Colorado's AI act set developer duties, then delayed them

The design

Colorado's legislature passed Senate Bill 24-205, “Consumer Protections for Artificial Intelligence,” and the governor signed it on 17 May 2024. The enacted bill adds a new part to the state's consumer protection statutes governing “high-risk artificial intelligence systems,” defined as any AI system that, when deployed, makes or is a substantial factor in making a “consequential decision” affecting a consumer's access to things such as employment, housing, or health care. The act creates two regulated roles: a “developer,” who builds or substantially modifies such a system, and a “deployer,” who puts it to use. As enacted, the duties attached to both roles were to begin on 1 February 2026.

What the evidence says

The statute sets out what each duty requires: developers must use “reasonable care” against foreseeable algorithmic discrimination, document a system's intended uses and limitations, and disclose that to deployers. Deployers must maintain a risk-management program and complete impact assessments before deploying a high-risk system. A year later the legislature returned in a special session and passed Senate Bill 25B-004, “Increase Transparency for Algorithmic Systems,” approved 28 August 2025. Its enacted text does not repeal the duties; it replaces “February 1, 2026” with “June 30, 2026” everywhere the earlier act used that date, extending compliance without altering what developers and deployers must do.

What it asks of people

The act does not ask consumers to do anything directly; it asks businesses to document and disclose. But it gives a Colorado consumer a defined path if a high-risk system is used against them: someone subject to a consequential decision is entitled to a plain-language notice, a chance to correct the data used, and a right to appeal to a human when technically feasible. Those entitlements sit inside the same duty-of-care structure now pushed to mid-2026, so relying on the statute's protections before that date means relying on requirements not yet operative.

Privacy and safeguards

The act layers onto Colorado's existing consumer protection law rather than creating a new privacy regime; it does not set retention limits or grant a standalone right to delete AI-processed data. Enforcement is reserved to the state Attorney General, with no private right of action, and the statute lets a developer or deployer rebut liability by showing it complied with the act's documentation duties or a recognized risk-management framework. What the act does not cover is any duty specific to emotional or companionship-style AI systems; a high-risk determination turns on the type of decision a system makes, not on whether it simulates a relationship.

• Does a given AI system make or substantially influence a decision the statute defines as consequential?
• Which date governs a specific duty: the original February 2026 date or the June 2026 date substituted by SB25B-004?
• What has the Attorney General published about how “reasonable care” will be assessed once the duties take effect?

Colorado's act is a broader consumer-protection statute than the companion-chatbot laws this site has tracked in California and New York, built around decisions rather than relationships, and its own amended text now sets the clock for June 2026 rather than the date originally enacted.