session laws, SB 24-205 as amended by SB 25B-004 has a June 30, 2026 start date, and SB 26-189 replaces the part on January 1, 2027. The parts of SB 26-189 that took effect on signing, sections 6-1-1704(4), 6-1-1705(3) and 6-1-1706(6), concern rulemaking and joinder and do not change the earlier disclosure. On that reading, the general AI-interaction disclosure applies from June 30 through December 31, 2026 and is not part of the reenacted law. Enforcement through 2026 is by the Attorney General only, with no private right of action (section 6-1-1706(1) and (6), as enacted in 2024).

The Attorney General's agreement in X.AI LLC v. Weiser covers SB 24-205 and replacement or amending legislation enacted in the 2026 session. Two legal questions remain open: whether that agreement also reaches HB 26-1263 and HB 26-1195, which amend the same part of the law, and where HB 26-1263's provisions will be codified after January 1, 2027. This guide does not decide them, or whether any particular business is covered.

What SB 24-205 required of developers and deployers

This section describes the law as enacted in 2024, with the start date later moved to June 30, 2026. SB 26-189 repeals and reenacts the part on January 1, 2027 (see below). A high-risk AI system is one that, when deployed, makes or is a substantial factor in making a consequential decision. Consequential decisions are those with a material effect on access to, or the cost or terms of, education, employment, financial or lending services, essential government services, health care, housing, insurance or legal services. Algorithmic discrimination means unlawful differential treatment or impact based on protected characteristics such as age, disability, race or sex.

• Developers (section 6-1-1702): use reasonable care to protect consumers from known or foreseeable risks of algorithmic discrimination from intended and contracted uses. Give deployers documentation on foreseeable uses, training data, limitations and evaluation. Publish a public statement about the high-risk systems they offer. Tell the Attorney General and known deployers within 90 days of discovering algorithmic discrimination.
• Deployers (section 6-1-1703): use reasonable care against algorithmic discrimination. Keep a risk management policy and program that is reasonable in light of recognized frameworks, such as the NIST AI Risk Management Framework or ISO/IEC 42001. Complete impact assessments at least annually and within 90 days after an intentional and substantial modification, and keep them for at least three years after final deployment.
• Notices to consumers: before a consequential decision, a deployer must tell the consumer a high-risk system is involved and describe it. After an adverse decision, it must explain the principal reasons, let the consumer correct incorrect personal data and offer an appeal with human review where technically feasible. Deployers also post a public statement about their systems.
• Reports to the Attorney General: developers must notify the Attorney General and known deployers, and deployers must notify the Attorney General, within 90 days of discovering algorithmic discrimination. The Attorney General can ask developers for their documentation.
• Presumption: following the statute and the Attorney General's rules gives a developer or deployer a rebuttable presumption of reasonable care in Attorney General enforcement.
• Small deployers: deployers with fewer than 50 full-time-equivalent employees are exempt from some duties, such as the risk management program and impact assessments, if they meet conditions that include not training the system on their own data. The exemption does not cover the duty of care or the consumer notices.
• Exclusions: the definition of a high-risk system leaves out some technologies, such as spam filters, spreadsheets and firewalls, unless they make or are a substantial factor in a consequential decision. The law also leaves out a tool that talks with consumers in natural language to give information, make referrals or answer questions if it is subject to an accepted use policy that prohibits generating discriminatory or harmful content, again unless it makes or is a substantial factor in a consequential decision. A party that claims an exemption has the burden of showing it qualifies.

The duty to tell consumers they are dealing with AI

Section 6-1-1704 is the part of the law most relevant to chatbots. As enacted, it says a deployer, or a developer, that deploys, offers, sells, leases, licenses, gives or otherwise makes available an AI system intended to interact with consumers must ensure each consumer who interacts with it is told they are interacting with an AI system. No disclosure is required where it would be obvious to a reasonable person. A consumer is a Colorado resident. The text refers to AI systems intended to interact with consumers, not only to high-risk systems.

SB 25B-004 moved the start of this duty from February 1, 2026 to June 30, 2026. SB 26-189 repeals and reenacts part 17 effective January 1, 2027. Its new section 6-1-1704 is a notice that deployers give before covered automated decision-making technology is used in a consequential decision. It does not contain the general requirement to tell consumers they are interacting with an AI system. Under the session laws, then, the general AI-interaction disclosure applies from June 30, 2026 through December 31, 2026.

Colorado's rules aimed at chatbots are in a separate law. HB 26-1263, the Conversational AI Service Operator Requirements, was signed May 29, 2026 (Chapter 208). The General Assembly lists an effective date of August 12, 2026; operator duties apply from January 1, 2027 and the annual report to the Attorney General from July 1, 2027. Under the session law, operators of covered conversational AI services must tell users the service is AI, keep a protocol for prompts about suicidal ideation or self-harm, and have added duties for users the operator knows are minors. See our page on chatbot disclosure laws for how states compare on when a chatbot must say it is AI.

What SB 26-189 does

The description below comes from the bill summary on the General Assembly's page for SB 26-189 as enacted, and from the Attorney General's rulemaking page. It is a summary, not the full text.

SB 26-189 regulates automated decision-making technology (ADMT) used in consequential decisions in education, employment, housing, financial or lending services, insurance, health care and essential government services. It repeals and reenacts the SB 24-205 provisions with new requirements on that technology.

• Developers: documentation duties start January 1, 2027.
• Deployers: clear and conspicuous notice to consumers at the point of interaction with a covered ADMT, and a plain-language description within 30 days after an adverse consequential decision. The Attorney General must adopt rules on the adverse-outcome disclosures by January 1, 2027.
• Consumers: may request their personal data, correction of it, and meaningful human review.
• Enforcement: by the Attorney General under the Colorado Consumer Protection Act, as a deceptive trade practice. Before January 1, 2030, the Attorney General must give 60 days' notice and an opportunity to cure if a cure is possible. The bill creates no new private right of action.

Enforcement of SB 24-205

• The Attorney General has exclusive authority to enforce the part (section 6-1-1706(1)). A violation is an unfair or deceptive trade practice under Colorado's consumer protection act.
• There is no private right of action. The text says the part is not a basis for one (section 6-1-1706(6)).
• Affirmative defense: a developer, deployer or other person can raise a defense if it discovers and cures a violation through user feedback, adversarial testing or red teaming, or an internal review, and is otherwise in compliance with a recognized risk management framework such as the NIST framework, ISO/IEC 42001 or one the Attorney General designates. The defendant has the burden of proof.
• Rulemaking: section 6-1-1707 says the Attorney General may adopt rules to implement and enforce the part.

Attorney General rulemaking and the federal lawsuit

The Attorney General's office has run a combined rulemaking for SB 26-189 and HB 26-1263. Its rulemaking page says informal comment was open through July 13, 2026, proposed rules were filed on August 11, 2026, an interim draft was released on October 6, and a regulatory analysis on October 21. The page says a formal hearing was held on October 26, 2026, with written comments due by 11:59 p.m. that day. As of October 31, 2026, the page lists no adopted final rules and says the Attorney General must adopt ADMT rules before January 1, 2027.

For SB 26-189, the draft rules address required disclosures and human review after an adverse outcome, what it means for the technology to materially influence a decision, and how consumers exercise data rights. For HB 26-1263, they address when an operator has actual knowledge that a user is a minor, protocols for prompts about suicide or self-harm, and annual-report metrics.

In X.AI LLC v. Weiser (D. Colo., No. 1:26-cv-01515), xAI sued the Attorney General on April 9, 2026. The complaint alleges SB 24-205 violates the First Amendment and other constitutional provisions and asks for a declaration and an injunction. The United States later intervened as a plaintiff. A court order of April 27, 2026 records the Attorney General's agreement not to initiate enforcement, including investigations, of SB 24-205 or replacement or amending legislation enacted in the 2026 session, for conduct through 14 days after the court rules on xAI's planned preliminary-injunction motion. xAI is to file that motion within 28 days after the implementing rules are finally adopted. A docket summary by the Civil Rights Litigation Clearinghouse, last updated October 29, 2026, shows no such motion or ruling yet. The complaint's claims are allegations, not findings.

Other Colorado laws that touch chatbots

• HB 26-1263 (Conversational AI Service Operator Requirements), signed May 29, 2026: age estimation, AI disclosure, protections for known minors, a suicide and self-harm protocol, a bar on presenting outputs as equivalent to licensed professionals' services, and annual reports to the Attorney General. The General Assembly lists an effective date of August 12, 2026; operator duties apply from January 1, 2027.
• HB 26-1195 (Psychotherapy Artificial Intelligence Restrictions), signed June 3, 2026: restricts the use of AI in psychotherapy services. The General Assembly lists an effective date of August 12, 2026.