On May 17, Colorado’s governor signed the groundbreaking Consumer Protections for Artificial Intelligence Act. The Act regulates “high-risk AI systems” that are involved in making “consequential decisions” (such as decisions regarding employment, healthcare, financing, and education) that could result in discrimination against an individual based on age, race, sex, and other protected classifications. The law goes into effect on February 1, 2026.

The Act outlines several compliance requirements for Developers of high-risk AI systems and companies that obtain and use such systems (referred to as “Deployers” in the Act). Developers must provide Deployers with documentation describing the high-risk AI system, agree to assist the Deployer in conducting impact assessments, and provide a statement on its website describing the high-risk systems it develops. Certain Deployers must maintain a written AI risk management program, conduct annual impact assessments, disclose the use of high-risk AI systems, and provide consumers with certain rights, including a right opt out and to appeal adverse decisions. Additionally, Deployers must alert the Colorado Attorney General should the Deployer discover that the high-risk AI system is discriminatory.

The Colorado Attorney General has both rulemaking authority and exclusive authority to enforce the Act. Due to the Colorado Attorney General’s leadership in the technology space, we may be seeing rulemaking activity from the AG’s Office as early as this fall. Like the Colorado Privacy Act, which also governs automated decision-making, a violation of the Act constitutes a violation of the Colorado Consumer Protection Act, which allows the Attorney General to seek penalties of up to $20 thousand per violation and attorney’s fees and costs.