In the spring of 2024, the Colorado legislature was the first to pass a “comprehensive” artificial intelligence (“AI”) law, the Colorado Artificial Intelligence Act (“CAIA”). Since its passage, state leadership has waffled on whether CAIA strikes the right balance between protecting consumers while allowing businesses to innovate using AI. As of this writing, the only comparable legislation to be passed is the EU AI Act, which has also been criticized for going too far and stifling innovation.

Effective February 1, 2026, CAIA will require companies doing business in Colorado to meet stringent compliance and oversight requirements intended to prevent algorithmic discrimination in AI systems considered to be “high risk.” The broad applicability and heavy compliance burden will be difficult for smaller businesses.

The AI regulatory saga in Colorado

CAIA has been mired in criticism since its passage, and that criticism persists a year later. In a rare signing statement issued on May 17, 2024, Governor Jared Polis both commended CAIA for attempting to protect Coloradoans from algorithmic discrimination while expressing reservations over how a regulatory “patchwork” system would stifle innovation in AI technology¹. A month later and at the behest of Colorado businesses, Governor Polis, Attorney General Phil Weiser, and state Senator Robert Rodriguez, who sponsored CAIA and the Colorado Privacy Act, issued a joint statement re-emphasizing the importance of AI regulation that strikes a balance between protecting consumers without restraining the growth potential in Colorado’s technology sector. The o²verarching theme of the statement seems to be “the work isn’t done yet” when it comes to AI regulation, and it re-emphasizes the idea that the Federal government should be the leader on AI regulation.

Over the course of 2024, a Colorado Artificial Intelligence Impact Task Force held several meetings that gave stakeholders opportunities to give their input on changes to CAIA. Stakeholders in these meetings hailed from a wide cross-section of interests, including state legislators, legal experts, consumer protection groups, and technology companies. The takeaways highlighted areas of CAIA that stakeholders agreed need to be changed, and others that would need more debate to reach a consensus. The state legislature attempted to introduce amendments to CAIA a week before the 2025 session closed, but these were shelved indefinitely, which inspired statements from state leadership to the Colorado legislature to postpone CAIA’s effective date by a year. AG Weiser published his testimony on this point, and joined a letter to the same effect that was signed by Governor Polis, U.S. Representatives Joe Neguse and Brittany Pettersen, U.S. Senator Michael Bennet, and Denver Mayor Mike Johnston. The Colorado legislature could still postpone CAIA via a special session later in 2025, but as of the time of this writing, it will go into effect as originally passed and planned in early 2026.

AI regulatory challenges in the broader U.S.

Colorado is not the only state entering the AI regulatory space with trepidation. In 2024, the Connecticut state legislature killed a similar bill to CAIA under threat of veto by the governor. In 2025, the Virginia legislature passed a less-stringent version of CAIA, but it was vetoed by the governor, citing similar concerns as Governor Polis in his CAIA signing statement. Meanwhile, other states continue to permit AI regulations in piecemeal, with Utah, for example, passing several AI bills targeting impersonation, transparency, and mental health services; but none of these laws approach the level of comprehensiveness of CAIA.

Adding a deeper wrinkle to the AI regulation saga, the U.S. House Committee on Energy and Commerce added a provision to the federal budget reconciliation bill that would put a ten-year moratorium on states enforcing any AI regulations³. Co-led by Colorado’s AG Weiser, the National Association of Attorneys General published a bipartisan letter in response, criticizing the moratorium in the absence of federal AI regulation. AG Weiser’s involvement on this letter seems to contradict CAIA concerns he expressed only weeks before, but there is a consistent theme – while CAIA is far from perfect, Weiser believes there needs to be some AI regulation.

Where this leaves U.S. businesses

The AI regulatory scene in Colorado, and the broader U.S., makes it difficult for businesses to formulate their own plans when deploying AI systems and models. Some businesses will have to comply with the EU AI Act regardless, and may choose to apply those considerations uniformly across jurisdictions despite similar criticism that the Act is anti-innovation. Others are left weighing the risk of being too slow to innovate versus the risk of making an AI system mission-critical that could be rendered illegal by regulation in the future. The regulation debate aside, businesses still have to contend with the unknown risks associated with AI that could result in contract or tort liability if AI systems are deployed thoughtlessly.

For now, the only certainty is uncertainty.

1. Letter from Jared Polis, Governor, State of Colo., to The Hon. Colo. General Assemb. (May 17, 2024) (on file with Reed Smith, LLP) (signing S.B. 24-2025 with reservations). ↩︎
2. Statement from J. Polis, Governor, State of Colo., P. Weiser, Att’y Gen., State of Colo., and R. Rodriguez, S. Majority Leader, Colo. General Assemb. (June 13, 2024) (on file with Reed Smith, LLP) (addressing “innovators, consumers, and all those interested in the AI space” regarding S.B. 24-2025). ↩︎
3. Staff of H. Comm. on Energy and Commerce, 118^th Cong., Providing for reconciliation pursuant to H. Con. Res. 14, Part 2 – Artificial Intelligence and Information Technology Modernization (Comm. Print 2025). ↩︎