AIWiki
Malaysia
Back to all articles
Ethics & Policycoloradoai regulationalgorithmic discrimination

Colorado AI Act

4 min readUpdated October 2026
Colorado AI Act
Type
State statute
Jurisdiction
Colorado, United States
Bill
SB 24-205 (signed May 2024)
Original effective date
Postponed to 30 June 2026
Replaced by
SB 26-189 (signed 14 May 2026, effective 1 January 2027)
Enforcement
Colorado Attorney General

The Colorado AI Act was a state law regulating the development and deployment of high-risk artificial intelligence systems — those that make or substantially factor into consequential decisions in areas such as employment, housing, credit, insurance, health care and education. Signed in May 2024, it was the first comprehensive AI statute enacted by a US state. Before it could take effect, Colorado replaced it in 2026 with a narrower disclosure-focused law, making the Act's journey a case study in how AI regulation is being recalibrated.[1]

History

Governor Jared Polis signed Senate Bill 24-205 in May 2024, while publicly urging the legislature to refine it. The Act imposed duties on two roles: developers (those building high-risk AI systems) and deployers (those using them). Both owed a duty to use reasonable care to avoid algorithmic discrimination — biased outputs that disadvantage protected groups. Deployers were additionally required to adopt a risk-management policy, complete annual AI impact assessments, notify consumers before a consequential decision was made, disclose the system's role afterwards, and allow consumers to request correction of their data and to opt out of profiling.[1][2]

Implementation proved contentious. The effective date was postponed — first to 1 February 2026 and then to 30 June 2026 — while industry groups argued the impact-assessment and risk-management duties were too prescriptive. Governor Polis convened an AI Policy Working Group that consulted stakeholders for roughly six months and published a proposed framework in March 2026.[3]

The result was Senate Bill 26-189, signed on 14 May 2026 and effective 1 January 2027, which replaced SB 24-205. The new law strips the risk-management and impact-assessment machinery and instead centres on transparency: advance notice when automated decision-making technology (ADMT) will be used in a consequential decision, post-decision explanations, consumer rights over data correction, and meaningful human review. Enforcement is centralised in the Colorado Attorney General, and discrimination liability is apportioned on a fault basis. The US Federal Trade Commission subsequently signalled it may consider such state laws preempted by federal law, adding a further layer of uncertainty.[3][4]

Key Concepts and Technology

Three ideas anchor the legislation. A high-risk AI system is defined functionally — any AI system that makes or is a substantial factor in making a consequential decision — so it covers résumé-screening models, credit scoring and insurance underwriting rather than naming specific technologies. Algorithmic discrimination frames the core harm as unfair outcomes rather than model accuracy. And the developer/deployer split recognises that bias can enter at training time or at deployment time, assigning duties accordingly.[1]

These concepts echo the European Union's AI Act risk tiers and the US NIST AI Risk Management Framework, but Colorado's original statute was notable for being both the earliest and the most procedurally demanding at state level.[5]

>See Also

🇲🇾Malaysian Context

🇲🇾 Colorado's arc — from prescriptive duties to lighter disclosure rules — is directly relevant to Malaysian policymakers drafting hard-law AI regulation. Malaysia currently relies on a principles-based National AI Governance Framework and guideline-style oversight from sector regulators rather than a single AI statute, and the Colorado experience illustrates both pressures Malaysian drafters face: business compliance cost on one side, and anti-discrimination expectations on the other.[6]

For Malaysian organisations, the practical exposure is extraterritorial. Companies selling into or employing in the United States — shared-services centres, HR-technology vendors, fintech and insurance operators active in Penang and Kuala Lumpur — may fall within ADMT disclosure duties if they serve Colorado consumers, just as GDPR pulled Malaysian processors into European compliance. The lesson from Colorado is that AI-impact documentation, notice templates and human-review workflows built early are cheaper than retrofitting them after a law takes effect.[4]

References

  1. ↑Colorado General Assembly. SB24-205 Consumer Protections for Artificial Intelligence. https://leg.colorado.gov/bills/sb24-205
  2. ↑Arnold and Porter. (2026). Colorado Narrows Its AI Law, but the FTC Says That's Not Enough. https://www.arnoldporter.com/en/perspectives/advisories/2026/07/colorado-narrows-its-ai-law-but-the-ftc-says-thats-not-enough
  3. ↑Seyfarth Shaw. (2026). Colorado Enacts Artificial Intelligence Replacement Law. https://www.seyfarth.com/news-insights/colorado-enacts-artificial-intelligence-replacement-law.html
  4. ↑Colorado Attorney General. Colorado Anti-Discrimination in AI Law rulemaking. https://coag.gov/ai/
  5. ↑NIST. (2023). AI Risk Management Framework 1.0. https://www.nist.gov/itl/ai-risk-management-framework
  6. ↑Malaysia Digital Economy Corporation. Malaysia AI Governance Framework. https://www.mdec.my/
Back to all articles