On 17 May 2024, Colorado Governor Jared Polis signed Senate Bill 24-205, “Consumer Protections for Artificial Intelligence,” making Colorado the first US state to pass a broad law targeting algorithmic discrimination by artificial intelligence systems. The law was scheduled to take effect on 1 February 2026, though its implementation date was later debated and revisited by the legislature.
The act imposes a duty of “reasonable care” on both developers and deployers of high-risk AI systems to protect consumers from algorithmic discrimination. Developers must give deployers documentation describing the system and supporting impact assessments, publish a public statement about the high-risk systems they make and how they manage discrimination risk, and disclose known risks of algorithmic discrimination to the state attorney general within 90 days of discovery. Deployers must implement risk-management policies, complete impact assessments, conduct annual reviews, notify consumers when an AI system makes a consequential decision about them, and allow consumers to correct inaccurate data and appeal adverse decisions. The law also requires anyone deploying consumer-facing AI in Colorado to disclose that a person is interacting with an AI system.
Colorado’s approach echoes the EU AI Act’s focus on high-risk systems and impact assessments, but it operates at the level of a single US state. For businesses, it signals the start of a patchwork of differing state AI laws in the United States, a contrast with the EU’s single harmonized regulation, and a reason companies operating across states must track each jurisdiction separately.