Colorado Makes History with the Nation's First Comprehensive AI Act

Tatiana Rice, CIPP/EU, serves as Deputy Director with the Future of Privacy Forum’s US Legislation team and leads FPF’s Biometrics workstream.

Colorado is taking center stage in the national and international conversation on responsible AI governance. With the recent passage of the Colorado AI Act, sponsored by Senate Majority Leader Robert Rodriguez and signed into law by Governor Jared Polis on May 17, Colorado is a trailblazer in regulating high-risk artificial intelligence (AI) systems. The Colorado AI Act is the first comprehensive legislative framework in the US to govern high-risk AI systems, setting a precedent for other states. Significantly, it will also be the first comprehensive AI law to come into effect globally, ahead of even the European Union AI Act.

The Colorado AI Act (CAIA) responds to the increasing use of AI in decision-making, particularly across sectors like healthcare, education, and employment. While AI holds immense potential for societal advancement, it also poses risks, including well-documented cases of algorithmic discrimination. In today's evolving technological landscape, AI presents great power but requires great responsibility, as it can either perpetuate existing biases or mitigate them. The CAIA seeks to achieve the latter.

Although most agree that civil rights laws already apply to these sectors in theory, whether humans or machines are conducting relevant tasks, applying these laws from the 1960s to modern AI is murky and lacks transparency. The CAIA aims to fill this gap by providing guidelines and measures to identify and mitigate algorithmic discrimination and establishing a governance framework with proper testing, documentation, transparency, guardrails, and oversight to ensure AI's potential benefits are realized while addressing inherent biases in decision-making processes.

It’s also critical to highlight the broadly consultative process that shaped the CAIA, balancing the interests of both civil society and industry. While some were surprised by the swift passage of the bill—introduced in early April and signed into law by early May—the groundwork for the CAIA was laid much earlier. In 2023, Senator Rodriguez and Connecticut Senator James Maroney convened a multi-state, bipartisan working group of policymakers. This group collaborated extensively with experts in AI, computer science, civil rights, civil society, academia, and other fields to develop a well-rounded understanding of AI governance needs. Sen. Rodriguez circulated discussion drafts in late fall 2023 and continued to refine the model with Maroney, incorporating stakeholder feedback and reactions–influencing the development of both the CAIA and Sen. Maroney’s Connecticut Senate Bill 2. The development process of the CAIA reflects a commitment to inclusive policymaking that is crucial when considering the multifaceted challenges posed by AI. 

While the framework of the Colorado AI Act (CAIA) may not be perfect, it has achieved a notable level of success by garnering positive recognition from both industry giants like IBM and Microsoft, trade associations like the BSA|The Software Alliance, and notable civil society advocacy groups such as the Center for Democracy and Technology and Consumer Reports. This broad level of cooperation contrasts sharply with legislative efforts on the federal level, where even basic data privacy laws struggle to reach consensus in Congress, leaving technology policy experts increasingly looking to states for guidance. The CAIA's passage marks a significant milestone in responsible technology governance, positioning Colorado as a leader in ethical AI practices. However, as Governor Polis noted in his signing statement, the CAIA is just the beginning. With the law set to take effect in 2026, stakeholders must continue to collaborate, offering reasonable revisions and solution-oriented ideas to refine and improve this pioneering legislation.

The era of "move fast and break things" is coming to a close, with entities such as the Federal Trade Commission (FTC) and various state Attorneys General emphasizing the necessity and impending reality of comprehensive AI regulation. By embracing the CAIA, Colorado not only reaffirms its commitment to ethical AI development and consumer protection, but Colorado businesses may be better positioned to succeed in the long run.

Debates continue over the efficacy of the CAIA and whether it will spark a nationwide "Denver effect," yet its precedent is undeniable. As states deliberate their own laws governing AI in the absence of federal legislation, the question remains: Can this framework foster alignment across diverse jurisdictions?