Colorado's AI law names 2026 for its consumer notice duty

The conversation

Colorado's governor signed Senate Bill 24-205, the Colorado AI Act, on 17 May 2024, after the legislature passed it with amendments in early May. The bill's own history page shows the multi-chamber path the text took before signature, and the signed act itself defines a high-risk artificial intelligence system as one that, when deployed, makes or is a substantial factor in making a consequential decision, and builds separate duty chapters for the developers who build such systems and the deployers who put them to use.

What the documents show

The signed text's section 6-1-1704 sets a disclosure duty that is broader than the high-risk category alone: a deployer or developer that makes an AI system available that is ‘intended to interact with consumers’ must ensure disclosure to each consumer that they are interacting with an AI system, and that duty is not required only where it ‘would be obvious to a reasonable person.’ Separately, sections 6-1-1702 and 6-1-1703 require developers and deployers of high-risk systems to use reasonable care against algorithmic discrimination, complete impact assessments, publish public statements summarising the system, and report discovered discrimination to the state attorney general within 90 days. The statute's own text repeats one phrase throughout these sections: each duty applies ‘on and after February 1, 2026,’ which is the date the enacted law itself sets for these obligations to take hold, distinct from the 17 May 2024 signature date.

The system boundary

Enforcement sits exclusively with the Colorado Attorney General, who also holds rulemaking authority under the act; the statute gives developers and deployers a rebuttable presumption of reasonable care where they have complied with the statute and any attorney-general rules, which functions as the law's defined path from a good-faith compliance program to a defense in an enforcement action rather than strict liability for every algorithmic outcome. The statute also lists carve-outs, including for legal-compliance activities, security incident response, and pre-market research and testing.

Where it fails

Because the 1 February 2026 date named in the enacted text is close to this entry's preparation date, a builder should verify the current statute directly rather than the 17 May 2024 signing date, since the substantive duties do not take hold on that earlier date. The enacted text is the only source checked here; it does not disclose whether later Colorado legislation has since amended that date, and a reviewer should recheck the current codified statute before relying on it.

• Does the deployment make or substantially factor into a ‘consequential decision’ as defined by the statute, which would put it in the higher-risk duty chapters?
• Even outside the high-risk category, does the system interact with consumers in a way that is not obviously an AI interaction, triggering section 6-1-1704's disclosure duty?
• Has the 1 February 2026 date in the enacted text been amended by any later Colorado legislation not reflected in the version reviewed here?

This entry describes the act as signed; it does not draw conclusions about compliance in any specific Colorado business.