Colorado passed the first comprehensive US state AI law. Operators in travel and health need to read it.
Colorado signed Senate Bill 205 into law in May 2024, producing the first comprehensive U.S. state-level AI legislation. The bill is risk-tiered, covers high-risk AI systems across employment, housing, financial-services, and healthcare contexts, and creates a regulatory framework that adjacent states are likely to follow as their own legislative cycles produce comparable legislation. The legislation begins binding deployment requirements through 2026.
For operators in travel and healthcare categories, the legislation matters in three specific ways.
The first is the high-risk-AI-systems classification. The bill defines high-risk systems as AI tools that make consequential decisions in the covered categories, with the consequence that AI deployments in healthcare-class contexts (clinical-decision-support, claim-routing, prior-authorization, patient-engagement-class systems that affect care decisions) are explicitly within scope. Operators deploying AI in these contexts in Colorado need to engage with the bill's compliance requirements, including impact-assessment work, deployer-and-developer documentation, and consumer-facing transparency requirements.
The second is the patchwork-strategy implication. The Colorado law is the first comprehensive state-level legislation; it is unlikely to be the last. Other states (California, New York, Connecticut, Oregon) have legislation in various stages of development that follows similar risk-tiered framings. Operators in regulated sectors need to plan against a state-by-state patchwork that will, over the next 24-36 months, produce overlapping-and-divergent compliance requirements. The patchwork-strategy work includes building flexible compliance infrastructure that can accommodate multiple state-level frameworks rather than building against a single state's specific requirements.
The third is the federal-pre-emption uncertainty. The state-level legislation is being developed in the context of an uncertain federal regulatory trajectory. The Trump administration's deregulatory posture at the federal level reduces the likelihood that comprehensive federal legislation will pre-empt the state-level frameworks in the near term. Operators planning their compliance posture against the assumption that federal legislation will simplify the patchwork are planning against a scenario that is unlikely to materialize on the relevant timeline. The state-level patchwork is the binding regulatory framework for the foreseeable horizon, and operators should plan accordingly.
The Colorado legislation also surfaces a structural question for the broader operator class. The state-level AI legislation is being developed in a relatively uncoordinated way, with each state's framework reflecting that state's specific political-and-regulatory environment. The cumulative compliance-burden for operators serving multi-state populations will be substantial, with the consequence that the state-level patchwork produces operational friction that the federal-level framework would have reduced.
For travel and healthcare operators reading the Colorado legislation through 2024-2026, the practical advice is to engage with the bill's specific requirements for the Colorado-population deployments and to build the broader patchwork-strategy infrastructure that supports the multi-state compliance work. The patchwork is not going away. The patchwork is going to grow. The operators who build the infrastructure to handle it will produce more durable compliance positions than the operators who treat each state's legislation as a one-off compliance project.
Colorado is the first comprehensive state-level AI law. The next several states will follow on their own timelines. The durable read should be that the state-level patchwork is the binding regulatory framework for the next several years, with the federal framework being a future possibility rather than a current constraint. Build the patchwork-strategy infrastructure now. The operational consequences of not building it will compound across each subsequent state-level framework that the next 24-36 months produces.
—TJ