CO SB205

Establishes Colorado's AI consumer protection law effective February 1, 2026, creating requirements for developers and deployers of high-risk AI systems that make consequential decisions affecting consumers in employment, education, housing, insurance, lending, legal services, healthcare, and essential government services.

Requires developers to conduct reasonable care to prevent algorithmic discrimination, provide documentation to deployers about training data, known limitations, performance metrics, and mitigation measures, and disclose any discovered discrimination risks within 90 days.

Mandates deployers implement risk management policies, complete annual impact assessments, and provide consumers with pre-decision notices disclosing AI system use, purpose, and contact information, plus post-decision explanations for adverse decisions with opportunities to correct data and appeal.

Creates exemptions for small businesses (fewer than 50 employees), federal agencies, federally regulated entities, research activities, and systems that are obvious to users (like chatbots) or perform narrow procedural tasks.

Grants the Colorado Attorney General exclusive enforcement authority to treat violations as unfair trade practices, with affirmative defenses for entities that discover and cure violations or comply with recognized AI risk management frameworks.