In 2024 Colorado became the first state in the nation to enact comprehensive regulation of artificial intelligence (AI) with Senate Bill 24-205 (SB205), also known as the Colorado Artificial Intelligence Act (CAIA). The law is comprehensive, similar to the European Union Artificial Intelligence Act. It established detailed compliance obligations for developers and users of "high-risk" AI systems operating in employment, housing, finance, health care, education, and essential government services.

The bill was signed by the governor over the objection of various business groups.  Specifically, the governor expressed concern “about the impact this law may have on an industry that is fueling critical technological advancements” and observed how regulation – like SB205 – “applied at the state level in a patchwork across the country can have the effect to tamper innovation and deter competition in an open market.”  However, attempts to update the law failed earlier in 2025. 

The law comes into effect February 1, 2026.

The law is very broad and applies beyond the scope of basic employment practices.  It applies to developers and deployers of “high-risk” AI systems. High-risk AI systems are ones that can make or significantly influence “consequential decisions” in areas such as employment, housing, credit, education, and healthcare. “Consequential decisions” in the employment context is broadly defined and includes decisions that have a “material legal or similarly significant effect on the provision or denial to any consumer of … employment or an employment opportunity.”   Potentially, as one commentator stated, this law could lead to claims in performance management, disciplinary action, or even workplace surveillance.

This law also is broadly interpreted to cover not only applicants and employees, but Colorado consumers in the normal sense of the word definition.   

Under the law, users (called deployers) of AI systems must provide notice to applicants of why an  adverse consequential decision may be made by a high-risk AI system, including the degree and manner in which the AI contributed to the decision, the type and source of data processed in making the decision, and an opportunity to correct any personal data used. Further, they are required to post a public statement on their website, summarizing the types of high-risk AI systems they currently deploy, how they manage risks of algorithmic discrimination, and the nature, source, and extent of information collected and used.

Under the law, there is a rebuttable presumption that deployers used reasonable care if they comply with the following:

• Implement a risk management policy and program for high-risk AI systems;
• Complete an impact assessment of high-risk AI systems;
• Notify consumers of specified items if the high-risk systems make decisions about a consumer;
• Make a publicly available statement summarizing the types of high-risk systems that the deployer currently deploys; and
• Disclose to the attorney general the discovery of algorithmic discrimination within 90 days of discovery.

And there are reasonable exemptions to the law including:

• Employers employing fewer than 50 full-time equivalent employees;
• They do not use their own data to train the AI system;
• The AI system is used for the intended uses disclosed by the developer; and
• They make certain information related to impact assessment available to consumers.

Finally, there is no private cause of action. Therefore, only the Colorado Attorney General could enforce this law. By excluding private rights of action, businesses do not have to worry about potential class actions or other types of lawsuits by hungry plaintiff attorneys.

There may be an exception for background checks. The law focuses its strictest obligations on AI systems that serve as the principal basis for consequential decisions without meaningful human involvement. However, background checks do require human interaction, and final decisions for hiring generally are made by the employer using human judgement. Until the law comes into force and a lawsuit is determinative of this approach, background checks may still have risks under the law.

In other words, any AI system that substantially influences employment decisions could be deemed high-risk under the law, even if the final decision involves meaningful human judgment. Employers using AI tools to assist in background checks or hiring assessments will need to carefully evaluate the level of human oversight embedded in their processes.

In recent developments, on August 28, 2025, Colorado employers received a reprieve. A special legislative session was called into action on August 21, 2025, to presumably find a way to overcome a $1 billion shortfall in the budget. However, the Colorado law is on the agenda. It should be noted that the momentum for regulating AI has faded, especially after the Trump Administration issued its Executive Order entitled, “Removing Barriers to American Leadership in Artificial Intelligence,” on January 23, 2025. Consistent with this change in the winds, Colorado lawmakers proposed several bills to scale back the Colorado AI Act.  We will see if the law is scaled back or not before the February 1 deadline.

Until any changes are certain, employers with operations in Colorado should not begin reviewing AI risk management practices and ensure the level of human oversight of decision-making processes.  Moreover, with the disclosure requirement pending, employers should prepare robust disclosures that would comply with the law.  Therefore, it would be wise to work with legal counsel now to inventory risks and prepare policies, procedures, and training.

Source: Littler 8/29/25, Forbes 5/9/25, Seyfarth Shaw 5/23/24, Jackson Lewis May 20, 2024, HR Dive 5/20/24, Law360 5/22/24