USA – COLORADO Trends and Developments Contributed by: Daniel Pietragallo and Douglas DePeppe, Buchalter LLP
mentation, risk management programmes, impact assessments, and affirmative defences. The Colo - rado Attorney General’s enforcement authority also provides the right to inspect any company’s risk management policy, impact assessment, or records to ensure compliance. This broad oversight authority will allow the Colorado Attorney General to identify those companies that have implemented the required governance structures and those that lack appropri - ate corporate governance. There is no private right of action associated with this law. What next for the Colorado AI Act? In August 2025, following a special legislative session that resulted in little progress, the legislature agreed to delay enforcement of SB 24-205 until 30 June 2026. However, negotiations between consumer and indus - try groups are ongoing and may yield minor changes to the law before it goes into effect. An additional delay of enforcement until January of 2027 is also a possibility.
Proposed modifications to the law include a focus on Automated Decision-Making Technology (ADMT), which aligns with language in the California Consumer Privacy Act (CCPA). Despite the potential for delayed implementation enforcement and further changes to the law, the era of comprehensive state-level AI gov - ernance regulation is upon us with the coming imple - mentation of the Colorado AI Act. For companies using AI systems to make consequen - tial decisions, waiting until the enforcement date to develop a compliance strategy creates increased regulatory risk. Colorado’s law is structurally closer to the EU AI Act than any other US state law and stands out for its heightened risk-based regulatory require - ments. Colorado’s AI Act will usher in a new era of comprehensive state-level AI governance, regulation and enforcement in 2026.
574 CHAMBERS.COM
Powered by FlippingBook