Colorado AI ActCompliance Service
SB24-205 creates the most comprehensive state-level AI regulation in the U.S. — covering 8 consequential decision categories, with dual obligations for developers and deployers, annual impact assessments, and penalties up to $20,000 per violation.
We build your compliance documentation — impact assessments, risk management policies, consumer notices, evidence bundles, and public disclosures — so you're ready before enforcement begins.
Does the Colorado AI Act Apply to You?
Answer 3 questions to find out your classification, obligations, and risk level under SB24-205.
Do you do business in Colorado or serve Colorado residents?
The law applies to any organization whose AI affects Colorado residents, regardless of location.
8 Categories of Consequential Decisions
If your AI makes or substantially assists in decisions in any of these areas, it is classified as “high-risk” under SB24-205. Source: CRS § 6-1-1701(3).
Employment
Hiring, promotions, termination, compensation
Education
Admissions, financial aid, grading
Financial
Loans, credit, mortgages, interest rates
Healthcare
Treatment access, coverage, diagnosis
Housing
Rental screening, tenant checks, leases
Insurance
Coverage, pricing, claims, risk scoring
Government
Benefits, licenses, permits, services
Legal
Legal aid, case predictions, bail
AI systems that do not make consequential decisions — such as spell-checkers, spam filters, and general chatbots — are generally not high-risk. Source: CRS § 6-1-1701(9)(b).
Why Start Now — Not in 2026
The June 30, 2026 deadline is statutory and immovable. Compliance preparation takes months, not weeks.
Vendor Documentation Takes Weeks
Requesting model cards and performance metrics from AI vendors is a 4-8 week process. Most vendors have never been asked for this.
Impact Assessments Require Data
Annual impact assessments require internal data collection — system inventories, decision logs, demographic analysis.
Safe Harbor = Day-One Defense
Following NIST AI RMF or ISO 42001 before enforcement creates an affirmative defense from day one. Source: CRS § 6-1-1706(3).
60-Day Cure Period Advantage
First-time violations get a 60-day fix window with no penalty. But only if you have a compliance program in place.
Policy Drafting Is Iterative
Risk management policies, consumer notice templates, and public disclosures require multiple review cycles with stakeholders.
Costs Rise Near Deadlines
Every compliance deadline sees a surge in demand and pricing. Organizations that start early get better service and lower costs.
What the Law Requires
SB24-205 creates separate obligations for developers and deployers. Most organizations are deployers. Many are both.
Deployer Obligations
Organizations that use AI for decisions
- 1Reasonable Care§ 6-1-1703(1)
Exercise reasonable care to prevent algorithmic discrimination in your use case
- 2Risk Management Policy§ 6-1-1703(2)
Implement a written risk management policy and program for AI systems
- 3Annual Impact Assessment§ 6-1-1703(3)
Complete impact assessment before deployment and annually thereafter
- 4Consumer Pre-Decision Notice§ 6-1-1703(4)(a)
Notify consumers before AI makes or assists in consequential decisions
- 5Adverse Decision Notice§ 6-1-1703(4)(b)
Explain reasons when AI contributes to adverse decisions, offer appeal
- 6Public Website Disclosure§ 6-1-1703(5)
Publish types of high-risk AI used and discrimination risk management
Developer Obligations
Organizations that build or modify AI
- 1Reasonable Care§ 6-1-1702(1)
Protect consumers from known or foreseeable risks of algorithmic discrimination
- 2Deployer Documentation§ 6-1-1702(2)
Provide clear documentation including use cases, limitations, and risk information
- 3Impact Assessment Materials§ 6-1-1702(3)
Provide model cards, dataset cards, and materials for deployer impact assessments
- 4Public Website Disclosure§ 6-1-1702(4)
Publish types of high-risk AI developed and discrimination risk management
- 5AG Notification§ 6-1-1702(5)
Report algorithmic discrimination to AG and deployers within 90 days
Small Business Exemption
Deployers with <50 employees who don't train AI with their own data are exempt from DEPLOY-2, DEPLOY-3, and DEPLOY-6. Must still comply with DEPLOY-1, DEPLOY-4, and DEPLOY-5. Source: CRS § 6-1-1703(6).
NYC Local Law 144 vs Colorado AI Act
Already compliant with NYC? Colorado is broader, deeper, and structurally different.
| Aspect | NYC LL144 | Colorado SB24-205 |
|---|---|---|
| Scope | Employment decisions only (AEDTs) | 8 consequential decision categories |
| Who Must Comply | Employers + employment agencies | Developers AND Deployers (dual obligations) |
| Third-Party Audit | Required (independent auditor) | Not required — internal assessment allowed |
| Impact Assessment | Not required | Required annually + before deployment |
| Risk Management Policy | Not required | Required for all deployers |
| Consumer Notice | Required (10 days before use) | Required (before consequential decision) |
| Appeal Rights | Not specified | 45-day response requirement |
| Safe Harbor | None | NIST AI RMF / ISO 42001 = affirmative defense |
| Cure Period | None | 60 days for first offense |
| Enforcement | NYC DCWP | Colorado Attorney General (exclusive) |
| Penalty | $500-$1,500/violation/day | Up to $20,000 per violation |
| Private Lawsuits | Possible under other laws | No private right of action under this law |
| Small Biz Exemption | None | <50 employees (conditional) |
Already have NYC compliance? Your bias testing methodology and evidence architecture transfer directly. See our NYC service.
The Safe Harbor Advantage
CRS § 6-1-1706(3) creates a powerful affirmative defense: follow a recognized AI risk framework, actively look for problems, and fix what you find — and you have a legal defense against AG enforcement.
This is a rebuttable presumption of “reasonable care” — not immunity. But it must be established before enforcement begins.
Establish Your Safe HarborNIST AI Risk Management Framework
AG-recognizedComprehensive AI risk governance framework from NIST
ISO/IEC 42001
AG-recognizedInternational standard for AI management systems
Other AG-Designated Frameworks
FutureAdditional frameworks may be designated by the AG
Important: Safe harbor requires: (1) follow a recognized framework, (2) discover violations through internal review or testing, and (3) cure the violation. All three must be documented.
What We Prepare For You
Every deliverable mapped to a specific statutory requirement. Colorado-specific, citation-backed documentation.
Impact Assessment Framework
Pre-structured template covering all 6 required content areas: purpose, discrimination analysis, data description, performance metrics, transparency measures, and post-deployment monitoring.
Risk Management Policy Draft
Written policy template with governance structure, risk identification processes, mitigation measures, training requirements, and review schedule.
Consumer Notice Templates
Pre-decision and adverse decision notice templates. AI disclosure language, appeal rights, data correction rights, contact information.
Public Website Statement
Draft public disclosure listing high-risk AI systems, discrimination risk management practices, and data collection descriptions.
Discrimination Testing Protocol
Algorithmic discrimination testing methodology using deterministic engines. Disparate impact testing, intersectional analysis, and remediation criteria.
SHA-256 Evidence Bundle
Cryptographically verifiable evidence package. Every document hashed and timestamped. Designed for AG review.
AI System Inventory Template
Structured inventory with purpose, vendor, deployment date, risk classification, and last assessment date.
Appeal Process Framework
Consumer appeal process template with 45-day response workflow, human review procedures, escalation paths.
Incident Response Playbook
AG notification workflow for discovered discrimination. 90-day timeline, investigation checklist, remediation documentation.
Preview Our Work
See the quality of our compliance documentation before you engage. Real sample artifacts — not mockups.
The HAIEC Difference
Compliance documentation generated by deterministic engines — not AI. Every output is reproducible, verifiable, and auditable.
Deterministic Engines
Rule-based analysis produces identical outputs for identical inputs. No probabilistic AI making compliance judgments.
Cryptographic Evidence
Every artifact is SHA-256 hashed and timestamped. Evidence bundles are tamper-evident and independently verifiable.
Statute-Mapped Documentation
Every deliverable traces to a specific CRS section. No generic templates. Every claim backed by a statutory citation.
Multi-Framework Reusability
Evidence collected for Colorado feeds into SOC 2, ISO 42001, and other frameworks. One engagement, multiple benefits.
Full Transparency
Fixed pricing. No hourly billing surprises. No hidden fees. Sample reports published publicly.
Annual Review Framework
Your compliance package includes a structured annual review framework for year-over-year maintenance.
Compare Your Options
Three paths to compliance. Only one gives you statute-mapped documentation with cryptographic evidence.
| Feature | Do Nothing | Law Firm | HAIEC |
|---|---|---|---|
| Impact Assessment Templates | Generic | Colorado-specific, pre-filled | |
| Risk Management Policy Draft | Billable hours | Template + framework | |
| Consumer Notice Templates | Legal review only | Pre-built, customizable | |
| Algorithmic Discrimination Testing | Deterministic engines | ||
| SHA-256 Evidence Bundles | Cryptographic audit trail | ||
| NIST/ISO Framework Alignment | Advisory only | Mapped to safe harbor | |
| Public Website Statement Draft | Billable hours | Included | |
| Annual Review Framework | Retainer required | Built-in scheduling | |
| Developer Documentation Kit | Model cards + data sheets | ||
| Transparent Fixed Pricing | N/A | $300-$600/hr | From $12,500 |
| Target Timeline | N/A | 6-12 weeks | 14 business days |
14-Day Target Timeline
From intake to handoff in 14 business days. Timeline may vary based on organization complexity.
Intake & Classification
Review your AI systems, classify developer/deployer roles, identify high-risk categories, assess exemption eligibility. Scoping document within 48 hours.
Documentation Framework
Draft risk management policy, impact assessment framework, and consumer notice templates. All documents mapped to specific CRS sections.
Discrimination Testing Protocol
Design algorithmic discrimination testing methodology, configure statistical tests, prepare monitoring dashboards.
Evidence Architecture
Build SHA-256 evidence bundles, public website statement drafts, and AG-ready documentation packages.
Review & Handoff
Executive briefing on compliance posture. Walk through every deliverable. Annual review framework and monitoring guidance.
Exemptions & Special Cases
Not everyone is covered. The law includes specific exemptions that could reduce your compliance burden.
Small Business (<50 Employees)
Partial ExemptionExempt from risk management policy, impact assessments, and public disclosures if you don't train AI with your own data. Must still provide consumer notices.
Insurance Companies
Full ExemptionColorado-regulated insurers already subject to CRS § 10-3-1104.9 are fully exempt.
Banks & Credit Unions
Conditional ExemptionFederally-examined financial institutions can use federal AI guidance instead, if it meets or exceeds Colorado requirements.
FDA/FAA Approved Systems
Full ExemptionAI systems approved or certified by federal agencies are exempt. Federal oversight is deemed sufficient.
Federal Contractors
Partial ExemptionAI work under federal contracts is exempt. Exception: employment and housing decisions are still covered.
Non-Consequential AI
Full ExemptionSpell-checkers, spam filters, calculators, firewalls, and general chatbots with anti-discrimination policies are not high-risk.
Transparent Pricing
Fixed pricing. No hourly billing. No scope creep. You know exactly what you get.
Deployer Package
For organizations that use AI for decisions
- Risk management policy draft
- Impact assessment framework
- Consumer notice templates (pre + adverse)
- Public website statement draft
- Discrimination testing protocol
- Appeal process framework
- AI system inventory template
- SHA-256 evidence bundle
- Annual review framework
- Executive briefing (60 min)
Combined Package
Developer + Deployer (both roles)
Save $9,500 vs separate packages
- Everything in Deployer Package
- Everything in Developer Package
- Cross-role obligation mapping
- Unified evidence architecture
- Combined public disclosure draft
- Priority 10-day target timeline
- Two executive briefings (60 min each)
- Quarterly check-in for first year
Developer Package
For organizations that build or modify AI
- Reasonable care framework
- Deployer documentation kit
- Model card templates
- Dataset documentation templates
- Public website statement draft
- Discrimination testing protocol
- AG notification playbook
- SHA-256 evidence bundle
- Annual review framework
- Executive briefing (60 min)
Enterprise: Multi-system organizations and ongoing compliance — book a consultation for custom scoping.
Important Legal Disclaimer
HAIEC provides compliance documentation frameworks and evidence generation tools. We are not attorneys and do not provide legal advice. The Colorado AI Act (SB24-205) is enforced exclusively by the Colorado Attorney General. Our service prepares documentation for review by your legal counsel. All final compliance decisions should be made in consultation with qualified legal professionals. Penalty figures cited from CRS § 6-1-1706(2) and § 6-1-105(1)(hhhh).
Frequently Asked Questions
Ready to Prepare Your Colorado AI Compliance?
June 30, 2026 is 137 days away. Vendor documentation, impact assessments, and policy drafting take months. Start now.
This service does not constitute legal advice. HAIEC is not a law firm. The Colorado AI Act (SB24-205) is enforced by the Colorado Attorney General. Consult qualified legal counsel for compliance decisions. All statutory citations reference Colorado Revised Statutes as of 2025.