If you run a business in Colorado and use any AI tools to make decisions about people, you have 88 days.
June 30, 2026 is when the Colorado AI Act (SB24-205) takes effect — the first comprehensive state AI law in the United States. It's been on the books since May 2024. The two-year runway for compliance ends this summer.
Here's the plain-language guide to what it means for Colorado small business owners.
Who This Law Applies To
The Colorado AI Act targets "high-risk AI systems" — specifically, AI that makes or significantly influences "consequential decisions" about consumers in these areas:
- Employment (hiring, firing, promotions, performance reviews)
- Housing (rental applications, mortgage decisions)
- Healthcare (access to services, treatment decisions)
- Financial services (loans, insurance, credit decisions)
- Education (admissions, scholarships, academic standing)
- Legal services (access to legal help, legal decisions)
If your business uses any AI tool that touches these areas, even as just one factor in a larger decision, this law likely applies to you.
The Small Business Exemption (Read This Carefully)
Colorado included a narrow exemption for small businesses. If you have fewer than 50 full-time employees, you may be exempt from most requirements, but only if BOTH conditions are true:
- You don't use your own data to train or customize the AI system
- You only use the AI tool for the purposes the developer already disclosed
Translation: If you're using an off-the-shelf AI tool exactly as designed and haven't trained it on your own data, you're probably exempt.
But: If you've customized the tool with your own data, fine-tuned it, or use it in ways the vendor didn't intend — you lose the exemption entirely.
What Non-Exempt Businesses Have to Do
If the exemption doesn't apply to you, here's what the law requires:
Risk management program. You need a documented process for identifying and reducing the risk that your AI tools could discriminate against people based on protected characteristics (race, gender, age, disability, etc.).
Annual impact assessments. Once a year, you evaluate whether your AI systems are producing discriminatory outcomes.
Consumer disclosures. When AI significantly influences a decision that affects a consumer, you have to tell them. A simple notification is sufficient.
Consumer appeal rights. Consumers must have a way to correct errors in their data and appeal AI-driven decisions with human review.
Vendor documentation. If you deploy third-party AI tools, ask your vendor for their compliance documentation — model cards, risk disclosures, transparency reports.
The Penalty
Non-compliance is treated as an unfair or deceptive trade practice. The Colorado Attorney General can fine businesses up to $20,000 per violation.
There is a safe harbor: if you can demonstrate a genuine good-faith compliance effort through documented processes and assessments, you get reduced liability.
Practical Steps for Colorado Business Owners Before June 30
Week 1: List every AI tool your business uses. Flag any that touch hiring, lending, housing, insurance, healthcare, or education decisions.
Week 2: Determine if you qualify for the small business exemption (under 50 employees, no custom training data, using tool as designed).
Week 3: For tools that don't qualify for exemption, contact the vendor and request compliance documentation.
Week 4: Write a one-page risk assessment for each AI tool that doesn't qualify for exemption. Document what it does, what data it uses, and how you monitor for bias.
Before June 30: If AI significantly influences any consumer decisions in your business, update your process to include a notification to customers.
You don't need a law firm for most of this. You need a spreadsheet, honest documentation, and 3-4 hours of focused work. The law rewards genuine effort.
Sources: Colorado General Assembly SB24-205, Schellman Compliance Guide, National Association of Attorneys General