By 
Small businesses operating in Colorado have roughly two months of implementation time left before the Colorado AI Act becomes enforceable. The law applies equally to small and large businesses, with only one narrowly drawn small-deployer exemption that most employers who customise a vendor tool will lose the moment they train that tool on their own data. For a small business using AI in hiring, lending, housing, or healthcare decisions about Colorado residents, "do nothing and hope" is not a defensible posture.
The good news for small operators is that the Colorado AI Act is heavily process-based. It does not require a technology overhaul. It requires documentation, notices, and a defensible governance programme. With a tight scope of work, most small businesses can build a compliant package before 30 June 2026 without specialist AI engineering talent in-house.
What the Colorado AI Act actually is
Colorado Senate Bill 24-205, the Consumer Protections for Artificial Intelligence Act (CAIA), imposes a duty of reasonable care on both developers and deployers of high-risk AI systems to protect Colorado consumers from algorithmic discrimination.
What is a high-risk AI system
Under the statute (Colo. Rev. Stat. §6-1-1701), a high-risk AI system is any AI system that, when deployed, makes or is a substantial factor in making a consequential decision. A consequential decision is one with a material legal or similarly significant effect on the provision, denial, cost, or terms of any of the following:
- Education enrollment or opportunity
- Employment or an employment opportunity
- Financial or lending service
- Essential government service
- Health-care service
- Housing
- Insurance
- Legal service
The statutory scope is broader than many small business owners assume. Any AI system that scores, ranks, or recommends candidates; sets or assists in setting loan terms; scores credit; prices or underwrites insurance; screens tenants; or contributes to a healthcare decision is likely in scope when used with Colorado residents.
What counts as algorithmic discrimination
Algorithmic discrimination is defined as any condition where the use of an AI system results in unlawful differential treatment or impact that disfavors an individual or group of individuals on the basis of a protected characteristic under Colorado or federal law, including age, color, disability, ethnicity, genetic information, limited English proficiency, national origin, race, religion, reproductive health, sex, veteran status, or other classification protected under state or federal law. The statute specifically excludes systems used only for self-testing, bias mitigation, or to increase diversity in a manner consistent with anti-discrimination law.
Who is regulated
Two primary roles exist:
- Developer: A person doing business in Colorado that develops, or intentionally and substantially modifies, a high-risk AI system.
- Deployer: A person doing business in Colorado that deploys a high-risk AI system.
Both roles carry obligations. Jurisdiction follows the Colorado resident, not the business location. A company based outside Colorado that uses a high-risk AI system to make a consequential decision about a Colorado resident is a deployer under the statute.
The small-deployer exemption and why it is narrower than it looks
The statute's small-deployer exemption at §6-1-1703(6) relieves a deployer from three specific obligations: maintaining a risk management policy and program, completing an impact assessment, and publishing a website statement summarising its high-risk AI systems. The exemption applies only when all of the following conditions are met throughout the relevant deployment period:
- The deployer has fewer than 50 full-time equivalent employees.
- The deployer does not use its own data to train the high-risk AI system.
- The deployer uses the system only for the purposes previously disclosed by the developer.
- The system continues to learn only from data other than the deployer's data.
- The deployer makes available to consumers any impact assessment that the developer has provided regarding the system, including the information a deployer would have included if it had conducted its own assessment.
The practical effect: the moment a small business fine-tunes a vendor AI tool with its own hiring data, lending data, candidate data, or tenant data, the small-deployer exemption disappears and full deployer obligations apply. Using the vendor tool strictly as shipped preserves the exemption; adjusting it in any meaningful way does not.
Two further points matter. First, the small-deployer exemption is partial, not total. Even exempt small deployers remain subject to the consumer notification requirements, the adverse-decision disclosure requirements, and the 90-day notification obligation to the Attorney General for discovered algorithmic discrimination. Second, there is no small-business exemption for developers. If a small business builds or substantially modifies a high-risk AI system, full developer obligations apply regardless of size.
Deployer obligations in detail
When the small-deployer exemption does not apply, a deployer must, on and after 30 June 2026:
- Use reasonable care to protect Colorado consumers from known or reasonably foreseeable risks of algorithmic discrimination.
- Implement and maintain a risk management policy and program that is reasonable under a nationally or internationally recognised framework such as the NIST AI Risk Management Framework or ISO/IEC 42001, or another framework designated by the Colorado Attorney General.
- Complete an impact assessment before first deployment, at least annually, and within 90 days after any intentional and substantial modification of the system. The assessment must cover purpose and intended use, benefits, categories of input and output data, algorithmic discrimination risk analysis and mitigation steps, performance metrics and known limitations, transparency measures, and post-deployment monitoring and user safeguards. Retain for at least three years after final deployment.
- Annually review each deployed high-risk AI system to ensure it is not causing algorithmic discrimination.
- Notify consumers before a consequential decision is made, disclosing that a high-risk AI system is being used, the purpose of the system, the nature of the consequential decision, and contact information for the deployer.
- When a decision is adverse to the consumer, disclose the principal reasons for the decision, the degree to which the system contributed to the decision, the type of data processed, and the source of that data. Provide the consumer an opportunity to correct any incorrect personal data used and, where technically feasible, an opportunity to appeal for human review.
- Publish a statement on the deployer's website summarising the high-risk AI systems in deployment and how algorithmic discrimination risk is managed.
- Disclose to the Colorado Attorney General, within 90 days of discovery or receipt of a credible report, any algorithmic discrimination the system has caused or is reasonably likely to have caused.
Developer obligations in detail
A developer must, on and after 30 June 2026:
- Use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination arising from the intended and contracted uses of the high-risk AI system.
- Provide deployers with documentation sufficient for them to complete their impact assessments. At minimum: a statement of reasonably foreseeable uses and known harmful or inappropriate uses; a summary of the type of data used to train the system and known limitations; a description of how the system was evaluated for performance and for risks of algorithmic discrimination; and additional documentation reasonably necessary to assist the deployer in understanding outputs and monitoring performance.
- Publish on the developer's website, or in a public use-case inventory, a statement summarising the types of high-risk AI systems the developer has developed or substantially modified and how it manages risks of algorithmic discrimination.
- Disclose to the Colorado Attorney General and to all known deployers any known or reasonably foreseeable risks of algorithmic discrimination, within 90 days of discovery or receipt of a credible report.
- Respond to Attorney General documentation requests within 90 days. Trade-secret designations are permitted. Sharing documents with the AG does not waive attorney-client privilege or work-product protection.
The affirmative defence and the rebuttable presumption
The statute provides two overlapping legal shields that matter for any small business building a compliance programme:
- Rebuttable presumption of reasonable care. A developer or deployer that complies with the statute (and any Attorney General rules promulgated under §6-1-1707) is presumed to have exercised reasonable care. The presumption shifts the evidentiary burden to the Attorney General.
- Affirmative defence. A developer, deployer, or other person has an affirmative defence to a violation if, at the time of the potential violation, it was in compliance with a nationally or internationally recognised risk management framework that the Act or the Attorney General has designated (NIST AI RMF and ISO/IEC 42001 are both widely expected to qualify), and the entity took specified measures to discover and correct the violation.
This is the single most important strategic point for a small business. A compliant NIST AI RMF or ISO/IEC 42001 implementation is not optional paperwork. It is the mechanism by which the Act's enforcement posture softens from strict scrutiny to a good-faith review. The affirmative defence is the reason the documentation package matters as much as any technical control.
Enforcement and penalties
The Colorado Attorney General has exclusive enforcement authority under CAIA. There is no private right of action. Violations are deceptive trade practices under the Colorado Consumer Protection Act, which authorises civil penalties of up to $20,000 per violation. Each affected consumer or transaction can be a separate violation. For a tool used across many hiring or lending decisions, aggregate exposure scales quickly.
Before bringing an enforcement action, the Attorney General must provide written notice of an alleged violation and allow a 60-day cure period. An entity that discovers and cures a violation through feedback, testing, or internal review, and that is in compliance with a recognised risk management framework, may also assert the affirmative defence described above.
A practitioner's five-step plan for small businesses
Step 1: Inventory AI systems and confirm Colorado nexus
List every tool in the tech stack that scores, ranks, classifies, recommends, prices, or decides anything about a person. Flag anything used in hiring, lending, insurance, housing, education, healthcare, legal services, or essential government services. For each tool, identify whether Colorado residents are being evaluated, whether the tool's output is a substantial factor in a consequential decision, and who the vendor is. Pay attention to AI features embedded in applicant tracking systems, CRM platforms, tenant screening services, and credit decisioning systems, which often escape notice because they are sold as "automation" rather than "AI".
Step 2: Decide whether the small-deployer exemption applies and document it
For each flagged tool, answer the five small-deployer questions in writing. Do you have fewer than 50 FTEs? Do you use only the vendor's disclosed purposes? Have you made the vendor's impact assessment available to consumers? Is the tool still learning only from non-deployer data? Have you avoided any fine-tuning on your own data? If any answer is "no", the exemption is off the table for that tool. Record the reasoning so you can hand it to counsel or the Attorney General if asked.
Step 3: Build a framework-aligned risk management programme
Adopt NIST AI RMF or ISO/IEC 42001 as the backbone of the risk management policy and programme. Both frameworks include concepts (govern, map, measure, manage) that map cleanly to the statute's requirements. For a small business, the programme does not need to be elaborate. It needs to be documented, accurate about what the organisation actually does, and signed off by the owner or a designated compliance owner. The goal is to support the affirmative defence, not to impress auditors.
Step 4: Complete impact assessments and issue notices
For each in-scope tool, prepare an impact assessment covering every element required by the statute. If internal resources are limited, engage a third-party consultant or use a vendor-provided assessment as a starting point, but take ownership of the analysis rather than simply accepting the vendor's version. Build the two required consumer notices into the decision workflow: a pre-decision notice before any consequential decision, and an adverse-decision notice including correction rights and appeal rights where technically feasible. Maintain delivery logs.
Step 5: Prepare the Attorney General response package
Assume an Attorney General inquiry will arrive. The package you want ready in advance includes the AI inventory, the small-deployer exemption analysis, the risk management policy signed by the owner, the impact assessments with bias testing evidence, notice templates and delivery logs, vendor documentation files, a written algorithmic discrimination response protocol (the 90-day AG notification), and evidence of ongoing monitoring. Retain for at least three years after a system is retired. Time-to-response is the most visible signal of a functioning compliance programme.
An illustrative scenario
The following is a hypothetical designed to illustrate how the rules interact. It does not describe any real enforcement action.
A 42-employee recruitment agency in Colorado Springs licenses a vendor AI résumé screener and fine-tunes it on its own historical candidate data to prioritise construction-industry roles. Because the agency trains the system on its own data, the small-deployer exemption in §6-1-1703(6) no longer applies. The agency is a deployer with full obligations: reasonable care, risk management policy, impact assessment, annual review, pre-decision and adverse-decision notices, website statement, appeal process, and 90-day AG notification duty.
If the Attorney General opens a post-June 30 inquiry and the agency can produce a NIST-aligned risk management policy signed by the owner, an impact assessment that identifies and mitigates discrimination risks, evidence of annual review, notice templates with delivery logs, and a written record of the exemption analysis that explains why full obligations apply, the agency is well placed to invoke both the rebuttable presumption and the affirmative defence. The same facts without the documentation package produce a very different outcome, where the 60-day cure period becomes a scramble and penalties accumulate per affected candidate.
Compliance FAQ
Does the small-business exemption fully relieve a Colorado small business from CAIA compliance?
No. The exemption under §6-1-1703(6) is partial and conditional. It removes three obligations (risk management policy, impact assessment, website statement) only when the business has fewer than 50 FTEs, does not train the system on its own data, uses the system only for the developer's disclosed purposes, and makes the developer's impact assessment available to consumers. Consumer notification, adverse-decision disclosure, and 90-day AG notification still apply. Any fine-tuning on the deployer's own data removes the exemption entirely for that tool.
What must an impact assessment contain?
The statute requires the deployer to cover purpose, intended use, deployment context, and benefits; categories of input and output data used or produced; analysis of algorithmic discrimination risks and mitigation steps taken; performance metrics and known limitations; transparency measures; and post-deployment monitoring and user safeguards. Updated before first deployment, at least annually, and within 90 days of an intentional and substantial modification. Retain for at least three years after final deployment.
How does the Colorado AI Act compare to NYC Local Law 144 for a small business using AI in hiring?
NYC Local Law 144 requires an annual independent bias audit by a qualified third party, publication of the audit summary on the employment website, and candidate notice at least 10 business days before AEDT use. The Colorado AI Act does not mandate an independent third-party audit; it requires a risk management programme, impact assessments (which can be performed internally or by a third party), and structured consumer notices including appeal rights. A small business operating in both jurisdictions should build one documentation set that satisfies both regimes, rather than treating them as separate tracks.
What internal documentation proves compliance with the Colorado AI Act?
At minimum: an AI system inventory, the small-deployer exemption analysis for each tool, a signed risk management policy aligned with NIST AI RMF or ISO/IEC 42001, impact assessment records with bias testing data and mitigation evidence, pre-decision and adverse-decision notice templates with delivery logs, appeal handling procedures, vendor documentation files, and a written AG notification protocol for discovered discrimination. Retain for at least three years after system retirement.
Can the deadline still change?
Possibly. The Colorado General Assembly's 2026 regular session has been considering amendments to CAIA informed by the AI Impact Task Force recommendations, covering definitions, exemptions, and enforcement mechanics. The political direction is uneven, with industry and civil society groups taking different positions. Businesses should plan for 30 June 2026 as the binding date and track any amendments through the session.
The bottom line
The Colorado AI Act does not require a small business to stop using AI. It requires the small business to know which tools are in scope, decide honestly whether the small-deployer exemption applies, build a framework-aligned governance programme that supports the affirmative defence, and treat the consumer notices as part of the decision workflow rather than an afterthought. Done in advance, that is a finite project. Done under an Attorney General inquiry, it is a crisis. Inventory first, exemption analysis second, documentation package third, notices integrated into the workflow before 30 June 2026. That sequence holds regardless of how the 2026 legislative amendments land.
Last updated: April 2026. This article is educational content and is not legal advice. Obligations under the Colorado AI Act depend on specific facts, including the deployer's size, whether the tool is trained on deployer data, and the nature of the consequential decision. The law may be amended before the 30 June 2026 effective date. Consult qualified counsel before making compliance decisions.