Colorado's AI Act, the first comprehensive state-level high-risk AI statute in the United States, takes effect on June 30, 2026. The law applies to both developers and deployers of "high-risk" AI systems — defined as systems that make, or are a substantial factor in, consequential decisions about housing, employment, education, financial services, healthcare, legal services, government services, or insurance.
Three obligations dominate the compliance picture. First, deployers must operate a documented risk management program built around a recognized framework (NIST AI RMF or ISO/IEC 42001 are the obvious anchors). Second, deployers must complete an impact assessment for each high-risk system, covering purpose, training data, performance metrics, and mitigations for algorithmic discrimination. Third, deployers must disclose to consumers when a high-risk system is being used to make a consequential decision and explain how to appeal.
Developers face a parallel, narrower set of duties: provide deployers with the documentation needed to complete their impact assessments, publicly disclose the categories of high-risk systems they offer, and notify the Colorado Attorney General when they discover an instance of algorithmic discrimination caused by their system.
The Colorado AG has rulemaking authority and is expected to issue interpretive guidance close to the effective date. Enforcement is exclusive to the AG, with civil penalties up to $20,000 per violation. There is no private right of action, but the AG can investigate complaints from consumers.
Colorado's law arrives into a noisier federal landscape. A December 2025 executive order directed federal agencies to challenge state AI laws deemed inconsistent with national policy, and trade groups are already exploring pre-enforcement litigation. Even so, in-scope companies are running compliance work now: most general counsel offices are treating June 30 as a hard deadline.
Source: [Gunderson Dettmer](https://www.gunder.com/en/news-insights/insights/2026-ai-laws-update-key-regulations-and-practical-guidance)