Colorado extended the effective date of its AI law to 30 June 2026, giving developers and deployers more time to stand up governance, risk, and anti-bias controls. Substantive duties remain.
Why this matters
The extension provides breathing room for compliance programmes, but the law's discrimination risk, impact assessment, and disclosure requirements are unchanged. Organisations should use the time to build evidence pipelines.
Impact on obligations
Provider
Prepare discrimination risk controls and notices. Document bias testing and mitigation measures.
Deployer
Implement anti-bias controls, incident handling policies, and consumer disclosure templates before the June 2026 deadline.
What to evidence
- Bias testing records
- Incident handling policies
- Consumer disclosure templates
Key artefacts explained:
- DSSE: Dead Simple Signing Envelope — portable signature format
- STH: Signed Tree Head — tamper-evident checkpoint in transparency log
- TSA: Time-Stamp Authority — independent timestamp receipt
- WORM: Write Once Read Many — immutable storage for audit trails