Let’s talk about America’s first real AI law — and why two months in, it has protected almost nobody yet.
There is this moment that happens every day now, in every state in the country. A person applies for an apartment, or a line of credit, or a job. And a machine they never met makes the call. No interview, no appeal, just a score — handed to a stranger who treats it like a fact.
That person has a name and a rent check and a Tuesday. The algorithm has a version number. And until the first of June this year, in the United States, the algorithm had no legal obligation to that person at all.
That changed in Colorado. On the first of June, SB 24-205 went live — the first comprehensive state AI law in the country. If you deploy a high-risk system that makes consequential decisions — hiring, housing, credit, education, healthcare, essential services — you now have a legal duty to use reasonable care so it doesn’t discriminate. You have to run impact assessments. You have to publish a statement about the systems you deploy. And when the machine makes an adverse call, the human on the other side gets a notice. With a reason. And a right to ask again.
It is genuinely the first time in America that the algorithm has to write about itself. That is not nothing. The EU did it at scale, but here, on this side of the Atlantic, it’s a first. And the first is always the one that sets the shape of what comes next.
Now here’s what people are missing.
First: the person the law is for cannot sue. There is no private right of action. The Attorney General enforces — and enforcement is a budget line and a mood. If you get denied by a machine in Colorado and the AG doesn’t pick up your file, your legal protection is a letter you can frame.
Second: the impact assessment is written by the company. The same company that built the system, or bought it, gets to describe why it’s safe. Trade secrets keep the details hidden. The AG can ask for the report. You never get to see it. It’s a school where the fox grades its own homework — and the report card is confidential.
Third, and this is the one that keeps me up: the law reaches decisions made solely on the system’s output. Solely. One human signature in the loop — one overworked person who clicks “approved” in forty seconds — and the whole thing steps out of the law’s reach. The rubber stamp with a pulse. The exact loophole we keep building.
And then the deepest thing. Stand back.
America’s first AI law is about judgment. Whether the machine treats you fairly when it decides your fate. And that matters. But the law says nothing — nothing — about the machine pretending to be human. Nothing about the voice that calls you, cloned from someone you trust. Nothing about the face that never existed, endorsing something you’d never buy. Nothing about the video that can now outlive the truth.
The first law in the United States to regulate artificial intelligence regulates the algorithm’s opinion. It has almost nothing to say about the algorithm’s lies.
That tells you where we are. We built the law for the machine as a judge. We’re still defenseless against the machine as an actor. And the actor is the one coming for us.
So here’s the operator question. If you deploy AI — and you do, even if you don’t call it that — ask yourself what your impact assessment would say if the AG asked for it tomorrow. Would it survive contact with a lawyer who’s looking for the discrimination? The companies that treat the assessment as a chore are going to get eaten. The ones that build for auditability from day one are going to own the next decade of trust.
And for the rest of us, the principle is simpler than any statute. Notice is not consent. An appeal you can file is not power you hold. The human has to be a real party to the decision about them — not a recipient of its paperwork.
Colorado wrote the first draft of that. It’s honest work, and it’s incomplete, and it’s going to be amended and copied and fought over for the next ten years. But it’s the first time the machine had to stop and write about itself before it got to decide you.
Read the notice when it comes. Ask for the appeal. Make them say the reason out loud.
That’s the whole move. You’ve got this.