Multinationals that use AI to score, rank or screen people in both the EU and Colorado are planning against two laws that look alike from a distance and work very differently up close. The EU AI Act (Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744) is a product safety regime with risk management, data governance, logging and conformity assessment. Colorado's law, after Senate Bill 26-189 repealed and reenacted the 2024 statute, is a transparency and redress regime for automated decision-making technology (ADMT) used in consequential decisions. This guide compares scope, roles, duties, assessments, individual rights and enforcement, shows which EU evidence can be reused for Colorado and where it cannot, and gives a decision checklist and a worked scenario. It is for privacy, legal, AI governance and security teams running one AI compliance programme across both jurisdictions. Status in this guide was checked on 13 November 2026.
Key takeaways
- The short answer: the EU law is broader and heavier. An organisation that meets the EU AI Act for an Annex III system will already hold most of the documentation Colorado deployers and developers need, but not the Colorado consumer notices, the 30-day adverse outcome explanation or the correction and human review process in the Colorado form.
- Dates do not line up. Colorado's ADMT law applies to consequential decisions made on or after 1 January 2027, according to the Colorado Attorney General. EU high-risk obligations for Annex III systems apply from 2 December 2027 under the amended Article 113, so Colorado bites first for many systems.
- Different triggers catch different systems. The EU test is a listed use case (Annex III) with a documented derogation in Article 6(3); the Colorado test is whether ADMT output is a non-de minimis factor in a decision in one of seven covered domains. A system can be in one law and out of the other.
- Colorado has no impact assessment; the EU has two. SB 26-189 contains no impact assessment or risk management programme duty. The EU requires a provider risk management system (Article 9) and, for some deployers, a fundamental rights impact assessment (Article 27).
- Enforcement models differ. EU fines reach EUR 15 million or 3% of worldwide turnover for most operator duties (Article 99(4)); Colorado treats a violation as a deceptive trade practice enforced only by the Attorney General, with a 60-day cure period until 1 January 2030 and no new private right of action.
Status of both laws as of 13 November 2026
Colorado SB 24-205, the 2024 "high-risk AI" law with impact assessments, never applied. SB25B-004, signed on 28 August 2025, first pushed its requirements to 30 June 2026; SB 26-189, signed on 14 May 2026 according to the Colorado Division of Real Estate, then repealed and reenacted Part 17 of Article 1 of Title 6 of the Colorado Revised Statutes as an ADMT law. The detail of that history sits in the Colorado AI Act Guide; this page compares the current law only.
| Item | EU AI Act | Colorado (SB 26-189) |
|---|---|---|
| Legal instrument | Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744 | C.R.S. 6-1-1701 to 6-1-1709, as reenacted by SB 26-189 |
| Obligations for Annex III or covered ADMT | Chapter III Sections 1 to 3 apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) | Applies to consequential decisions made on or after 1 January 2027 |
| Implementing detail | Harmonised standards, Commission guidelines and an AI Office FRIA template (Article 27(5)) | Attorney General rules on adverse outcome disclosures and human review, due before 1 January 2027; proposed rules were heard on 26 October 2026 |
What to watch: the Attorney General's AI page, last modified 27 October 2026, records no adoption of final rules. Final Colorado rules, which will set the content of the post-adverse-outcome disclosure and what counts as meaningful human review, and EU harmonised standards for Chapter III. Track EU dates on the EU AI Act Implementation Timeline Tracker.
Scope: which systems each law catches
The two laws define their target from opposite directions. The EU AI Act starts with the AI system and asks whether its intended purpose falls in a listed high-risk area. Colorado starts with the decision about a consumer and asks whether technology output materially influenced it.
| Scope element | EU AI Act | Colorado |
|---|---|---|
| Regulated object | AI system (and general-purpose AI models, out of scope here) | Automated decision-making technology: technology that processes personal data and uses computation to generate outputs such as predictions, scores or rankings (6-1-1701(2)) |
| Risk trigger | Annex III use case or Annex I product safety component (Article 6) | Output "materially influences" a consequential decision: a non-de minimis factor that affects the outcome, excluding incidental, trivial or clerical uses (6-1-1701(13)) |
| Covered areas | Eight Annex III areas: biometrics; critical infrastructure; education; employment; essential private and public services and benefits; law enforcement; migration, asylum and border control; justice and democratic processes | Seven covered domains: education; employment; residential real estate in Colorado; financial or lending services; insurance; health care services; essential government services and public benefits (6-1-1701(6)) |
| Escape route | Article 6(3) derogation where the system does not materially influence outcomes (narrow procedural task, improving a completed human activity, pattern detection, preparatory task), documented under Article 6(4); never available where the system profiles natural persons | Exclusions from ADMT (for example spreadsheets without machine learning, databases, tools that only summarise information for human review) and from consequential decision (routine administration, advertising, search, content moderation, fraud and sanctions compliance, cybersecurity) |
| Territorial reach | Providers placing systems on the EU market wherever established, deployers in the EU, and third-country providers and deployers where output is used in the Union (Article 2(1)) | Developers and deployers "doing business in Colorado" (6-1-1701(7), (8)) |
| Sector carve-outs | Annex III 5(b) excludes systems used to detect financial fraud | Insurers under C.R.S. 10-3-1104.9 deemed compliant; HIPAA entities excluded except employment decisions; FDA-regulated devices excluded (6-1-1708) |
Where the scopes diverge in practice
- Insurance: the EU lists risk assessment and pricing for life and health insurance (Annex III 5(c)). Colorado lists insurance as a covered domain, but deems insurers already regulated under C.R.S. 10-3-1104.9 compliant in the practice of insurance. A motor insurer's pricing model can therefore sit outside Annex III and inside the Colorado domain list, and then be deemed compliant through the insurance statute.
- Housing: leasing or buying Colorado residential real estate is a Colorado domain with no direct Annex III equivalent. Tenant screening tools are a typical case where Colorado applies and the EU high-risk regime may not.
- Health care: Colorado covers health care services but excludes HIPAA covered entities and business associates except for employment decisions. The EU catches medical devices through Annex I instead, on the later 2 August 2028 date.
Roles: provider and deployer vs developer and deployer
Both laws split duties between the party that builds or sells the technology and the party that uses it, but the boundaries differ in ways that matter for in-house builds.
| Question | EU AI Act | Colorado |
|---|---|---|
| Who builds or sells | Provider: develops a system or has it developed and places it on the market or puts it into service under its own name | Developer: makes a covered ADMT commercially available, builds components for one, or substantially modifies an ADMT so it becomes covered; internal and research-only uses are excluded (6-1-1701(8)) |
| Who uses | Deployer: uses a system under its authority, other than for personal non-professional activity | Deployer: a person doing business in Colorado that uses a covered ADMT (6-1-1701(7)) |
| In-house build used internally | The organisation is the provider (putting into service for its own use) and the deployer | Usually a deployer only, because internal-use developers are excluded |
| Role change | A deployer that substantially modifies or rebrands a high-risk system can become a provider (Article 25) | Substantially modifying an ADMT so that it becomes covered can make a person a developer |
The in-house case is the most common surprise. A bank that trains its own credit model carries full EU provider duties for EU use, while in Colorado it carries deployer duties only. The EU role split is covered in the EU AI Act Provider vs Deployer Obligations Guide.
Duties compared, side by side
| Duty area | EU AI Act (high-risk) | Colorado (covered ADMT) | Reuse of EU evidence |
|---|---|---|---|
| Builder documentation to users | Technical documentation (Article 11) and instructions for use (Article 13) | Developer documentation: intended and known harmful uses, training data categories to the extent known, known limitations, use and human review instructions, information deployers need for notices (6-1-1702(1)) | High: Article 13 instructions cover most items; add a "known harmful uses" section and Colorado notice inputs |
| Change notification | Substantial modification triggers new conformity assessment (Article 43(4)) | Notify deployers within a reasonable time of material updates, intentional and substantial modifications and changes in intended use (6-1-1702(2)) | Medium: EU change control identifies the events; Colorado needs direct notice to each deployer |
| Risk management | Lifecycle risk management system (Article 9) | No equivalent duty | Not required in Colorado; still useful as diligence for discrimination claims |
| Data governance and bias | Training, validation and testing data quality (Article 10); special category data for bias correction only under Article 4a conditions | No data governance duty; liability under the Colorado Anti-Discrimination Act for decisions materially influenced by covered ADMT (6-1-1707) | High as evidence of care, but compliance with Part 17 is expressly not a defence (6-1-1707(8)) |
| Logging and records | Automatic logs (Article 12); deployers keep logs under their control for at least six months (Article 26(6)) | Developers keep compliance records at least three years; deployers keep records for at least three years after each consequential decision, which may include version identifiers and changelogs (6-1-1702(4), 6-1-1703) | Partial: EU logs are a source, but Colorado retention is longer and decision-centred |
| Human oversight | Designed in by the provider (Article 14) and assigned by the deployer to competent people with authority (Article 26(2)) | Meaningful human review and reconsideration on request after an adverse outcome, to the extent commercially reasonable (6-1-1705(1)) | Medium: the EU oversight role can perform Colorado reviews if it has authority to change outcomes |
| Notice to individuals | Deployers of Annex III systems inform natural persons that they are subject to the system (Article 26(11)) | Clear and conspicuous notice before use, which a prominent public notice at points of consumer interaction can satisfy (6-1-1704(1)) | High for the trigger, low for the wording: write Colorado-specific text |
| Explanation | Right to clear and meaningful explanation of the system's role and the main elements of the decision, on request, for decisions with legal or similarly significant effects (Article 86) | Within 30 days after an adverse outcome: plain-language description of the decision and the ADMT's role, how to request more information (tool name, version, developer, data types and sources), and consumer rights (6-1-1704(3)) | Medium: same content, but Colorado is proactive and time-bound, the EU is on request |
| Correction | No AI Act equivalent (GDPR Article 16 rectification applies separately) | Instructions to correct factually incorrect or materially inaccurate personal data; opinions, predictions and scores need not be corrected (6-1-1705) | Low: build from the GDPR rectification process |
| Conformity and registration | Conformity assessment (Article 43), EU declaration, CE marking, registration (Article 49) | None | Not needed |
Impact assessments: FRIA and Article 9 vs nothing in Colorado
This is the clearest break from the 2024 Colorado law. SB 24-205 required annual impact assessments; the reenacted law does not use the term. The EU, by contrast, has two assessment duties that apply to different parties.
- Provider risk management (Article 9): a documented, iterative process across the lifecycle, covering known and foreseeable risks to health, safety and fundamental rights. See the EU AI Act Article 9 Risk Management System Guide.
- Deployer FRIA (Article 27): required before first use for bodies governed by public law, private entities providing public services, and deployers of creditworthiness and credit scoring systems (Annex III 5(b)) or life and health insurance risk and pricing systems (Annex III 5(c)). It records the processes, period and frequency of use, affected groups, specific risks, oversight measures and complaint mechanisms, and the results go to the market surveillance authority. See the EU AI Act Fundamental Rights Impact Assessment.
- Colorado: no assessment duty, but discrimination liability remains under 6-1-1707, fault is allocated between developer and deployer by relative fault, and indemnities for a party's own discrimination violations are void. Bias testing is therefore a litigation defence asset rather than a filing.
Practical choice: keep running one assessment per system that meets the EU standard, and treat its bias and affected-group sections as the Colorado discrimination file. The AI Impact Assessment Template gives a structure that covers both.
Threat models: what each law is trying to stop
- EU AI Act: unsafe or rights-infringing AI systems reaching the market.
- Colorado: consumers harmed by opaque decisions they cannot see, challenge or correct.
- Security and identity overlap: both regimes depend on attributing each output to a specific model version, configuration and calling identity. Colorado's adverse outcome notice names the tool's version and developer; EU Article 12 logs must support traceability. Shared service accounts and unpinned model versions break both. See the EU AI Act Article 12 Guide.
Enforcement and penalties
| Element | EU AI Act | Colorado |
|---|---|---|
| Enforcer | National market surveillance authorities; AI Office for general-purpose AI models | Attorney General only, through the Colorado Consumer Protection Act (6-1-1706(1)) |
| Legal characterisation | Administrative fines under Article 99 | A violation is a deceptive trade practice (6-1-1706(2), C.R.S. 6-1-105(1)(uuuu)) |
| Maximum fines | EUR 35 million or 7% for prohibited practices; EUR 15 million or 3% for operator obligations including Articles 16 and 26; EUR 7.5 million or 1% for misleading information; lower of the two for SMEs (Article 99(3) to (6)) and for small mid-caps on 99(4) and 99(5) (Article 99(6a)) | No amount set in Part 17; remedies come from the Colorado Consumer Protection Act |
| Cure | None in the Regulation | Notice of violation and 60 days to cure where a cure is possible; not for knowing or repeated violations; repealed on 1 January 2030 (6-1-1706(3)) |
| Private action | Complaints to market surveillance authorities; Article 86 explanation right | "Nothing in this Part 17 creates a new private right of action" (6-1-1706(4)); existing remedies preserved |
Decision guidance: one programme or two
- Build one EU-grade core: where the same system runs in both places, the EU duties are the superset for documentation, logging and oversight. Use one system record, one model version register and one assessment, then layer Colorado outputs on top.
- Add a Colorado decision layer: pre-use notices, the 30-day adverse outcome disclosure, a correction route and a human review queue are decision-time processes the EU AI Act does not require in the same form. They belong to the business process owner, not the model team.
- US-only systems: a tenant screening or motor insurance tool used only in Colorado does not need EU artefacts. Apply the Colorado layer plus a proportionate bias test.
- Small organisations: EU SMEs get the lower fine cap in Article 99(6), not lighter duties. The 2024 Colorado law had a deployer exemption below 50 full-time employees; SB 26-189 as enrolled contains none, so a small Colorado landlord or lender using a scoring tool is in scope.
Worked scenario: a lender scoring applicants in Dublin and Denver
A lender has built an in-house credit scoring model. Loan officers in Ireland and Colorado see the score, a reason code list and a recommended decision, and approve or decline.
- Classify: in the EU the model evaluates creditworthiness, so it is Annex III 5(b) and high-risk; it profiles natural persons, so the Article 6(3) derogation is unavailable. In Colorado it is ADMT, the decision concerns financial or lending services, and the score is weighed, so it materially influences a consequential decision.
- Assign roles: EU provider and deployer (built and used in-house); Colorado deployer only (internal-use developers are excluded).
- EU work, due 2 December 2027: Article 9 risk management, Article 10 data governance, Article 11 documentation, Article 12 logs, Article 14 oversight design, Article 15 robustness and cybersecurity, conformity assessment and registration; as deployer, an Article 27 FRIA before use and Article 26 duties.
- Colorado work, due 1 January 2027: a pre-use notice in the application journey; a template for the 30-day adverse outcome disclosure naming the tool, version and data sources; a correction route for factual errors in application data; a human review queue staffed by officers with authority to change the outcome; records kept three years per decision.
- Reuse: the FRIA's affected-group and bias sections become the Colorado discrimination file; Article 12 logs feed the Colorado decision record; the Article 14 oversight role performs Colorado reconsideration.
- Check overlaps: 6-1-1704(6) lets creditors satisfy the disclosure through federal ECOA or FCRA adverse action notices if those notices also meet its requirements. Review existing notices before writing new ones.
Common failure patterns
- Planning to the repealed Colorado law: budgets for annual impact assessments and Attorney General reports under SB 24-205, while the 30-day disclosure and correction process required by SB 26-189 is not built.
- Assuming EU compliance covers Colorado: EU artefacts are evidence, not consumer-facing processes. Colorado's notices, explanation deadline and correction route need their own owners.
- Treating a human approver as an exemption: a weighed score is a non-de minimis factor in Colorado and profiling blocks the EU derogation, whatever the approval screen looks like.
- Short log retention: keeping inference logs for the EU six-month minimum and deleting them before Colorado's three-year record period ends.
- Unattributed outputs: a shared service account calling an unpinned third-party model means neither the EU logs nor the Colorado disclosure can say which version made the recommendation. Give each AI system and agent its own identity; see the EU AI Act for AI Agents.
- Relying on contract indemnities: Colorado voids clauses indemnifying a party for its own ADMT-related discrimination violations, so vendor contracts cannot shift that exposure.
Detection and measurement
- Inventory coverage: percentage of AI and ADMT systems with a recorded EU classification and Colorado domain decision.
- Disclosure timeliness: share of Colorado adverse outcome disclosures sent within 30 days of the decision.
- Review outcomes: number of human review requests and the percentage that changed the outcome; a rate near zero suggests reviewers are rubber-stamping.
- Attribution completeness: percentage of decisions whose record names model version, configuration and calling identity.
Framework mapping
| Framework | Reference | How it supports both laws |
|---|---|---|
| NIST CSF 2.0 | GV.OC-03 | Legal and regulatory requirements, including privacy and civil liberties, understood and managed |
| NIST CSF 2.0 | ID.AM-07 | Inventories of data and metadata, needed for Colorado training data categories and EU Article 10 |
| NIST SP 800-53 Rev 5 | PT-5, RA-8 | Privacy notice and privacy impact assessment practices that underpin notices and assessments |
| NIST SP 800-53 Rev 5 | AU-11 | Audit record retention set to the longer of the EU and Colorado periods |
| ISO/IEC 27001:2022 | Annex A 5.31 | Identifying legal, statutory, regulatory and contractual requirements |
| NIST AI RMF / ISO/IEC 42001 | Management system | Governance structure for both; neither carries a statutory defence under SB 26-189 |
See the NIST AI RMF Guide and EU AI Act vs ISO/IEC 42001.
Practitioner checklist
- Retire any plan built on Colorado SB 24-205 and re-baseline on SB 26-189.
- Record for each system its EU classification (Annex III area, derogation decision) and Colorado status (domain, materially influence test).
- Map roles per system and jurisdiction, noting in-house builds that are EU providers but Colorado deployers only.
- Build Colorado notices, the 30-day adverse outcome disclosure, correction and human review before 1 January 2027.
- Reuse Article 13 instructions as the Colorado developer documentation pack, adding known harmful uses.
- Set decision record retention to at least three years for Colorado systems, above the EU six-month log minimum.
- Keep bias testing for Colorado-only systems as a discrimination defence, not a filing.
- Re-check this comparison when final Colorado rules or EU harmonised standards land.
Standards and references
- European Commission AI Act Service Desk: Article 113, Entry into force and application
- European Commission AI Act Service Desk: Article 27, Fundamental rights impact assessment
- European Commission AI Act Service Desk: Article 6, Classification rules for high-risk AI systems
- European Commission AI Act Service Desk: Article 99, Penalties
- Colorado General Assembly: SB 26-189 enrolled text
- Colorado General Assembly: SB26-189 Automated Decision-Making Technology
- Colorado Attorney General: Artificial intelligence rulemaking
- Colorado Division of Real Estate: SB26-189 summary
Related NHI Mgmt Group resources: Colorado AI Act Guide · EU AI Act Compliance Guide · EU AI Act High-Risk AI Systems Guide · US State Privacy Laws Guide. This guide summarises the EU AI Act and Colorado's automated decision-making technology law as of 13 November 2026 and is not legal advice.