Colorado AI Law: Complete Small Business Guide

Colorado passed the first major U.S. AI disclosure law. If you have customers in Colorado, here's what the current law requires and how to prepare before it takes effect.

What this law actually does

Colorado SB 24-205 (the "Colorado Artificial Intelligence Act") requires any business deploying "high-risk AI systems" to disclose that use to consumers, conduct annual impact assessments, and provide opt-out mechanisms. The fine is up to $20,000 per violation, and each affected consumer can be a separate violation.

Does it apply to my business?

Yes, if both of these are true:

You do business with consumers in Colorado (sell products, provide services, or run a website that Coloradoans interact with)
Your site uses AI in any of these ways: chatbots, automated customer service, dynamic pricing, recommendation engines, hiring filters, or anything making consequential decisions

There is no small business exemption. A two-person Shopify store using a Drift chatbot is on the hook just like a Fortune 500.

What you need to do

Add a clear notice before any AI interaction (e.g., "You're chatting with an AI assistant")
Provide a way for users to request a human or opt out
Conduct an annual impact assessment for high-risk AI uses
Maintain documentation of which AI tools you use and what data they process

The cheapest path to compliance

For most SMBs, compliance is mostly about disclosure language on your site — not ripping out AI tools. Add a banner near your chat widget. Update your privacy policy. Document what you use.

Real risk: The current law (SB 26-189) takes effect January 1, 2027 and is enforced by the Colorado Attorney General. Sites with chat widgets and other consumer-facing AI but no disclosure are the obvious early targets — the cheap fix is getting your disclosures in place now.

How to find out where you stand

ComplianceBeacon scans your site and tells you which AI tools you're using and what disclosures Colorado law requires. Run a free scan.