What are the Colorado AI Act compliance deadlines?

May 17, 2024: SB 24-205 signed. Aug 28, 2025: SB 25B-004 delays the act. Feb 1, 2026: Original effective date (superseded). May 14, 2026: SB 26-189 signed (repeal and reenact). Jun 30, 2026: Delayed effective date (superseded). Jan 1, 2027: ADMT obligations apply. Jan 1, 2027: AG rules due. Jan 1, 2030: Mandatory cure period ends.

When does Colorado AI Act take effect?

Colorado AI Act takes effect on Jan 1, 2027. The next milestone is Jan 1, 2027: ADMT obligations apply.

Who does Colorado AI Act apply to?

Developers and deployers of covered ADMT that processes personal data to materially influence consequential decisions about Colorado consumers in education, employment, housing, financial/lending services, insurance, health care and essential government services. No revenue or volume threshold identified. SB 26-189 removed the federally-regulated-entity exemptions in SB 24-205.

What are the penalties under Colorado AI Act?

Violations are deceptive trade practices under the Colorado Consumer Protection Act (civil penalties under C.R.S. 6-1-112). No private right of action. Until January 1, 2030 the AG must give a 60-day notice and opportunity to cure where a cure is possible.

Colorado AI Act

Enacted Colorado · In force Jan 1, 2027 · next deadline Jan 1, 2027 (in 2 months)

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

Coming up

Takes effectJan 1, 2027 · in 2 months · Source

ADMT obligations applyDeveloper documentation, consumer notices, post-adverse-outcome disclosure, correction and human-review rights take effect.

ComplianceJan 1, 2027 · in 2 months · Source

AG rules dueAttorney General must adopt rules clarifying the post-adverse-outcome disclosure requirements.

SunsetJan 1, 2030 · in 3.2 years · Source

Mandatory cure period endsThe AG's obligation to offer a 60-day notice-and-cure period expires.

Already passed

Transition endsJun 30 · 4 months ago · Source

Delayed effective date (superseded)SB 25B-004 date; superseded by SB 26-189 before it arrived, so no obligations applied.

MilestoneMay 14 · 5 months ago · Source

SB 26-189 signed (repeal and reenact)SB 26-189 replaces SB 24-205 with a narrower ADMT disclosure framework and moves the effective date to January 1, 2027.

Transition endsFeb 1 · 9 months ago · Source

Original effective date (superseded)Original SB 24-205 date; postponed by SB 25B-004, so no obligations applied.

Transition endsAug 28, 2025 · 14 months ago · Source

SB 25B-004 delays the actSpecial-session bill pushes the SB 24-205 effective date from February 1, 2026 to June 30, 2026.

MilestoneMay 17, 2024 · 2.4 years ago · Source

SB 24-205 signedGovernor Polis signs the original Colorado AI Act with a February 1, 2026 effective date.

Summaries for reference, not legal advice. Check the official text.

What it does

Colorado's 2024 high-risk AI law (risk-management programs, impact assessments) never took effect: it was delayed to June 30, 2026 and then repealed and reenacted by SB 26-189, signed May 14, 2026, as a narrower automated decision-making technology (ADMT) law. From January 1, 2027, developers must give deployers technical documentation (intended uses, training data categories, limitations) and deployers must notify consumers at the point of interaction, explain ADMT's role within 30 days after an adverse outcome, and offer data correction and meaningful human review. Impact-assessment and risk-management-program mandates were dropped; 3-year record retention remains.

Who it applies to: Developers and deployers of covered ADMT that processes personal data to materially influence consequential decisions about Colorado consumers in education, employment, housing, financial/lending services, insurance, health care and essential government services. No revenue or volume threshold identified. SB 26-189 removed the federally-regulated-entity exemptions in SB 24-205.
Penalties: Violations are deceptive trade practices under the Colorado Consumer Protection Act (civil penalties under C.R.S. 6-1-112). No private right of action. Until January 1, 2030 the AG must give a 60-day notice and opportunity to cure where a cure is possible.
Enforced by: Colorado Attorney General (exclusive)
Official name: Colorado SB 24-205 (Consumer Protections for Artificial Intelligence), as delayed by SB 25B-004 and repealed and reenacted by SB 26-189 (Automated Decision-Making Technology)
Citation: SB 24-205 (2024); SB 25B-004 (2025 1st Extraordinary Session); SB 26-189 (2026); C.R.S. Title 6, Art. 1, Part 17
Topics: AI, Privacy

Verified 2026-09-22 leg.colorado.gov leg.colorado.gov coag.gov consumerfinancemonitor.com akingump.com

Research notes

SB 24-205's high-risk AI obligations never became operative. SB 26-189 was signed May 14, 2026, which is why the June 30, 2026 date never took effect. Specific Colorado AG rulemaking hearing dates under SB 26-189 were not verified. The per-violation civil penalty amount comes from the general Colorado CPA and is not restated in SB 26-189.

EnactedAlabama

Alabama Personal Data Protection Act (APDPA)Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.Next: May 1, 2027 APDPA takes effect · in 6 months

In forceArkansas

Arkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026

AmendedCalifornia

CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months

In forceCalifornia

California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026

In forceCalifornia

California ADS employment regulationsClarifies that using an automated-decision system in hiring or other employment decisions can violate the Fair Employment and Housing Act if it discriminates on protected traits. Employers must keep automated-decision data and employment records for at least four years. AI assessments that elicit disability information can be unlawful medical inquiries.In effect since Oct 1, 2025

EnactedCalifornia

California AI Auditor RegistryCreates a state registry for AI auditors run by the Government Operations Agency. From 2029 only registered auditors may offer, sell or conduct covered AI audits, and they must show their registration number in advertising. Registered auditors must file information and follow conduct rules.Next: Jan 1, 2027 Act takes effect · in 2 months

AmendedCalifornia

California AI Transparency Act (SB 942)Covered generative AI providers must offer a free AI-content detection tool, give users the option of a visible (manifest) disclosure on AI-generated image, video or audio, and embed a latent, machine-readable provenance disclosure. Licensees must keep those disclosures intact, and providers must revoke a license within 96 hours of learning a licensee disabled them. AB 853 delayed the operative date to August 2, 2026 and extends duties to large online platforms and GenAI hosting platforms from 2027 and to capture-device makers from 2028.Next: Jan 1, 2027 Large online platform and hosting platform duties · in 2 months

In forceCalifornia

California AI autonomous-harm defense banA defendant that developed, modified or used AI cannot argue in a civil case that the AI acted autonomously and so caused the harm on its own. Other defenses such as causation and comparative fault remain.In effect since Jan 1, 2026

Questions about Colorado AI Act

What are the Colorado AI Act compliance deadlines?: May 17, 2024: SB 24-205 signed. Aug 28, 2025: SB 25B-004 delays the act. Feb 1, 2026: Original effective date (superseded). May 14, 2026: SB 26-189 signed (repeal and reenact). Jun 30, 2026: Delayed effective date (superseded). Jan 1, 2027: ADMT obligations apply. Jan 1, 2027: AG rules due. Jan 1, 2030: Mandatory cure period ends.
When does Colorado AI Act take effect?: Colorado AI Act takes effect on Jan 1, 2027. The next milestone is Jan 1, 2027: ADMT obligations apply.
Who does Colorado AI Act apply to?: Developers and deployers of covered ADMT that processes personal data to materially influence consequential decisions about Colorado consumers in education, employment, housing, financial/lending services, insurance, health care and essential government services. No revenue or volume threshold identified. SB 26-189 removed the federally-regulated-entity exemptions in SB 24-205.
What are the penalties under Colorado AI Act?: Violations are deceptive trade practices under the Colorado Consumer Protection Act (civil penalties under C.R.S. 6-1-112). No private right of action. Until January 1, 2030 the AG must give a 60-day notice and opportunity to cure where a cure is possible.

Deadlines

What it does

Related