Colorado’s Artificial Intelligence Law Could Be on the Chopping Block

When he signed Colorado’s artificial intelligence law (SB 24-205, the “Act”) into law, Colorado Governor Jared Polis told the Colorado General Assembly, by letter, that he did so “with reservations.” Polis criticized the Act for “creat[ing] a complex compliance regime,” and expressed “concern[] about [its] impact . . on an industry that is fueling critical technological advancements….” He urged the General Assembly “to amend [the Act] to conform with evidence based findings and recommendations for the regulation of [the AI] industry.” 

The General Assembly tried but failed to heed the governor’s words at a special legislative session in August 2025, when it extended the Act’s effective date from February 1, 2026, to June 30, 2026. With no amendment of the Act yet proposed in the current legislative session, the governor’s AI Policy Working Group has taken the initiative to spur legislative action.

On St. Patrick’s Day, the Working Group released a proposed bill to amend the Act. Although it has not yet been introduced in the legislature, the draft provides an early indication of how the state might ease the Act’s complex requirements. If enacted, the bill would significantly reduce compliance burdens for employers, although certain provisions would be more demanding than those in the existing statute. 

The proposed bill would eliminate many of the Act’s most onerous employer obligations while preserving key transparency requirements. Specifically, the Act would remove the following mandates currently imposed on employers that use artificial intelligence as a substantial factor in employment decisions:

• Reporting findings of discriminatory outcomes to the Colorado attorney general;
• Conducting impact assessments;
• Implementing a risk management policy and program;
• Conducting annual reviews of AI tools;
• Posting or updating privacy policies to describe the use of AI tools;
• Providing notice when interacting with an AI system;
• Complying with correction requests; and
• Affirmatively avoiding algorithmic discrimination (instead relying on a prohibition on violating existing state and federal anti-discrimination laws).

The proposal would retain the requirement that employers give notice before, or at the time, a covered tool is used. It would also continue to require post-adverse action notices. Deployers would also need to provide detailed information about AI tools they develop. Employers would still be required to offer an appeals process for adverse decisions, but only to the extent that the appeals process is commercially reasonable.

The proposed bill would introduce these new obligations: 

• First, employers would be required to retain records of their use of covered tools for three years.
• Second, the bill would substantially expand the definition of covered technology. Under the existing Act, only artificial intelligence systems—computing systems that use an inferential step and are used as a substantial factor in employment and other consequential decisions—are regulated. Under the proposal, any computational process that uses personal information and produces output materially influencing employment or other consequential decisions would fall within the law’s scope. Although the bill includes carveouts for clerical uses of technology, the broadened definition would capture a wide range of automated processes that would not constitute “artificial intelligence” under the prior standard.
• Third, the proposal raises uncertainty about whether it would extend Colorado Privacy Act obligations—currently limited to consumer data—to applicant and employee data.

If introduced, the bill will likely undergo substantial revision before and during the legislative process. Lawmakers may also propose competing bills, as occurred during the August 2025 special legislative session. If the Act were to be replaced by the Working Group’s proposal, the revised law would not take effect until January 1, 2027, giving employers some breathing room to address compliance.