Skip to main content
PDPA & Privacy

Colorado AI Act: Duties for AI Developers and Deployers

The Colorado AI Act takes effect on June 30, 2026. It sets duties for AI developers and deployers, including Reasonable Care and Impact Assessments for High-risk AI Systems. Thai companies working with consumers in Colorado should review whether the law applies to their role.

11 Mar 20266 minWilson Sonsini
Colorado AI ActAI GovernanceAlgorithmic DiscriminationComplianceAI Ethics

Who Has Duties Under the Law?

The state of Colorado passed the Colorado AI Act (SB 24-205), which takes effect on June 30, 2026. It creates duties for both developers and organisations that deploy AI in consequential decision-making.

Key Provisions of the Law

Reasonable Care Standard

The law requires both Developers and Deployers to exercise "reasonable care" to prevent Algorithmic Discrimination, which involves discriminatory outcomes based on protected characteristics such as race, sex or age.

High-risk AI Systems

The law classifies certain AI systems used in consequential decisions as High-risk AI. Relevant areas include:

  • Employment and performance evaluation
  • Credit and insurance approvals
  • Education and admissions
  • Healthcare
  • Law enforcement

Impact Assessments Before and During Use

One requirement is to conduct an Impact Assessment before deployment and monitor the system during use. The assessment covers:

  • The purpose of the AI system and its target users
  • The types of data used for training and inference
  • Bias testing and results
  • Remediation measures if discrimination is identified
  • Human oversight processes

Transparency

Individuals affected by AI-driven decisions have the right to:

  • Be informed that AI is being used in the decision-making process
  • Receive an explanation of the factors considered by the AI
  • Appeal to a human reviewer

Comparison with Thailand’s PDPA

The Colorado AI Act and Thailand’s PDPA both address risk assessment, individual rights and organisational accountability. They are separate laws with different scopes, so this table is only a high-level comparison.

Topic Colorado AI Act Thailand PDPA
Impact Assessment Mandatory for High-risk AI DPIA for high-risk processing
Data subject rights Notice + appeal Rights of access, rectification, erasure, and objection
Reasonable Care Broad standard Principles of necessity and proportionality

Implications for Thai Organizations

Check whether Colorado consumers are affected. If your AI system supports consequential decisions involving people in Colorado, seek advice on which duties apply to your role, even if the company is based elsewhere.

Use the requirements as review questions. Even where the law does not apply directly, its focus on purpose, data, impact testing, human oversight and appeals can help a team examine its own system more methodically.

Keep evidence from before deployment. Record data choices, test results, accountable reviewers and complaint channels. These records help the team examine impact and explain its decisions.

This article is a general overview, not legal advice. Check the current law and its application to your business with an appropriate adviser.

Sources:

"Empowering Innovation,
Transforming Futures."

Contact us to make your project a reality.