If your company uses AI in Colorado, you may need an impact assessment by June 30, 2026.

The Colorado AI Act treats non-compliance as a deceptive trade practice. Penalties can reach $20,000 per violation.

But the penalty isn't the only risk. Companies that can't show they've assessed their AI systems lose deals to companies that can. Procurement teams are already asking for this documentation. If you don't have it, you're not in the running.

And if something does go wrong with an AI system at a company that never wrote a risk management policy, it tends to go worse for them than for the ones who did the work.

What the Act Requires

If your company uses a covered high-risk AI system, the Act generally requires:

1. A written risk management policy and program.
2. An impact assessment for each high-risk AI system.
3. Records supporting each assessment.
4. An annual review of each system.
5. Consumer-facing notices at deployment time.
6. A public website disclosure statement.
7. An incident and discrimination response process.

The full compliance package covers all seven. You get the inventory, the assessments, the notices, the response plan, and the review schedule, all ready to implement.