Colorado's AI & technology laws, explained for small business

Duties start January 1, 2027

Who it applies to: Any business — no size exemption — using AI or automated tools that materially influence decisions about employment, housing, lending, insurance, health care, education, or essential government services.

Tell people before an automated tool influences a decision about them; explain adverse outcomes in plain language within 30 days; offer human review and data correction; keep records for 3 years. The 2024 version (SB 24-205) was repealed — impact assessments and risk programs are gone.

Signed May 29, 2026 · duties start January 1, 2027

Who it applies to: Operators of public conversational AI that primarily simulates human conversation — aimed at companion-style bots. Routine customer-service bots are excluded from the definition, with edges to be settled by AG rules.

Disclose the user is talking to AI, estimate age and protect minors, respond safely to self-harm signals, never imply licensed professional care, and report annually to the Attorney General.

The nearest deadline on this page

Who it applies to: All DORA-regulated mental-health professionals — including registered psychotherapists — and their practices.

No AI conducting therapeutic communication with clients; AI-generated treatment recommendations need professional review; and AI note-takers/transcription (AI scribes) require advance disclosure and written client consent. If your practice uses an AI scribe, you need consent forms — in the languages your clients speak — by August 12.

In force since July 1, 2025

Who it applies to: Every employer using fingerprint timeclocks, face-scan access, or voice ID — this one has NO size threshold, unlike the rest of the privacy act.

A written biometric policy with a retention schedule and deletion rules, an incident-response plan, and employee notice + consent before collection. Most small employers with punch clocks have never heard of it.

In force since 2018

Who it applies to: Every business holding Colorado residents' personal information — no size threshold.

A written data-disposal policy, reasonable security procedures, vendor security flow-down, and breach notification within 30 days (to the Attorney General too, at 500+ residents). If you handle customer financial data, the federal FTC Safeguards Rule adds the written security plan (WISP) requirement.

In force since July 1, 2023

Who it applies to: Businesses processing personal data of 100,000+ Colorado consumers a year (or 25,000+ plus selling data). Most Main Street businesses are BELOW these thresholds.

If you are under the thresholds, the core act does not apply to you — but the biometric amendment, the breach rules, and the AI laws above still do. That honest triage is exactly what a readiness assessment sorts out.

In force since January 1, 2026

Who it applies to: Anyone advertising a price in Colorado — pricing pages, online menus, booking flows, Google Business Profiles, rental listings.

The full price must appear as one number, more prominently than any other figure, unavoidable on websites — and in each language your ad uses. A Spanish-language ad needs the Spanish-language total-price disclosure. We audit and fix priced pages as part of web care.

Fully enforceable since July 1, 2025

Who it applies to: Every Colorado public entity: towns, counties, school districts, and 1,700+ special districts — including their PDFs and documents.

The federal ADA web rule gave small entities until 2027–2028. Colorado did not: state-law exposure started July 1, 2025, with statutory damages per plaintiff. One WCAG 2.1 AA remediation satisfies both. We build accessible bilingual government sites, and state SIPA grants can help fund the work.

Homepage rules in force since August 6, 2025

Who it applies to: Every metro district organized after 2000 that levies property tax — roughly 2,300 districts, heaviest in the Adams County growth corridors.

Thirteen categories of statutory website content on fixed annual clocks, five of them now required on the homepage, plus a plain-language explainer of what the district is. We build, retrofit, and run these sites bilingually.