Colorado AI Act: does it apply to companies that only supply data?

What is the status of the Colorado AI Act?#

The Colorado AI Act has changed twice since it was signed, so the status question comes before the role question. The original law, Senate Bill 24-205, was signed in May 2024 and never took effect on its first or second start date.

The timeline below reflects the dates reported in the source cited for this article. Because the law has already been delayed once and rewritten once, check the text in force on the day you sign a license, and do not rely on any summary, including this one, as a statement of current law.

Who did the 2024 text regulate?#

The 2024 text regulated developers and deployers of high-risk AI systems doing business in Colorado. A high-risk system was one that makes, or is a substantial factor in making, a consequential decision about a consumer, such as a decision about employment, lending, housing, insurance, education, healthcare, legal services or essential government services.

Developers were those who build or intentionally and substantially modify an AI system. Deployers were those who use a high-risk system. The duties aimed at algorithmic discrimination: developers owed documentation and disclosures to deployers, and deployers owed risk management, impact assessments and notices to the consumers affected.

These definitions still matter in practice even after the 2026 rewrite, because buyers' contract templates, vendor questionnaires and internal policies were drafted around them. Whether the reenacted law keeps the same roles and duties is a question to check against its text with counsel.

Is a data supplier a developer or a deployer?#

A data supplier is usually neither a developer nor a deployer when it only licenses historical records to a company that builds models. Supplying training material is not building or modifying an AI system, and the supplier does not use the resulting system to make decisions about anyone.

The answer can change with what the company actually does. The table sorts common activities by likely role under the 2024 framework; activities near a line are questions for counsel.

Where can a supplier still be pulled in?#

A supplier can still be pulled in through contracts even when the act does not reach it directly. Under the 2024 text, a developer of a high-risk system owed documentation to deployers that could extend to the data used for training, so it may ask suppliers for facts about where records came from, which periods they cover and what limitations they have.

The second route is the supplier's own operations. A company that uses an AI screening tool in hiring may be a deployer for that use regardless of any data license. That is a separate compliance question from licensing.

Other laws also stay in play. The Colorado Privacy Act and other state privacy laws may apply to personal data in the records, and they are assessed on their own terms, deal by deal. The Colorado Attorney General describes the Privacy Act as covering residents acting in an individual or household context, not in a commercial or employment context, which affects how it applies to business records.

• 1Provenance: which systems produced the records and over what period.
• 2Collection context: how records were created and under what notices.
• 3Known gaps and limitations: missing periods, regions or record types.
• 4Privacy treatment: what was removed and how.
• 5Intended and excluded uses agreed in the license.

Illustrative: a property management software company draws a line#

Illustrative: a fictional maker of property management software holds years of Zendesk tickets, maintenance work orders and Jira issues from its customers' support requests. A model developer asks to license the support and maintenance history, then later asks for rental application records with approve or deny outcomes to train a tenant screening model.

The general counsel treats the two requests differently. Support tickets and work orders, prepared to remove names, addresses and unit details, stay a plain supplier transaction. The application records are declined: they center on applicant personal data, the company's customer contracts limit their reuse, and their stated purpose is a housing decision of the kind the 2024 text treated as high-risk.

The signed license covers support and maintenance records only. It excludes use in decisions about individual consumers, assigns any developer or deployer duties to the buyer and includes a change-in-law clause. The company provides a short provenance summary and a description of what was removed, nothing more.

What should a supplier put in the license?#

A supplier's license should allocate AI-law responsibility to the party that builds and uses the system. The clauses below are common supplier-friendly positions; the right mix depends on the records and the buyer's intended use.

How to answer a buyer's AI-law questionnaire#

A buyer's AI-law questionnaire is best answered with facts about the records, not with legal conclusions about the buyer's system. Suppliers are often sent long compliance forms written for software vendors, and some questions assume a role the supplier does not have.

Answer what you know from your own systems and preparation work, mark questions about model behavior as outside your role, and route any request for a warranty or certification to counsel before replying.

• 1Describe the source systems, record families and date coverage.
• 2State what personal and confidential details were removed, and how.
• 3Name known gaps, such as lost periods after a system migration.
• 4Decline to certify the fairness or accuracy of a model you did not build.
• 5Keep every answer consistent with the license and its documentation.

How SourceX approaches state AI laws#

SourceX checks state AI laws during the Rights step of the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. Whether a law such as the Colorado AI Act may apply is assessed deal by deal with counsel, based on the records, the buyer's intended use and the law in force at signing.

Excluded high-risk uses are written into the permitted-use entry of the SourceX Evidence Packet. Its provenance and privacy record entries give a buyer the facts it may need for its own compliance work, without the supplier taking on the buyer's role.