Does the Colorado AI Act apply to my business?
- SB 24-205 no longer exists; test applicability against SB 26-189.
- Three questions: covered ADMT, consequential decisions, Colorado residents.
- Deployers carry the consumer-facing duties; developers carry the documentation duty.
- Location does not exempt you — the duties follow the Colorado resident.
- Current as of July 2026. The Colorado position is in active motion; this guide tracks the live state.
The test, under the law that actually exists
Ask three questions. Does a system of yours process personal data to produce predictions, recommendations, classifications or scores? Do those outputs guide or assist consequential decisions about individuals, in domains like employment, lending, housing, insurance, education or essential services? And do any of those individuals live in Colorado? Three yeses and you are in scope as a deployer; if you build such technology and supply it to others who deploy it for Colorado residents, you are in scope as a developer.
Deployer duties versus developer duties
Deployers carry the consumer-facing duties: pre-use notice, the 30-day plain-language explanation after an adverse outcome, meaningful human review and reconsideration, access and correction of inaccurate personal data, and three-year record retention. Developers carry a documentation duty toward their deployers: intended uses, known harmful uses, training data categories, and known limitations. If you both build and deploy, you carry both sets. Note what is absent: the repealed law's risk management programmes, impact assessments, and duty of care do not exist under SB 26-189.
Location does not exempt you
The duties follow the Colorado resident, not your registered office. A London or San Francisco company whose scoring model influences decisions about people in Colorado is in scope on the same terms as a Denver one, which is the same extraterritorial logic buyers already apply under the GDPR and the EU AI Act.
What to do if you are in scope
Inventory the systems that meet the covered-ADMT test, name an owner for each, and wire the four consumer-facing duties into how each system already operates before 1 January 2027. Enforcement is currently paused pending litigation and rulemaking, which is a preparation window, not an exemption: the Attorney General's rules will define the detail, and the organisations that mapped their systems early will absorb those rules as configuration rather than as a programme.
Key terms
- Covered ADMT
- Automated decision-making technology that processes personal data to guide consequential decisions.
- Deployer
- An organisation using covered ADMT to guide consequential decisions about individuals.
- Developer documentation
- The information a developer must supply to a deployer under SB 26-189: intended uses, known harmful uses, training-data categories, known limitations.
- Colorado resident
- An individual located in Colorado to whom the consumer-facing duties of SB 26-189 flow.
- Effective date
- 1 January 2027 for SB 26-189, subject to litigation and rulemaking outcomes.