Colorado AI Act: The First US Algorithmic Discrimination Law

The target is algorithmic discrimination: any condition in which use of an AI system results in unlawful differential treatment or impact disfavoring people on the basis of actual or perceived age, color, disability, ethnicity, genetic information, limited English proficiency, national origin, race, religion, reproductive health, sex, veteran status, or other protected classifications under Colorado or federal law. A high-risk AI system is one that, when deployed, makes or is a substantial factor in making a consequential decision: a decision with material legal or similarly significant effect on provision, denial, cost, or terms of education enrollment or opportunity, employment or an employment opportunity, a financial or lending service, an essential government service, healthcare services, housing, insurance, or a legal service. 'Substantial factor' captures systems that assist human deciders, not only fully automated ones, a resume screener that ranks candidates for a human recruiter is in scope. Carve-outs exclude systems performing narrow procedural tasks and enumerated technologies (calculators, spam filters, cybersecurity tools, spell-checkers) unless they make or substantially influence consequential decisions. The frame will feel familiar to EU AI Act readers, consequential-decision categories echo Annex III, but Colorado's single hinge is discrimination, not the EU's broader health-safety-fundamental-rights sweep, which makes disparate-impact analysis the technical center of Colorado compliance.

Developers (who create or intentionally and substantially modify a high-risk system) owe reasonable care against algorithmic discrimination plus a disclosure regime built to let deployers comply downstream. To deployers: a statement of the system's intended uses and known harmful or inappropriate uses; documentation of training-data summaries, known or foreseeable limitations and discrimination risks, the system's purpose, intended benefits, and evaluated performance; and the information a deployer needs to complete its impact assessments and to understand outputs and monitor performance. Publicly: a statement summarizing the types of high-risk systems the developer makes available and how it manages known or reasonably foreseeable algorithmic-discrimination risks. To the Attorney General: disclosure, within 90 days, of any known or reasonably foreseeable risk of algorithmic discrimination the developer discovers the system has caused or is reasonably likely to cause, whether discovered internally or via a credible deployer report. The duty of care carries a rebuttable presumption of compliance if the developer meets the section's requirements, the statute's core carrot: paper the disclosures properly and the burden shifts. For AI vendors selling into Colorado's covered sectors, the practical work is productizing this documentation, a 'Colorado packet' per system, versioned with releases, because every deployer's compliance depends on receiving it and contracts will demand it.

Deployers (Colorado businesses using high-risk systems) carry the heavier operational load. Risk-management program: a documented, iterative program governing high-risk AI deployment, and the statute names its acceptable shapes, the NIST AI Risk Management Framework, ISO/IEC 42001, or another recognized comparable framework, sized to the deployer's scale and the system's risk. Impact assessments: before deploying and at least annually (and within 90 days after an intentional substantial modification), covering purpose and intended use, discrimination risk analysis and mitigation, data categories processed, performance metrics and limitations, transparency measures, and post-deployment monitoring; assessments are retained and producible to the AG on demand. Consumer notice: before or at the time a high-risk system makes or substantially factors into a consequential decision about a consumer, tell them, plus a plain-language statement of the system's purpose and the decision's nature, and the deployer's public website must describe the high-risk systems it deploys and its risk management. Adverse decisions: if the decision is adverse, the consumer gets the principal reasons (including the degree the system contributed and the data types and sources involved), an opportunity to correct inaccurate personal data the decision relied on, and an opportunity to appeal with human review where feasible. Small-deployer relief: employers under 50 FTE using systems as intended without their own training data get partial exemptions from the program, assessment, and website duties. General-purpose consumer-facing AI (any AI system interacting with consumers, not just high-risk) must disclose it is AI unless obvious.

The original effective date was February 1, 2026. It is now June 30, 2026, moved by SB 25B-004 in an August 2025 special session, and the story behind the move matters for planning. Governor Polis signed SB 24-205 in May 2024 'with reservations,' publicly inviting amendment before effectiveness; a 2025 regular-session rewrite effort (SB 25-318) collapsed; stakeholder negotiations between industry (seeking narrower definitions, duty relief for small business, and delay) and consumer advocates (defending the discrimination core) deadlocked; and the special session produced only the delay, not substantive amendment. Read three implications. First, the June 30, 2026 date is real for planning purposes, systems, contracts, and assessment programs take quarters to build, and betting on repeal is not a program. Second, substantive amendment before effectiveness remains genuinely possible in the 2026 regular session, most plausibly around definitions, small-business thresholds, and cure provisions, so build the durable components (inventory, discrimination testing, vendor documentation flows) that survive any likely amendment, and defer only the pure-paperwork artifacts most exposed to rewording. Third, Colorado's stumble chilled copycat momentum, other states watched the fight, Connecticut's similar bill stalled repeatedly, and the 2025-2026 state pattern shifted toward narrower laws (Utah's disclosure statute, Illinois' employment-AI amendments, Texas's TRAIGA) and toward scrutiny of federal preemption efforts, so Colorado remains the high-water mark of US comprehensive AI regulation for now.

Against the EU AI Act: Colorado borrowed the consequential-decision architecture but narrowed the harm to discrimination, dropped the prohibition tier and conformity-assessment machinery, and split duties along the same developer/deployer seam. A company building EU high-risk compliance holds most Colorado assets already: the EU risk-management system exceeds Colorado's program requirement (both map to NIST AI RMF and ISO 42001), Annex IV documentation covers most of Colorado's developer disclosure content, and EU human-oversight design covers Colorado's human-review expectations; the genuine Colorado deltas are the discrimination-specific impact analysis (disparate-impact testing against US protected classes, a different statistical and legal exercise than EU fundamental-rights analysis), the adverse-decision explanation and appeal workflow with its specific content requirements, and the AG-notification clock. Against the Colorado Privacy Act: the CPA's profiling opt-out and DPIA requirements already touch automated decisions with significant effects, and the two regimes share data-inventory and assessment plumbing; run one assessment pipeline emitting both artifacts, and reconcile the consumer-notice surfaces so the privacy notice, CPA opt-out disclosures, and AI Act statements do not contradict each other. Sequencing for a company facing both continents: EU first if 2026 EU exposure exists (broader duties, bigger fines), Colorado's deltas layered on the same chassis; Colorado-only companies should stand up NIST AI RMF governance now, wire the vendor-documentation demands into procurement immediately (developer packets take vendors quarters to produce), build discrimination testing where consequential decisions run, and hold the notice and appeal templates until the amendment picture clarifies in spring 2026.