Colorado Artificial Intelligence Laws: 3 Takeaways for Boards

Here are some of the most important laws for Colorado boards and businesses to know. 

1. Colorado AI Act (SB 205 – Enacted May 2024) 

The Colorado Artificial Intelligence Act, or Colorado AI Act, aims to minimize various potential risks associated with developing and using new AI technology. It includes sections that apply to developers of new generative AI systems and the boards or other groups that incorporate them. These groups are referred to as deployers. 

The CAIA primarily focuses on known AI security risks, especially in high-impact sectors like finance, health care, employment, or housing. These industries handle sensitive data and essential services, raising the stakes for potential harm if AI is misused or fails.

The Colorado AI Act imposes several types of compliance regulations on AI developers and deployers to reduce potential risks. These regulations include: 

• Requirements to disclose key information about how AI systems are used and why they were adopted
• Adequate risk management policies that document specific risks associated with each AI program and how the developer or deployer mitigates them
• Transparency guidelines to ensure that developers and deployers properly share information about the types of data that AI programs use 
• Regular impact assessments of each AI system 

The Colorado Artificial Intelligence Act is scheduled to go into effect on Feb. 1, 2026. At this time, the Colorado Attorney General will be responsible for ensuring that AI system developers and deployers comply with its regulations. 

Board Takeaway: If your company uses AI in key decision areas (employment, housing, financial services, education, health care, public services), you will be subject to significant governance obligations. Boards will need regular reporting on AI audits, impact assessment, and fairness risks.

2. Colorado Privacy Act (CPA) (Enacted July 2023)

The Colorado Privacy Act, or CPA, addresses residents’ rights to their personal data. It aims to limit the ways in which businesses gather and use personal information about their customers, particularly without their knowledge. It significantly increases businesses’ obligation to be transparent with their customers about the specific types of data they are gathering, how they are gathering it, and how they are using it. 

The CPA applies to businesses that are based in Colorado, as well as those that do business with Colorado residents. Businesses must gather data from a minimum of 100,000 customers per year or directly benefit from the data of at least 25,000 customers per year to be impacted by this Act. 

Businesses that are impacted by the CPA must allow customers to opt out from having their data processed. They must also conduct regular data protection assessments to study how specific types of data are being gathered and processed. During these assessments, businesses must identify specific risks that gathering specific types of data have and draft solutions for reducing their impact. 

Board Takeaway: Any AI system that leverages personal data for automated profiling or decisions is subject to CPA obligations. This overlaps heavily with the AI Act for governance coverage.

3. Federal and National Context  

While Colorado leads state-level regulation, federal activity is highly relevant. There are several federal laws that Colorado boards should be aware of, including: 

1. FTC enforcement: The Federal Trade Commission continues to crack down on AI-driven deceptive or unfair practices under existing consumer protection laws.
2. SEC disclosures: The U.S. Securities and Exchange Commission expects companies to disclose material AI-related risks in investor filings.
3. EU AI Act: Colorado organizations with operations or users in the European Union must prepare for compliance, as the EU’s framework imposes transparency, accountability, and safety standards.