EU AI Act vs Colorado AI Act: What US Companies Selling into Europe Must Know

If you are a US company selling AI into Europe, the EU AI Act is now by far the heavier law to plan around. Colorado's original AI Act was the closest US equivalent, but in May 2026 Colorado repealed it and replaced it with a lighter, disclosure-based law (SB 26-189) that takes effect on 1 January 2027. Build your compliance programme to the EU standard and you will cover most of Colorado. The few Colorado-specific extras are worth knowing, because they sit in places the EU law doesn't reach.

This guide compares the two laws as they stand in late October 2026. It covers who each applies to, what each requires, how they treat hiring, lending, insurance and healthcare decisions, and how to build one programme that satisfies both.

First, the Colorado AI Act you may have read about no longer exists

Much of what is online about the "Colorado AI Act" describes SB 24-205, the 2024 law that borrowed heavily from the EU model. It imposed a duty of care against algorithmic discrimination, risk management programmes and impact assessments. Its start date was pushed from 1 February 2026 to 30 June 2026, and it never took effect.

In May 2026, the Colorado legislature passed SB 26-189 by 34–1 in the Senate and 57–6 in the House, and Governor Jared Polis signed it on 14 May. It repealed SB 24-205 and replaced it with a narrower framework built around notices, explanations and human review.

EU AI Act vs Colorado AI law at a glance

Does each law apply to your US company?

The EU AI Act reaches far beyond Europe

Under Article 2, the AI Act applies to providers that place AI systems on the EU market or put them into service there, wherever the provider is based. It also applies to providers and deployers outside the EU when the AI system's output is used in the EU. A US hiring platform screening candidates for a German employer is in scope, even if every server sits in Virginia.

Non-EU providers of high-risk systems must also appoint an authorised representative established in the EU, in writing, before placing the system on the market.

Colorado follows the consumer

Colorado's law applies to developers and deployers of covered ADMT used for consequential decisions about Colorado consumers. "Consumer" is defined more broadly than in the Colorado Privacy Act. It includes Colorado employees and job applicants, so HR technology vendors are firmly in scope.

Where the two laws overlap: the same high-stakes decisions

The laws use different words but target almost the same decisions. Colorado lists seven consequential-decision domains. The EU's Annex III high-risk list covers nearly all of them, plus areas Colorado leaves out.

Housing is the notable gap. An AI tenant-screening tool may fall outside the EU's high-risk list but squarely inside Colorado's law, so don't assume EU classification settles your Colorado position.

What each law requires you to do

Under the EU AI Act (high-risk systems)

• A risk management system across the whole AI lifecycle
• Data governance for training, validation and test data
• Technical documentation and automatic logging
• Instructions for use for deployers
• Human oversight designed into the system
• Accuracy, robustness and cybersecurity measures
• A quality management system, conformity assessment, CE marking and EU database registration
• Post-market monitoring and serious-incident reporting

Under Colorado SB 26-189

Developers must give deployers a statement of intended and harmful uses, training data categories, known limitations and instructions for use. They must notify deployers of material modifications and keep records for at least three years. Trade secrets need not be disclosed.

Deployers must:

1. Give notice before use

   Tell consumers clearly that covered ADMT will be used in a consequential decision, with a way to get more information. A prominent public notice at points of interaction can satisfy this.

2. Explain adverse outcomes within 30 days

   Provide a plain-language explanation of the decision and the ADMT's role, and tell the person how to request more information.

3. Offer data access, correction and human review

   Let people request their personal data, correct inaccuracies, and seek meaningful human review and reconsideration where commercially reasonable.

4. Make notices accessible

   Notices must work for people with disabilities and limited English proficiency.

5. Keep records for three years

   Retain records for at least three years from the date of the decision.

Enforcement and liability: very different risks

The EU's numbers are larger and apply per company: up to €35 million or 7% of global turnover for prohibited practices, and up to €15 million or 3% for most other breaches. Colorado's Attorney General enforces SB 26-189 exclusively, under a consumer protection statute where civil penalties reach $20,000 per violation, or $50,000 where an older adult is affected. Because penalties are counted per violation, a system making thousands of decisions can add up quickly.

Colorado's sharper edge is liability. SB 26-189 confirms that developers and deployers can both be liable under state anti-discrimination laws for decisions materially influenced by covered ADMT. Fault is allocated by each party's share rather than jointly, and developer liability applies where the technology was used as intended or marketed.

The federal wildcard

On 11 December 2025, President Trump signed an executive order titled "Ensuring a National Policy Framework for Artificial Intelligence". It directed the Justice Department to set up an AI Litigation Task Force to challenge state AI laws, and it named Colorado's original act as an example of excessive state regulation. Legal commentators note that an executive order cannot itself preempt state law, and Congress has not passed a preemption statute.

In April 2026, xAI sued Colorado's Attorney General in federal court to block the original act, and the Justice Department joined the case with equal protection claims. That suit targeted SB 24-205, which has since been repealed. How it applies to the replacement law was not clear from public reports at the time of writing.

The timeline you are working to

• 2 Feb 2025

  EU: prohibited AI practices and AI literacy duties apply.

• 2 Aug 2025

  EU: general-purpose AI model obligations apply.

• 14 May 2026

  Colorado: SB 26-189 signed, repealing SB 24-205.

• 2 Aug 2026

  EU: transparency duties under Article 50 and AI Act penalties apply.

• 26 Oct 2026

  Colorado: public comments due on the Attorney General's draft implementing rules.

• 1 Jan 2027

  Colorado: SB 26-189 and its implementing rules take effect.

• 2 Dec 2027

  EU: obligations for Annex III high-risk systems, such as hiring, credit and education, apply.

• 2 Aug 2028

  EU: obligations for high-risk AI in regulated products apply.

How to comply with both: build once, localise twice

1. Classify every AI system under both laws

   For each system, record the EU risk tier and whether it materially influences a Colorado consequential decision. Flag housing tools separately.

2. Confirm your role in each market

   Provider or deployer in the EU; developer or deployer in Colorado. Many US vendors are providers and developers. Appoint an EU authorised representative if you supply high-risk systems.

3. Write one model fact sheet

   Combine EU instructions for use with Colorado's developer statement: intended and harmful uses, training data categories, limitations, oversight instructions. Give it to every customer.

4. Build the adverse-decision workflow

   A template explanation, a request channel, a correction process and a human review queue, with a 30-day clock for Colorado. The same workflow supports the EU right to explanation.

5. Keep governance evidence even where Colorado dropped it

   Colorado no longer requires impact assessments, but discrimination claims remain possible. Bias testing and documented risk management are your best defence, and the EU requires them anyway.

6. Fix your contracts

   Allocate responsibilities clearly between developer and deployer, remove indemnities Colorado will void, and require customers to use the system as intended.

Common mistakes to avoid

• Citing the repealed SB 24-205 or its 30 June 2026 date
• Assuming the NIST AI RMF still gives a Colorado safe harbour
• Assuming US-only hosting keeps you out of the EU AI Act
• Treating EU classification as the answer for Colorado housing tools
• Waiting for federal preemption to make state compliance unnecessary

A prompt to map one AI product against both laws

Paste in a description of your product to get a first-pass map of your obligations in both jurisdictions. Treat the output as a draft for your counsel, not legal advice.

You are an AI regulatory analyst covering the EU AI Act (Regulation
(EU) 2024/1689, as amended by the Digital Omnibus on AI) and Colorado
SB 26-189 (effective 1 January 2027, replacing SB 24-205).

Our product:
[what it does, who buys it, who it makes decisions about, which
decisions it influences, where customers and affected people are,
whether we build, customise or only resell the AI]

Produce:
1. EU AI Act: our role (provider, deployer, other), the risk tier
   with the Annex III area if high-risk, and whether we need an EU
   authorised representative.
2. Colorado: whether the product is covered ADMT, which of the seven
   consequential-decision domains it touches, and whether we are a
   developer, deployer or both.
3. A side-by-side table of our obligations under each law, marking
   which ones one piece of work can satisfy for both.
4. The Colorado-only items we must add (notices, 30-day adverse
   outcome explanation, data correction, human review, 3-year
   records, contract changes).
5. Every fact you needed but I did not provide, marked UNKNOWN.

Use only the facts I give you. Do not assume a jurisdiction applies
without a stated reason.

Colorado got lighter. Europe didn't. If you sell AI on both sides of the Atlantic, the EU sets your floor and Colorado adds a few rooms on top. — Kumail Mehdi

Frequently asked questions

Sources

• Regulation (EU) 2024/1689 — the EU AI Act (EUR-Lex)
• Seyfarth — Colorado enacts artificial intelligence replacement law
• Troutman Pepper — Colorado legislature passes bill to repeal and replace the AI Act
• Morrison Foerster — Colorado's new AI rules
• Colorado Attorney General — Consumer Protection Act penalty increases (HB19-1289)
• Clark Hill — What Trump's AI executive order means for Colorado's AI Act
• Barnes & Thornburg — DOJ intervenes in lawsuit challenging Colorado's AI law
• Gibson Dunn — EU AI Act Omnibus agreement