Three States, Three Playbooks: How Colorado, Utah and California Now Regulate AI

US states are regulating artificial intelligence through three genuinely different legal strategies, and multi-state businesses can no longer treat compliance as a single checklist. Colorado's revised AI Act targets algorithmic discrimination in high-risk automated decision-making; Utah's framework centers on transparency, requiring businesses in regulated professions to tell consumers when they are interacting with AI; and California has moved through new regulations under the California Consumer Privacy Act governing automated decision-making technology used to make "significant decisions" about consumers. This article compares what each regime actually requires, where their obligations diverge, and what those differences mean operationally for companies and professionals.

The Fragmented Landscape of US State AI Laws

There is no comprehensive federal AI statute governing how businesses deploy the technology, so states are legislating independently — and they are not legislating consistently. Law firm Bryan Cave Leighton Paisner, which tracks proposed and enacted AI bills across the United States, describes the result as an "uncertain regulatory environment that must be closely monitored and evaluated" for its impact on both risk and the commercial viability of proposed use cases. The practical consequence is that a company's obligations can change with the state line it crosses.

Analysis published in Communications of the ACM frames the problem from the stakeholder side: variation across jurisdictions "adds complexity for all stakeholders, from technology firms to consumers, who must navigate an increasingly complex regulatory landscape." The article points to New York City's independent legislation on AI-driven hiring as evidence that fragmentation extends below the state level, compounding compliance work for companies operating across multiple jurisdictions. Even professional practice is affected: the American Psychological Association notes that some state laws restrict licensed mental health professionals from using AI-powered clinical tools, such as programs that flag patients at increased risk of self-harm, and observes that "the rules vary from state to state, and it's not yet clear how state licensing boards will regulate and manage the fallout from these laws."

Colorado's Revised AI Act: Focus on Algorithmic Discrimination

Colorado's SB24-205 — the Consumer Protections for Artificial Intelligence Act, passed with an effective date of May 17, 2024, according to the Colorado General Assembly's session-law record — became the first state law to regulate the use of AI in making consequential decisions about individuals, as reported by the law firm Davis+Gilbert in May 2024. But the law did not stay in its original form. Colorado has since repealed its original AI Act and replaced it with a revised framework centered on automated decision-making technology, according to compliance firm OneTrust.

Legal analysis from Norton Rose Fulbright details what changed. The revised act does not carry over all standards from the original: it removes the general duty of care to mitigate algorithmic discrimination risks and drops the requirements to perform annual impact assessments and maintain a risk management program. What remains is a framework imposing separate requirements on developers and deployers of covered automated decision-making technologies, with deployers of high-risk systems expected to exercise reasonable care to avoid algorithmic discrimination and to give consumers descriptions when adverse outcomes occur. Certain financial entities — banks and credit unions among them — are exempt where they are subject to state or federal prudential regulator guidance meeting specified criteria. For compliance teams, the revision meaningfully narrowed the assessment burden, but the substantive exposure around high-risk decision systems remains.

Utah's Approach to AI Transparency and Generative AI

Utah chose disclosure over the Colorado model of substantive risk regulation. According to law firm Cooley's April 2026 status review of state AI laws, Utah's law introduced targeted disclosure requirements, including a mandate that businesses in regulated professions proactively disclose when consumers are interacting with AI. The framework also reaches generative AI more specifically, requiring a high-level summary of the datasets used in developing generative AI systems.

Utah's experience is also a cautionary tale about implementation. Cooley reports that the state narrowed the framework through multiple bills in 2025, a reflection of early implementation concerns raised by state legislators and industry stakeholders. That rollback matters for two reasons. First, it signals that even enacted AI law can be materially reworked within a single legislative session, so businesses cannot assume a statute's first text is its final text. Second, it distinguishes Utah's approach from Colorado's: Utah regulates the point of consumer contact — who or what the consumer is dealing with, and how generative systems were built — rather than the fairness of the decisions the systems produce.

Comparative Overview of Key State AI Laws

The table below juxtaposes the three regimes on the dimensions compliance teams most often triage first: scope, core obligations, and timing. Use it to locate which regime a given AI deployment falls under — a generative chatbot serving regulated-profession clients points toward Utah, a high-risk decision system points toward Colorado, and consumer-facing automated decision-making at scale points toward California.

Comparison of enacted AI frameworks in Colorado, Utah and California
State	Law / Framework	Scope	Key Compliance Requirements	Status & Timing Notes
Colorado	SB24-205, Consumer Protections for Artificial Intelligence (revised framework)	High-risk AI systems and automated decision-making technology; algorithmic discrimination	Deployers must exercise reasonable care to avoid algorithmic discrimination and provide consumers descriptions of adverse outcomes; separate requirements for developers and deployers	Session-law effective date May 17, 2024; original act repealed and replaced, removing annual impact assessments, the duty of care to mitigate discrimination risks, and the mandated risk management program
Utah	State AI transparency framework	Businesses in regulated professions; generative AI development	Proactive disclosure when consumers interact with AI; high-level summary of datasets used in generative AI development	Framework narrowed through multiple bills in 2025 amid early implementation concerns raised by legislators and industry
California	CCPA automated decision-making technology (ADMT) regulations	Businesses using ADMT to make "significant decisions" about consumers	New compliance obligations for businesses using ADMT in significant consumer decisions, following a lengthy rulemaking process	Regulations enacted in 2025 under the CCPA; diverge from Colorado's revised act in several key ways despite a shared goal of regulating automated decision-making

Read side by side, the table shows why no single compliance program fits all three states. The same product can trigger entirely different duties depending on where the user sits: Colorado asks whether a high-risk system produces discriminatory outcomes; Utah asks whether the consumer knows AI is involved; California asks whether the automated decision is "significant" under privacy-law definitions. Norton Rose Fulbright notes that although the revised Colorado act and the California ADMT regulations share the goal of regulating automated decision-making, "they diverge in several key ways" — a divergence businesses must resolve system by system, not statute by statute.

Navigating Multi-State Compliance Challenges

The first challenge is definitional. "AI," "high-risk" and "automated decision-making" are not defined identically across these frameworks, so the threshold question — is this system even covered? — can produce different answers in Denver, Salt Lake City and Sacramento for the same product. A tool that is "high-risk" under Colorado's framework may fall outside Utah's disclosure mandate if the user is not a regulated professional, yet still be an ADMT making a "significant decision" under California's privacy regulations.

The second challenge is conflicting disclosure design. Utah requires proactive disclosure of AI interaction; Colorado requires descriptions of adverse outcomes; California's regulations layer obligations onto significant-decision processes. Each demands different user-facing language, timing and delivery channels, so a single interface cannot satisfy all regimes with one generic disclaimer.

The third challenge is assessment standards. Colorado's revision removed annual impact assessments and the mandated risk management program — obligations that still exist in spirit elsewhere, such as through California's significant-decision rules — so teams cannot standardize on the most demanding standard and declare compliance everywhere. As the Communications of the ACM analysis observes, variation across hundreds of state bills, plus city-level laws like New York City's hiring rules, "adds complexity for all stakeholders." The American Psychological Association's account of state rules restricting clinical AI tools illustrates the sharpest edge of this fragmentation: uneven consumer and professional protections across state lines.

Navigating the Patchwork: Strategic Compliance for Multi-State AI Operations

Businesses deploying AI across multiple US states must adopt a proactive and adaptive compliance strategy, prioritizing a comprehensive understanding of each state's specific requirements and potential conflicts. Colorado's 2025 revision of its own recently enacted act is the clearest evidence that enactment is not the end of the story: Utah narrowed its framework the same year, and California's ADMT obligations emerged from a "lengthy and closely watched rulemaking process" that reshaped expectations after the underlying privacy law was already in force.

In practice, that strategy means mapping each AI deployment against the three regimes' distinct triggers — high-risk decision systems for Colorado, regulated-profession consumer contact and generative AI for Utah, significant consumer decisions for California — rather than assuming the strictest single standard covers the others. The measurable indicator of a working program is regular monitoring of state legislative updates and guidance from state Attorney Generals' offices. The APA's own guidance to psychologists points the same direction: engage with the evolving legal landscape in your state rather than waiting for clarity to arrive. Given that two pioneering states materially rewrote their AI frameworks within roughly a year of passage, the next legislative session — not the current statute book — is where a multi-state compliance posture will be decided.

Three States, Three Playbooks: How Colorado, Utah and California Now Regulate AI

The Fragmented Landscape of US State AI Laws

Colorado's Revised AI Act: Focus on Algorithmic Discrimination

Utah's Approach to AI Transparency and Generative AI

Comparative Overview of Key State AI Laws

Navigating Multi-State Compliance Challenges

Navigating the Patchwork: Strategic Compliance for Multi-State AI Operations

Sources

Tags

Related articles

Agentic AI Is a New Computational Paradigm, Not a Smarter Chatbot: Where It Breaks Computer Science's Old Abstractions

Pruning vs. Quantization vs. Distillation: How to Pick the Right Compression Technique for Your Edge AI Project

AI Alignment, Explained Through the RICE Framework: Robustness, Interpretability, Controllability, and Ethicality

Explainable AI: The Four Principles That Turn Black Boxes Into Accountable Systems