The rewrite substantially lightens compliance obligations. Gone are mandatory risk management programs and annual impact assessments. In their place: notice requirements, three-year records retention, and consumer-facing disclosures. Deployers must notify users before decisions, disclose adverse outcomes post-decision, and allow requests for human review and correction in certain cases. Developers must provide technical documentation and update notices. Both parties retain records for at least three years. The law takes effect January 1, 2027.
The original 2024 law faced repeated delays and partial federal court blockade following constitutional challenges, including litigation from xAI and the U.S. Department of Justice over diversity, equity, and inclusion provisions. Colorado's legislature and governor rewrote the statute before the prior version's effective date rather than litigate further.
Colorado has effectively reset one of the nation's first major state AI laws, trading a demanding governance model for a lighter disclosure regime. For employers and businesses deploying automated tools in high-stakes decisions, this signals how state AI regulation may evolve—and makes Colorado a critical test case for the broader regulatory landscape ahead.