The Colorado AI Act, formally Senate Bill 24-205, was signed into law in May 2024 and takes effect on February 1, 2026. It is the first comprehensive US state law regulating AI systems used in consequential decisions, and it sets a template that other states are watching closely.
The Act applies to "high-risk artificial intelligence systems," defined as systems that, when deployed, make or are a substantial factor in making a consequential decision. Consequential decisions are those that materially affect a Colorado consumer's access to or terms of education, employment, financial services, government services, healthcare, housing, insurance, or legal services. The definition is broader than it sounds; an AI tool used to score job applicants, screen rental applications, or set insurance premiums is in scope.
The Act imposes obligations on two categories: developers (who build the AI system) and deployers (who use it in a consequential-decision context). Developers must provide deployers with the documentation needed to complete an impact assessment, disclose foreseeable risks of algorithmic discrimination, and describe the data used to train the system. Deployers must implement a risk management program, complete impact assessments before deployment and annually, notify consumers when an AI system is used in a consequential decision, and offer a way to appeal an adverse decision.
For SaaS vendors selling into Colorado-touching workflows, the practical impact is that contracts with Colorado deployers will need to include the developer-disclosure obligations explicitly. Most modern AI vendor MSAs are adding Colorado-AI-Act exhibits in 2025 to land that contractually before the February 2026 enforcement date.