Colorado SB 24-205, Explained

Effective date and enforcement

Effective June 30, 2026. Enforced by the Colorado Attorney General. Maximum fine: $20,000 per violation. "Per violation" can mean per affected consumer, so a high-traffic site could face exposure in the millions.

§6-1-1701 — Definitions

Defines "high-risk AI system" as any AI used to make a consequential decision. Consequential decisions are defined broadly: education enrollment, employment, financial services, government services, healthcare, housing, insurance, legal services, and essential goods.

§6-1-1702 — Developer obligations

If you build AI tools, you must provide deployers with documentation of the system's purpose, intended use, known limitations, and data governance. Most SMBs are deployers, not developers — skip this section.

§6-1-1703 — Deployer obligations (this is the one for SMBs)

• Implement a risk management program proportionate to the risk
• Conduct annual impact assessments and after material modifications
• Notify consumers before AI processes their data for a consequential decision
• Provide a way for consumers to correct incorrect personal data and appeal adverse decisions
• Disclose AI usage on a public-facing webpage

§6-1-1704 — Notice requirements

The pre-use notice must explain: the purpose of the AI, the nature of the decision being made, contact information, and the consumer's right to opt out. The notice must be "clear and conspicuous," not buried in a privacy policy.

§6-1-1705 — Affirmative defense

Compliance with NIST AI RMF (or comparable framework) and a documented risk management program creates an affirmative defense against AG enforcement. Practical translation: document everything.

§6-1-1706 — Exemptions

Limited exemptions for HIPAA-covered AI, GLBA-covered financial AI, and certain federal-regulated AI. No general small business exemption.