AI Act vs Colorado AI Act: what they share and how they differ
AI Act and Colorado AI Act share 10 of 24 control themes and 8 checks. 75% of Colorado AI Act requirements can be proven with checks AI Act already uses, 21% the other way round.
Phasing in
AI Act
How to make an AI system compliant with the EU AI Act
33 requirementsNext Aug 2, 2027
In force
Colorado AI Act
How to comply with the Colorado AI Act (SB 24-205)
8 requirementsNext —
10/24shared control themes
8shared checks
75%of Colorado AI Act requirements covered by AI Act evidence
21%of AI Act requirements covered by Colorado AI Act evidence
At a glance
| AI Act | Colorado AI Act | |
|---|---|---|
| Jurisdiction | European Union | Colorado |
| Kind | Regulation | Statute |
| Status | Phasing in | In force |
| Binding | Yes same | Yes same |
| Object analysed | AI system | Automated decision |
| Scope | Providers, deployers, importers and distributors of AI systems; providers of GPAI models. | Developers and deployers of high-risk AI systems doing business in Colorado. |
| Territorial reach | Extraterritorial: applies when the system is placed on the EU market or its output is used in the EU. | Doing business in Colorado, decisions about residents. |
| Penalties | Up to €35M or 7% of worldwide turnover (prohibited practices); €15M or 3% (other obligations); €7.5M or 1% (incorrect information). | Unfair trade practice; Attorney General enforcement only. Affirmative defence when aligned with NIST AI RMF or ISO 42001. |
| Qualification axes | AI Act risk level, Organisation role, General-purpose model | High-risk system (consequential decision) |
| Roles | Provider, Deployer, GPAI provider | Developer, Deployer |
| Requirements | 33 | 8 |
| Next milestone | Aug 2, 2027, Annex I high risk (regulated products); GPAI placed on the market before Aug 2025 | — |
Theme by theme
requirements per theme
AI ActColorado AI Act
Governance
Assessment
Build
People & use
Lifecycle & third parties
What they share: one piece of evidence, two frameworks
8
| Code | Check | Requirements AI Act | Requirements Colorado AI Act |
|---|---|---|---|
| VER-003-01 | Documented and up-to-date risk register | ||
| VER-003-02 | Residual risks communicated to deployers | ||
| VER-004-01 | Documented data governance (collection process, bias, quality) | ||
| VER-007-01 | Instructions for use complete and compliant with Art. 13 | ||
| VER-013-F-04 | Communication to market surveillance authorities in the event of risk | ||
| VER-018-D-01 | Persons informed of the interaction with an AI system | ||
| VER-029-D-01 | Affected persons informed of the use of the AI system | ||
| VER-033-D-01 | Decision explanation procedure documented |
Differences: requirements specific to each framework
Requirements with no check serving the other framework: the extra work.
AI Act
26
EX-001
AI literacy Art. 4
EX-002
Prohibited practices Art. 5
EX-005
Technical documentation Art. 11 + Annexe IV
EX-006
Record-keeping / logging Art. 12
EX-008
Human oversight Art. 14
EX-009
EX-010
QMS Art. 17
EX-011
10-year retention Art. 18
EX-012
Automatically generated logs Art. 19
EX-014
Cooperation with authorities Art. 21 + Art. 26§12
EX-015
EU declaration of conformity Art. 47
EX-016
CE marking Art. 48
EX-017
EU database registration Art. 49
EX-019
DPIA Art. 26§9
EX-020
FRIA Art. 27
EX-021
Post-market monitoring Art. 72
EX-022
Serious incident reporting Art. 73
EX-023
Accessibility Art. 16(l)
EX-024
Conformity assessment Art. 43
EX-025
EX-026
Value chain Art. 25
EX-027
Compliant use Art. 26§1
EX-028
Input data Art. 26§4
EX-030
Information to workers' representatives Art. 26§7
EX-031
GPAI obligations Art. 53
EX-032
Colorado AI Act
2
CO-03
Public statement of high-risk systems §6-1-1702(4)
CO-06
Annual impact assessment and on each modification §6-1-1703(3)
Timelines
PastSet in the textPotentialTo verify
Apr 21, 2021AI Act · Commission proposal
May 17, 2024Colorado AI Act · Signed into law
Jul 12, 2024AI Act · Published in the Official Journal
Aug 1, 2024AI Act · Entry into force
Feb 2, 2025AI Act · Prohibited practices (Art. 5) and AI literacy (Art. 4)
Jul 10, 2025AI Act · GPAI Code of Practice published
Aug 2, 2025AI Act · GPAI obligations, governance, penalties, notified bodies
Aug 28, 2025Colorado AI Act · SB 25B-004: delay to 30 June 2026
Nov 19, 2025AI Act · Digital Omnibus proposal: high-risk delay tied to standards
Jun 30, 2026Colorado AI Act · Effective date (2026 session amendments to verify)
Aug 2, 2026AI Act · General application: Art. 50, sandboxes, Annex III high risk (unless Omnibus delay)
Aug 2, 2027AI Act · Annex I high risk (regulated products); GPAI placed on the market before Aug 2025
Dec 2, 2027AI Act · Omnibus backstop for Annex III high risk
Aug 2, 2028AI Act · Omnibus backstop for Annex I high risk
Aug 2, 2030AI Act · High-risk systems of public authorities already in service (Art. 111)
Run these requirements across all your AI systems
TrustFlow inventories your systems, qualifies them under each regulation and collects evidence once for every referential.