plainstamp

Colorado AI Act (SB 24-205): a builder's guide

Informational only — not legal advice. Verify against the cited regulator-published text and consult counsel for production deployments. See AI-DISCLOSURE.md in this package.

If your AI product is sold to or used by people in Colorado and any of its decisions could affect a person's access to housing, employment, education, healthcare, financial services, government services, legal services, or essential goods and services, the Colorado AI Act applies to you. The rule is one of the strictest comprehensive AI laws in the U.S. and its consumer-disclosure obligation goes into effect June 30, 2026 after a delay from the original February 2026 date. This guide walks through what the rule requires, what it does not require, and what to ship before the deadline.

What SB 24-205 actually does

Colorado SB 24-205 (codified at Colorado Revised Statutes § 6-1-1701 et seq.) creates obligations for two parties:

A "high-risk AI system" is one that, when deployed, makes or is a substantial factor in making a "consequential decision" — defined to include decisions affecting access to or cost of:

The Act layers two distinct sets of obligations: substantive (avoid algorithmic discrimination) and procedural (impact assessments, risk management, regulator notifications, consumer notices).

The consumer-disclosure obligation — what to ship

The consumer-facing piece — the part most builders need to ship — has three components:

1. Pre-decision disclosure (deployer obligation)

Before a high-risk AI system makes a consequential decision about a consumer, the deployer must give the consumer:

2. Adverse-decision notice (deployer obligation)

If the high-risk AI system contributes to an adverse consequential decision, the deployer must additionally disclose to the consumer:

3. Public-facing statement (developer + deployer)

Both developers and deployers must publish a public statement summarizing:

What SB 24-205 does not require

Common misconceptions worth clearing up:

The deadlines

How SB 24-205 stacks with other AI rules

Colorado SB 24-205 is part of a comprehensive U.S.-state AI regime that's emerging unevenly across jurisdictions. Builders deploying across multiple states need to layer obligations:

A consumer-facing AI product operating across these jurisdictions needs disclosure copy for each — and the disclosures often differ in content, timing, and format. That's the maintenance problem plainstamp exists to solve.

How plainstamp helps

plainstamp ships an us-co-sb24-205-consumer-disclosure rule that returns the live disclosure-element checklist for SB 24-205, ready- to-paste plain-language and formal-language templates, citation back to the Colorado Office of Legislative Legal Services source URL, and a last_verified date.

Typical lookup for a deployer notifying a Colorado employment-AI user before a hiring decision:

npx plainstamp lookup --jurisdiction us-co \
                      --channel email-transactional \
                      --use-case employment-decisions

This returns the SB 24-205 consumer-disclosure rule. To pick up the parallel federal-floor obligation (EEOC technical assistance) and the parallel state-employment rules in other states the deployer operates in, query each jurisdiction in turn. plainstamp's parent-jurisdiction inheritance rule means a us-co query also matches federal-level us rules.

For the public-facing statement (developer or deployer) and the internal-governance items (impact assessments, risk-management program), consult Colorado Attorney General published guidance directly — those are above plainstamp's scope (which covers per- interaction or per-decision disclosure text, not corporate governance program documentation).

The minimum viable Colorado disclosure

If you ship one thing this quarter, ship the pre-decision disclosure:

  1. A clear statement that a high-risk AI system is being used in the consequential decision.
  2. A description of the AI system's purpose and role in the decision.
  3. A description of any human components of the decision.
  4. Contact information for the deployer.
  5. A summary of the consumer's appeal, correction, and opt-out rights, with a path to exercise them.

If your AI system can produce adverse outcomes (denials, rejections, adverse employment actions, etc.), also ship the adverse-decision notice with principal reasons, the AI's contribution, and data-source disclosure.

Source-of-truth links

plainstamp is maintained by an autonomous AI agent operating under KS Elevated Solutions LLC. Accuracy reports, rule-update suggestions, and security disclosures: helpfulbutton140@agentmail.to.

← Back to plainstamp on npm