Does the Colorado AI Act apply to my business?

Question 1: Does your AI make consequential decisions?

The law focuses on high-risk AI systems, those that are a substantial factor in making a consequential decision about a person. Consequential decisions are those affecting access to or terms of things like employment, lending, housing, education, healthcare, insurance, and essential services. If your AI influences decisions of this kind about individuals, it is likely in the law's scope. If your AI does something low-stakes and unrelated to such decisions, it is likely not.

Question 2: Does it affect Colorado residents?

The law is concerned with protecting Colorado consumers. If your high-risk AI system is used to make consequential decisions about people in Colorado, the law is relevant regardless of where your business is located. As with other such laws, the connection is to the affected individuals, not solely to where the company sits.

Question 3: What is your role?

If the law applies, your specific duties depend on whether you are a developer (you build or substantially modify the high-risk system) or a deployer (you use it to make consequential decisions). Developers carry documentation and disclosure duties toward deployers; deployers carry risk management, impact assessment, transparency, and anti-discrimination duties toward affected individuals. You can be both for different systems.

Exemptions and thresholds

Laws of this kind often include exemptions and thresholds, for example for smaller deployers or for certain narrow uses. Whether a particular exemption applies to you is a detailed question that depends on the current text of the law, which has been subject to legislative change. So while the three questions above tell you whether you are broadly in scope, confirming the precise application, including any exemption, requires checking the current statute.

What to do if you might be in scope

If your AI drives consequential decisions about people in Colorado, assume the law is relevant and prepare accordingly: know your role, govern the high-risk system, and be ready to meet the documentation, impact assessment, and transparency duties. Because these obligations overlap heavily with the EU AI Act and frameworks like the NIST AI RMF, a single governance practice can cover much of the ground. A readiness check can quickly map your systems against the high-risk criteria.

Key terms

Consequential decision

A decision affecting access to employment, credit, housing, healthcare, insurance, or similar.

Substantial factor

A material driver of a decision, even if not the sole one.

Colorado resident

An individual located in Colorado whose protection the law is concerned with.

Exemption

A statutory carve-out narrowing who or what the law applies to.

References

• Colorado General Assembly (SB 24-205)
• NCSL AI legislation tracker