Página traduzida e verificada automaticamente. Prevalece a versão em inglês. Algumas partes ainda estão em inglês enquanto a tradução é verificada. Ver em inglês · Informar um erro de tradução

Regulamentações › Estados dos EUA › Colorado

Lei de IA do Colorado

Colorado Artificial Intelligence Act (SB 24-205)

Aplicação suspensa ia decisões automatizadas
QuandoSua data de vigência foi adiada de 1º de fevereiro de 2026 para 30 de junho de 2026, um tribunal federal suspendeu a aplicação em abril de 2026, e o legislativo vem reexaminando a lei. Verifique a situação atual antes de se basear nela.
Quem fiscalizaProcurador-Geral do Colorado
A quem se aplicaDesenvolvedores e implantadores de sistemas de IA de alto risco usados em decisões relevantes, como emprego, crédito, moradia, educação, saúde e seguros.

A primeira lei estadual ampla dos EUA sobre discriminação algorítmica, inspirada em parte em abordagens baseadas em risco como a Lei de IA da UE.

The law in brief

The Colorado AI Act (SB 24-205) was the first comprehensive US state law aimed at algorithmic discrimination. It puts duties on developers and deployers of high-risk AI systems, those that make, or are a substantial factor in making, consequential decisions about people.

Its status is unsettled. Its effective date was moved to 30 June 2026, and in April 2026 a federal court stayed its enforcement in a pending lawsuit, while the legislature has been revisiting the framework. The obligations below are the law as enacted; check Regulatory Watch before relying on dates.

A quem se aplica

  • Developers of high-risk AI systems doing business in Colorado.
  • Deployers that use high-risk AI systems to make consequential decisions about Colorado consumers.
  • Consequential decisions are those with a material effect on access to, or the cost or terms of, education, employment, financial or lending services, essential government services, health care, housing, insurance or legal services.
  • Some small deployers (fewer than 50 employees, meeting conditions) are exempt from parts of the deployer duties.

What it requires

A duty of reasonable care

Developers and deployers must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination.

Deployer risk management and impact assessments

Deployers maintain a risk management policy and program, and complete an impact assessment for each high-risk system at least annually and after significant changes.

Tell consumers, explain, and allow appeal

Notify consumers before a high-risk system is used in a consequential decision about them, and after an adverse decision explain the reasons and offer correction and appeal.

Developer documentation and disclosure

Developers give deployers the documentation needed for impact assessments, publish a statement on their high-risk systems, and tell the Attorney General and known deployers of discovered risks of algorithmic discrimination within 90 days.

Direitos das pessoas

Consumers must be told when a high-risk AI system is used to make a consequential decision about them. After an adverse decision they are entitled to an explanation of the principal reasons, a chance to correct incorrect personal data, and an appeal with human review where technically feasible.

Enforcement and penalties

Aplicada exclusivamente pelo Procurador-Geral do Colorado, com as violações tratadas como práticas comerciais enganosas nos termos da Colorado Consumer Protection Act; não há direito privado de ação. Seguir um framework reconhecido, como o Framework de Gestão de Riscos de IA do NIST ou a ISO/IEC 42001, fundamenta uma defesa afirmativa.

What's changing

Stayed and under revision. Enforcement was stayed by a federal court in April 2026, and further legislative changes have been under consideration. Treat the duties below as the direction of travel, and check Regulatory Watch for the current position.

What to do first

  1. Inventory AI used in consequential decisions about Colorado consumers.
  2. Adopt a risk management program aligned to the NIST AI RMF or ISO/IEC 42001; it helps under any version of the law.
  3. Prepare impact assessments for high-risk systems.
  4. Draft consumer notices and an adverse-decision explanation and appeal process.
  5. Watch the court case and the legislature before committing to dates.

Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.

Novidades recentes

Nada informado ainda. O Regulatory Watch lista novas regras, ações de fiscalização e decisões judiciais à medida que surgem.

Fontes

Biblioteca de regulamentações

Todas as leis estaduais de privacidade dos EUA em um só mapa

24 estados têm uma lei abrangente de privacidade na biblioteca, ao lado das leis da UE, do Reino Unido, federais dos EUA e globais: 102 no total, cada uma explicada em linguagem simples com suas fontes. Selecione um estado para ver o que se aplica lá.

  • Em vigor
  • Entrando em vigor
  • Leis setoriais
AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL