Colorado’s SB24‑205 and SB4 sit at the center of the state’s rapidly expanding AI‑governance framework. Together, they create one of the most comprehensive state‑level regulatory regimes in the United States, pairing broad consumer‑protection rules for high‑risk AI systems with sector‑specific obligations for public agencies. The two laws are complementary: SB24‑205 governs how private‑sector and public‑sector entities develop and deploy high‑risk AI, while SB4 focuses on transparency and accountability in government use of AI.
Colorado SB24‑205 — Consumer Protections for Artificial Intelligence
Colorado’s SB24‑205, signed May 17, 2024, is widely recognized as the first comprehensive U.S. state law regulating high‑risk AI systems. It establishes duties for both developers and deployers of AI systems that make or substantially influence “consequential decisions” affecting individuals in areas such as employment, education, housing, insurance, healthcare, financial services, and legal services.
Core requirements
- Reasonable‑care duty for developers and deployers to prevent known or reasonably foreseeable risks of algorithmic discrimination.
- High‑risk system definition tied to AI used in consequential decisions with material legal or similarly significant effects.
- Developer obligations, including:
- Providing deployers with detailed documentation about system purpose, limitations, training data, and known risks.
- Disclosing known or foreseeable risks of algorithmic discrimination.
- Deployer obligations, including:
- Implementing risk‑management policies and impact assessments.
- Notifying consumers when high‑risk AI is used to make consequential decisions.
- Providing adverse‑action notices when AI contributes to a negative outcome.
- Rebuttable presumption of reasonable care if entities follow the statute’s documentation, testing, and disclosure requirements.
- Effective date: February 1, 2026.
Significance
SB24‑205 is the first U.S. law to impose affirmative duties on AI developers, not just deployers, and the first to create a risk‑based regulatory structure for high‑impact AI systems. It is now a reference point for other states and for federal policymakers evaluating AI‑governance models.
Colorado SB4 — AI Use in State Government (2024 Special Session)
Colorado’s SB4 (Special Session 2024) focuses on government use of AI, creating transparency, accountability, and governance requirements for state agencies. While SB24‑205 regulates both private and public actors, SB4 is narrower and applies only to state government operations.
Core requirements
- Inventory and disclosure: State agencies must identify and publicly disclose their use of AI systems, including high‑risk or automated decision‑making tools.
- Governance policies: Agencies must adopt internal policies governing procurement, deployment, monitoring, and auditing of AI systems.
- Bias‑mitigation and safety: Agencies must evaluate AI systems for discriminatory or harmful impacts and implement mitigation strategies.
- Public transparency: Agencies must provide clear explanations of how AI systems are used in public‑facing services and how individuals may contest automated decisions.
- Oversight structure: Establishes reporting requirements to the Governor and legislature to ensure ongoing accountability.
Significance
SB4 ensures that Colorado’s own government adheres to the same principles of fairness, transparency, and responsible AI use that SB24‑205 imposes on the private sector. It positions Colorado as one of the first states to create a dual‑track AI governance system—one for the private sector and one for public agencies.
How the two laws work together
SB24‑205 and SB4 form a coordinated regulatory framework:
- SB24‑205 governs high‑risk AI systems across both private and public sectors, focusing on consumer protection and algorithmic discrimination.
- SB4 governs all AI use by state agencies, emphasizing transparency, accountability, and public trust.
- Together, they create a full‑spectrum AI governance model that addresses both the risks of private‑sector AI deployment and the responsibilities of government agencies using AI in public services.