Colorado enacts first US broad AI discrimination law

Colorado Governor Jared Polis signed SB 24-205, the Consumer Protections for Artificial Intelligence Act, making Colorado the first US state to enact broad legislation governing private-sector use of AI systems in consequential decisions rather than a narrow, single-sector rule.

The law targets “high-risk” AI systems used in decisions with legal or similarly significant effects on consumers — employment, housing, healthcare, insurance, education, lending and access to essential government services among them. Developers and deployers of such systems were required to exercise “reasonable care” to avoid algorithmic discrimination, and the law imposed specific obligations: risk-management programmes, impact assessments before and during deployment, consumer notice when a high-risk system was used in a decision affecting them, and rights to correct inaccurate data and appeal adverse determinations. Enforcement sat with the state attorney general under Colorado’s existing consumer protection statute, rather than creating a private right of action.

Polis signed the bill “with reservations,” according to reporting on his signing statement, citing concern about the compliance burden on business and stating a preference for federal or more harmonised standards over a patchwork of state rules — a position echoed by other governors weighing similar bills that year. The law’s effective date was itself revised after signing: Colorado’s legislature later passed a special-session bill delaying implementation, and by 2026 the framework had been substantially rewritten by SB 26-189.

SB 24-205 mattered less for the durability of its original text, which changed twice within two years, than for being the first comprehensive attempt by a US state to regulate algorithmic decision-making broadly rather than sector-by-sector, at a time when Congress had passed no federal equivalent.