Colorado’s AI Act—Attacked, Delayed, and Now Amended—What You Need to Know

It appears that the saga of Colorado’s controversial AI Act is now officially over. From the day it was signed by Gov. Jared Polis on May 17, 2024, the Act faced criticism for being too onerous, too burdensome, and too vague for businesses to implement. Attempts at reform first resulted in delaying the Act from taking effect, and eventually a revised Act passed on May 14, 2026, now scheduled to take effect on January 1, 2027.

The Act went through significant changes from its first passage in 2024, and it is important for businesses to understand where the regulation now stands and what it means for their use of AI technology in Colorado and with Colorado consumers.

This series of articles hopes to lay out the basics of the as-amended Colorado AI Act, addressing the scope and applicability of the law, what it requires, and how it will be enforced. While final rules are still being prepared by the Colorado Attorney General’s Office and are expected later this year, businesses would do well to understand what the law requires so they are prepared when it takes effect.

In this first of the series, we look at to whom and to what the Act applies.

ADMT, Developers, and Deployers

As an initial matter, it is important to understand that Colorado’s AI legislation still applies to so-called “developers” and “deployers” of AI technology—though that AI technology is now referred to by the more common parlance of, “automated-decision-making-technology.” Under the law, “automated-decision-making-technology,” or “ADMT,” refers to “a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual.” This definition differs from the original AI Act which focused instead on “artificial intelligence systems”—which were defined as “any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments.” The prior definition was criticized for being too vague and potentially quite broad in application. The ADMT definition in the current Act addresses these complaints and focuses the regulation on the use of “personal data” in connection with this technology and tying it to specific conduct—e.g., influential predictions, recommendations, classifications, rankings, and scores. This change limits the scope of the Act and focuses it specifically on the actions of interest.

As noted above, the Act continues to focus on “developers” and “deployers” of ADMT. As defined, “developers” of ADMT do business in Colorado and make covered ADMT commercially available, develop a component that is to be used as part of covered ADMT, or modify covered ADMT. This differs from a so-called “deployer,” which the law defines as someone doing business in Colorado who deploys a covered ADMT. Thus, if your business creates ADMT or uses ADMT in connection with “consequential decisions,” then you are subject to the Colorado law.

Consequential Decisions and Covered Domains

Further limiting the scope of the law, the Act only applies to ADMT when it is used to “materially influence” a “consequential decision”—a situation where the ADMT becomes “covered ADMT.” The Act defines a “consequential decision” as a decision, determination, or action made about a consumer that relates to:

• The provision of, or a consumer’s access to, eligibility for, selection for, or compensation for a covered domain, or
• A differentiated price, cost sharing, compensation, or other material terms in a manner that is reasonably likely to materially limit, delay, effectively deny, or otherwise fundamentally alter the consumer’s access, eligibility, or opportunity for a covered domain

Further, a “covered domain” refers to:

• An education enrollment or other education opportunity
• Employment or an employment opportunity that does, or may, create an employer-employee relationship
• The lease or purchase of residential real estate in Colorado
• A financial or lending service
• Insurance (including underwriting, pricing, coverage, claims adjudication, or other determinations that materially affect access to insurance benefits)
• Healthcare services
• Essential government services and public benefits (including eligibility or renewal determinations)

Taken together, the Act covers entities that develop ADMT or use ADMT to influence determinations involving educational, employment, real estate, financial, insurance, healthcare, or essential government rights or services. Importantly, even where the ADMT does not actually make the consequential decision, the requirements of the Act may still apply. Further, it is also important to note that the law does not include any business size thresholds or carve-outs for businesses of a certain size. Rather, all businesses that develop or deploy covered ADMT are subject to the law.

In our next article in this series, we’ll dive into what the law requires of developers and deployers of covered ADMT!

This publication is intended for general informational purposes only and does not constitute legal advice or a solicitation to provide legal services. The information in this publication is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this information without seeking professional legal counsel. The views and opinions expressed herein represent those of the individual author(s) only and are not necessarily the views of Clark Hill PLC or Clark Hill Solicitors LLP. Although we attempt to ensure that postings on our website are complete, accurate, and up to date, we assume no responsibility for their completeness, accuracy, or timeliness.