Colorado AI Act: Requirements, 2026 Delay and Federal Fight

A duty of reasonable care, not a licensing regime

The State of Colorado signed SB24-205 into law on May 17, 2024, after it passed the Senate on May 3 and the House on May 8. It requires developers and deployers of high risk artificial intelligence systems, defined as systems that make or are a substantial factor in consequential decisions about employment, housing, lending, education, healthcare, insurance or legal services, to use reasonable care to protect consumers from algorithmic discrimination. [1]

Developers must disclose system information to deployers, provide documentation supporting deployers' own impact assessments, publish a statement summarizing their risk management practices, and report a known or reasonably foreseeable discrimination risk to the Colorado Attorney General within 90 days of discovering it. Deployers carry a parallel set of duties: a risk management policy, an annual impact assessment, notice to consumers before a high risk system is used to make a consequential decision about them, and an opportunity to correct erroneous data and appeal an adverse decision. Any business deploying AI in a consumer-facing capacity must also disclose that a consumer is interacting with an AI system. The Attorney General has exclusive enforcement authority, and a violation is treated as a deceptive trade practice under existing Colorado consumer protection law rather than as a new standalone penalty scheme. [1]

Atlas interpretation: The statute regulates a process, not an outcome. It does not ban any AI use case or require pre-approval before a system goes into production. Instead it obligates developers and deployers to document, disclose and correct, and leaves the substance of what counts as reasonable care to be worked out through Attorney General guidance and, eventually, enforcement actions. That design is closer to existing state data privacy statutes, which Colorado had already enacted, than to the European Union's approach of pre-market conformity assessment for high risk systems. [1]

A compliance date pushed back before it ever applied

SB24-205 as signed set its substantive requirements to take effect February 1, 2026, giving developers and deployers roughly a year and a half of lead time. That date never arrived. During an August 2025 special legislative session, the General Assembly passed SB25B-004, which the governor signed on August 28, 2025, extending the effective date of SB24-205's requirements to June 30, 2026, before any of them had come into force. [1][2]

Atlas interpretation: A delay enacted before a law's original date arrives is a different signal than a delay granted after enforcement problems surface. It suggests the legislature judged the compliance apparatus, the impact assessment process and the guidance needed to operationalize a vague reasonable care standard were not going to be ready in time, rather than that the underlying policy was in dispute. The law's substance was left untouched; only the clock moved. [2]

The law a federal order later named by name

SB24-205 was the first comprehensive state statute in the United States to regulate algorithmic discrimination broadly across high risk AI systems, arriving two months after the European Parliament adopted the EU AI Act's text and more than a year before other states, including California with its own frontier model safety statute, passed comparable measures. [1]

Atlas interpretation: That first mover status is why the law was later singled out at the federal level. The December 2025 executive order directing agencies to challenge state AI statutes named Colorado's algorithmic discrimination statute explicitly, arguing it risks forcing AI systems to alter truthful outputs in violation of the First Amendment. Being the first comprehensive state AI law made SB24-205 the most established target available when the federal government went looking for one, ahead of newer and narrower statutes that had not yet generated a compliance record to point to. [1]