Colorado AI Act

Statute United States (Colorado)

The Colorado AI Act was, when it passed in May 2024, the most ambitious AI statute in the United States and the closest anything in America had come to the EU AI Act’s structure. It is now the most useful cautionary tale in this catalog, and I would rather carry the entry with its failure recorded than quietly drop it.

What it originally required, for “consequential decisions” in employment, lending, housing, education, healthcare, insurance and legal services:

• A duty of reasonable care against algorithmic discrimination - On both developers and deployers, which was the structural innovation.
• Developer disclosures to deployers - Known limitations, training-data summaries, evaluation results, intended uses. A documentation handoff, legally required, along a commercial supply chain.
• Deployer risk management and impact assessments - Annual reviews, aligned to a recognised framework such as NIST AI RMF.
• Consumer notice and a right to appeal - Told that an AI system was involved, and able to ask for human review.
• Attorney-General enforcement - No private right of action.

Then it was delayed to 30 June 2026, delayed again to 1 January 2027, and in the same breath rewritten. SB 189 stripped out the deployer risk-management and impact-assessment duties — the compliance machinery — and left a narrower automated-decision law.

The lesson is in which half survived. Disclosure obligations survived. Notice-to-the-consumer survived. What did not survive was the continuing internal-process obligation: the annual assessment, the documented risk programme, the thing that costs money every year rather than once. That is the same split visible in the EU, where the Digital Omnibus deferred high-risk conformity assessment by sixteen months while leaving the Article 50 transparency duties untouched on their original date.

Two conclusions follow, and I hold both. First, transparency obligations are the durable ones — they are cheap to comply with, easy to enforce, and hard to argue against in public — so a company deciding where to invest ahead of certainty should invest in being able to say what a system is, what it was trained on, and when a human can intervene. Second, the durable obligations are exactly the ones an API contract can carry. A model card is a document. A training-data summary is a document. An appeal path is an endpoint. An “AI was involved in this decision” disclosure is a response field.

The part that was removed is also the part that was never going to be machine-readable, which is why its removal changes less about what I can score than the headlines suggest. Colorado did not stop requiring AI accountability. It stopped requiring the paperwork and kept requiring the disclosure — and disclosure is the half that shows up in a contract.