Colorado AI Act and US State AI Laws: A Business Guide

The Colorado AI Act is the first broad US state law to regulate how businesses develop and use AI systems that make or shape consequential decisions about people, such as who gets hired, insured, housed, treated or lent money. It requires developers to document their systems and deployers to run a risk management program, complete impact assessments, notify consumers and give them a way to correct data and appeal. Other states have narrower laws, and the EU AI Act reaches US companies whose systems are used in Europe. This is general information, not legal advice; the Colorado law’s timing and scope have been revisited since passage, so verify the current official text and effective date before you plan around it.

The landscape: state laws, federal guidance, EU AI Act

There is no comprehensive federal AI statute in the United States. What exists at the federal level is guidance and enforcement under laws that predate AI: the voluntary NIST AI Risk Management Framework, consumer protection enforcement against deceptive AI claims, employment discrimination law applied to hiring tools, adverse action requirements in consumer credit, and sector rules in healthcare, finance and medical devices. Executive branch policy has shifted between administrations, and federal preemption of state AI laws has been proposed more than once. Check the current status rather than assuming either direction.

State AI laws fill the gap, and they come in several shapes:

• Broad algorithmic discrimination laws. Colorado’s act is the model: duties on developers and deployers of high-risk systems, built around impact assessments, notices and a risk management program.
• Disclosure laws. Utah requires businesses to tell consumers when they are interacting with generative AI in certain circumstances, with stricter rules for regulated occupations. California requires large AI providers to offer detection tools and content disclosures, and requires generative AI developers to publish training data summaries.
• Employment-specific rules. Illinois prohibits discriminatory use of AI in employment decisions and requires notice to employees; New York City requires bias audits and notices for automated employment decision tools.
• Sector and use-case laws. Texas restricts certain intentional harmful uses of AI and sets disclosure duties for government agencies and healthcare providers. Several states regulate chatbots in mental health, AI in patient communications, deepfakes and the use of a person’s voice or likeness.
• Privacy laws with AI provisions. Most comprehensive state privacy laws give consumers the right to opt out of profiling used for decisions with legal or similarly significant effects and require data protection assessments for that processing. California’s privacy regulator has added rules for automated decision-making technology.

Then there is the EU AI Act. It applies to providers who place AI systems on the EU market and to providers and deployers outside the EU when a system’s output is used in the EU. It sorts systems into prohibited practices, high-risk systems with heavy obligations, systems with transparency duties such as chatbots and synthetic media, and everything else, and it also regulates general-purpose AI models. Its provisions apply in phases over several years, so a US company with EU customers should confirm which obligations are live.

For a business, the practical consequence is that AI compliance is a mapping exercise. You identify your AI systems and the decisions they touch, then check each against the laws of the states where the affected people live and the markets where the system is used.

The Colorado AI Act in plain language

The act, part of Colorado’s consumer protection law, applies to developers and deployers of high-risk AI systems that do business in Colorado. A developer is a business that develops, or intentionally and substantially modifies, an AI system. A deployer is a business that uses a high-risk AI system. A company can be both, for example when it builds its own screening model and uses it.

The central duty on both is to use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination arising from the intended uses of a high-risk system. Algorithmic discrimination means unlawful differential treatment or impact based on protected characteristics such as age, disability, race, sex, religion, national origin or others protected under state or federal law. The act then lists specific obligations for each role, and a business that meets its list earns a rebuttable presumption that it used reasonable care.

Three further features shape how the law works in practice:

• Enforcement sits with the Colorado Attorney General. There is no private right of action. Violations are treated as deceptive trade practices, and the Attorney General has rulemaking authority to add detail.
• Frameworks count. The risk management program must be reasonable in light of a recognized framework, and the act names NIST AI RMF and ISO/IEC 42001 as examples. There is an affirmative defense for a business that discovers and cures a violation through its own testing and red-teaming while complying with such a framework.
• Not every AI use is covered. Only high-risk systems trigger the full duties. One obligation applies more broadly: any business that deploys an AI system that interacts with consumers must disclose that the consumer is dealing with AI, unless that would be obvious to a reasonable person.

The legislature has revisited the effective date and the scope since passage and may do so again. Treat any summary, including this one, as a map of the structure rather than a statement of the current text.

What “high-risk AI system” means

A high-risk AI system is one that, when deployed, makes a consequential decision or is a substantial factor in making one. A consequential decision is one with a material legal or similarly significant effect on whether a consumer is provided or denied, or the cost or terms of, any of the following:

• education enrollment or an education opportunity;
• employment or an employment opportunity;
• a financial or lending service;
• an essential government service;
• healthcare services;
• housing;
• insurance;
• a legal service.

“Substantial factor” is the phrase that catches most businesses. A model does not have to make the final call: if its score, ranking or recommendation is a meaningful input to a human’s decision, the system is in scope. A resume screener that ranks applicants before a recruiter looks at them is a substantial factor. So is a model that flags claims for a human adjuster to deny.

The act excludes systems that perform narrow procedural tasks or that only detect patterns without replacing human judgment, and it lists technologies that are not high-risk unless they make or substantially influence consequential decisions, such as anti-fraud tools that do not use facial recognition, cybersecurity and anti-malware tools, calculators, spreadsheets, databases, spam filters and similar software. The test is always what the system does in your decision process, not what the vendor calls it. A general-purpose chatbot used to draft emails is not high-risk; the same chatbot wired into a loan workflow to summarize and score applications may be.

Developer vs deployer duties

Area	Developer (builds or substantially modifies the system)	Deployer (uses the system to make consequential decisions)
Core duty	Reasonable care to avoid algorithmic discrimination from intended and contracted uses	Reasonable care to avoid algorithmic discrimination in deployment
Documentation	Provide deployers with a statement of intended uses and known harmful or inappropriate uses, high-level summaries of training data, known limitations and discrimination risks, evaluation and mitigation methods, data governance measures, intended outputs, guidance on proper use and monitoring, and the information deployers need to complete impact assessments	Obtain and keep the developer’s documentation; record how the system is configured and used
Risk management program	Not required as such, but evaluation and mitigation must be documented	Required: an iterative policy and program covering identification, documentation and mitigation of discrimination risks, reasonable in light of NIST AI RMF, ISO/IEC 42001 or a comparable framework, and proportionate to the business and the system
Impact assessment	Support the deployer’s assessment with documentation	Required before deployment, after an intentional and substantial modification, and periodically, covering purpose and use, discrimination risks and mitigations, data categories and outputs, performance metrics, transparency measures and post-deployment monitoring; records kept for the period the act sets
Consumer notices	None directly	Before a consequential decision: tell the consumer a high-risk system is in use, its purpose and nature, how to reach the deployer and where to find the public statement, and how to exercise related privacy rights. After an adverse decision: give the principal reasons, how much the AI contributed, the type and source of data used, an opportunity to correct inaccurate personal data, and an opportunity to appeal with human review where technically feasible
Public statement	Publish a summary of the high-risk systems developed and how discrimination risks are managed	Publish a summary of the high-risk systems deployed, how risks are managed, and the information collected and used
Reporting discrimination	Notify the Attorney General and known deployers of discovered or reasonably foreseeable discrimination risks within the period the act sets	Notify the Attorney General of discovered algorithmic discrimination within the period the act sets
Exemptions	Certain systems already regulated under other regimes	A limited exemption from some duties for smaller deployers that meet conditions (verify the current threshold and conditions); consumer notices still apply

Vendors sell models and platforms; customers deploy them. That split means the contract between them does real compliance work. Deployers should require the developer documentation in the contract, with an obligation to update it when the model changes. Developers should state intended uses precisely, because the reasonable care duty is measured against them.

Readiness checklist

The following list works for organizations of every size. A founder with one scoring model will finish it in a few days; a company with dozens of vendor systems will run it as a program. Most of it is good AI governance regardless of which law applies.

1. Inventory every AI system, including AI features inside vendor software, and record what decisions each one touches.
2. Flag anything that makes or substantially influences a decision in the eight consequential domains: education, employment, financial or lending services, government services, healthcare, housing, insurance and legal services.
3. Assign a role for each flagged system: developer, deployer or both. If you fine-tune or substantially modify a vendor model, you may have developer duties.
4. Map jurisdictions: which states the affected consumers live in, and whether any output is used in the EU.
5. Adopt a written AI risk management policy and program aligned with NIST AI RMF or ISO/IEC 42001, proportionate to your size and systems. Our guide to building an AI governance framework gives the structure.
6. Complete an impact assessment for each high-risk system and set a cadence for repeating it. Use the method in our AI risk assessment guide.
7. Collect developer documentation from every vendor and add contract clauses requiring it, including notice of model changes.
8. Write the consumer notices: the pre-decision notice, the adverse decision explanation, the correction process and the appeal path with human review.
9. Add AI interaction disclosures to chatbots and other consumer-facing AI, whether or not they are high-risk.
10. Publish the public statement describing your high-risk systems and how you manage them.
11. Set up monitoring and periodic review for algorithmic discrimination, with a defined process for investigating findings and notifying the Attorney General where the act requires it.
12. Keep records of assessments, notices, reviews and vendor documentation for the retention period the act sets.
13. Train the people who use the systems on what the notices mean and how to handle correction and appeal requests.
14. Assign an owner to track the law, its effective date, Attorney General rules and amendments, and the equivalent laws in other states where you operate.

If you already have a program built on the basics of AI governance, the Colorado-specific additions are mainly the consumer notices, the public statement and the formal impact assessment records.

Where PS3G fits

PS3G helps organizations of every size get ready for state AI laws without building a bureaucracy. Our AI governance services cover the inventory, the risk management policy and program aligned with NIST AI RMF and ISO 42001, impact assessments, vendor documentation requests and the consumer notice workflows. Our IT compliance consulting practice maps those controls to the privacy and security frameworks you may already maintain, so the evidence serves more than one obligation. We are not a law firm; we prepare the program and the documentation, work with your counsel on interpretation and filings, and apply the same work to our own software products, which keeps the advice practical.

Related reading

• AI Risk Assessment: How to Run One (Template and Examples)
• What Is AI Governance? A Practical Guide for Any Size of Organization
• AI Governance Framework: How to Build One (Structure + Examples)
• AI governance services and IT compliance consulting from PS3G

Frequently asked questions

Does the Colorado AI Act apply to businesses outside Colorado?

It applies to developers and deployers doing business in Colorado, which can include companies based elsewhere whose high-risk systems affect Colorado consumers. If you sell, hire, lend, insure or treat people in Colorado and an AI system influences those decisions, assume you are in scope and confirm with counsel. The same mapping exercise applies to every state with its own AI law.

Is a general-purpose chatbot a high-risk AI system?

Not on its own. A chatbot used to draft emails or summarize documents does not make consequential decisions. It becomes high-risk when it is built into a process that decides or substantially influences someone’s access to employment, credit, housing, insurance, healthcare, education, government or legal services. The consumer interaction disclosure, however, applies to consumer-facing chatbots regardless of risk level.

What is the difference between a developer and a deployer?

A developer builds an AI system or intentionally and substantially modifies one; a deployer uses a high-risk system to make consequential decisions. Developers owe documentation, public statements and risk disclosures. Deployers owe a risk management program, impact assessments, consumer notices, correction and appeal processes and a public statement. A company that fine-tunes a vendor model for its own decisions may carry both sets of duties.

Are small businesses exempt from the Colorado AI Act?

The act includes a limited exemption for smaller deployers that meet specific conditions, such as using the system only as the developer intended and not training it on their own data, which relieves them of some program and assessment duties. Consumer notice obligations still apply. The threshold and conditions have been part of the amendment debate, so verify the current text before relying on the exemption.

Who enforces state AI laws, and can consumers sue?

Under the Colorado AI Act, the Attorney General has exclusive enforcement authority and there is no private right of action. Other state laws vary: some are enforced by attorneys general or regulators, and employment or civil rights statutes may carry their own remedies. Existing laws on discrimination, consumer protection and privacy continue to apply alongside the AI-specific ones.

Does following NIST AI RMF or ISO 42001 make us compliant?

Not by itself. The Colorado act treats those frameworks as the measure of a reasonable risk management program and ties an affirmative defense to following them, but the specific duties, such as impact assessments, notices, the public statement and Attorney General reporting, still have to be met. Use the framework as the structure and the statute as the checklist.