The Colorado AI Act has applied since June 30, 2026. If your nonprofit uses AI to help make decisions about people, it applies to you.
This is a plain-language guide, not legal advice. We wrote it for Executive Directors, not lawyers. It explains what the act asks of you, and it tells you honestly where Candela helps and where the work stays on your desk.
Transparency
Tell people when an AI system, not a person, is handling their request or shaping a decision about them. In a nonprofit that often means AI used in hiring, in case management, and in how you route people to services.
Disclosure
Keep a record you can show. If someone asks whether AI touched a decision, you should be able to point to what was used, by whom, and when. A durable log is the difference between a claim and proof of reasonable care.
Impact assessment
For a high-risk AI system, meaning one used to help make a consequential decision about a person, write down the risks and the steps you take to reduce them, and review it periodically. A deployer is any org that uses such a system.
A few terms of art, defined once. A consequential decision is one that materially affects access to things like employment, housing, education, health care, or benefits. A deployer is the organization using the AI system. A high-risk AI system is one that helps make those consequential decisions. Deciding which of your tools fits that last definition is a legal call, and it belongs to you and your counsel.
Some of these Candela handles. Some it does not, and pretending otherwise would not help you. Both kinds of row are here, side by side.
Disclose to consumers when an AI system, not a person, is handling their request or shaping a decision about them.
Candela records a disclosure footer on AI-assisted outputs and tracks disclosed vs undisclosed AI use in the governance disclosure log.
Maintain a durable log of when AI was used, by whom, and on what, so you can show reasonable care if asked.
The §4.8 universal audit trail records who changed what and when across the platform; the governance activity log surfaces AI calls.
Stay ahead of contract, grant report, and federal compliance dates so nothing lapses while you sort out AI governance.
The free Compliance Inbox pulls contract, grant report, and federal compliance deadlines into one sorted view.
Decide in advance what counts as too concentrated or too stale, and have the system flag it, rather than eyeballing it.
Org governance settings let admins set funder over-concentration thresholds and how often dismissed gaps resurface.
When a consequential decision is adverse, give the person the required explanation and a way to correct data or appeal.
Candela does not run consumer-facing adverse-decision notices. You still need a process to explain, correct, and appeal, usually in your existing case or HR system.
Report known risks of algorithmic discrimination to the Attorney General within the statutory window.
Candela does not file with the Attorney General for you. Your organization and counsel prepare and submit any required filing.
Make the legal call about whether a specific AI tool is a high-risk system that triggers the deployer obligations.
This is a legal judgment. Candela gives you the usage records to inform it, but the determination stays with you and a qualified attorney.
If you build or resell an AI hiring tool, meet the separate developer duties the act places on that role.
Candela addresses your deployer duties for AI use inside the platform. Developer-side duties for third-party tools you build or resell are outside its scope.
Create an account and start tracking your contract, grant report, and federal compliance deadlines in one place. See how Candela documents AI use before you decide whether a paid tier earns its keep. No credit card, no sales call required.
Create your free account →Yes. Senate Bill 24-205, the Colorado Artificial Intelligence Act, has been in effect since June 30, 2026. If your organization uses AI to help make decisions about people, the obligations apply to you now, not at some future date.
It can. The act covers deployers, meaning any organization that uses a high-risk AI system to help make a consequential decision about a Colorado resident. A consequential decision is one that affects access to things like employment, housing, education, health care, or essential services. If you use AI to screen job applicants, prioritize a waitlist, or route people to services, read this page carefully. If you only use AI to draft a newsletter, the high-risk rules are unlikely to apply, though the honesty of good disclosure still helps you.
A consequential decision is one that has a material legal or similarly significant effect on a person. In a nonprofit that usually means hiring and staffing decisions, decisions about who gets into a program or service, and decisions that affect someone's benefits or eligibility. Deciding what color to make a flyer is not consequential. Deciding who moves up a housing waitlist is.
Candela gives you a running record of your AI use and your deadlines. The free Compliance Inbox tracks contract, grant report, and federal compliance deadlines in one place. On paid tiers, the governance dashboard adds a disclosure tracker and a review log, an audit trail records who changed what and when, and org governance settings let you set thresholds like funder over-concentration and how often dismissed gaps resurface. These features help you document reasonable care. They do not replace a lawyer.
No, and any tool that claims to is not being honest with you. Candela covers documentation, disclosure, and audit trail for AI use inside the platform. It does not handle consumer notification workflows when an AI-influenced decision goes against someone, it does not file disclosures with the Colorado Attorney General for you, and it cannot make the legal judgment of whether a given system counts as high-risk. Those steps stay with your organization and your counsel.
An impact assessment is a written review of a high-risk AI system: what it does, what data it uses, the risk of unfair outcomes, and the steps you take to reduce that risk. Under the act, deployers of high-risk systems are expected to complete one and review it periodically. Candela's audit trail and disclosure records give you evidence to put inside that assessment. Writing and signing the assessment itself is your organization's responsibility.
Nothing. The Compliance Inbox is part of the free Starter account. No credit card is required. You can create an account, start tracking your deadlines, and see how Candela documents AI use before you decide whether a paid tier is worth it.
No. This is a plain-language summary written for nonprofit leaders, not lawyers. It is not legal advice and it does not create a relationship of any kind. For a decision about whether the Colorado AI Act applies to a specific system in your organization, talk to a qualified attorney and read the statute itself.
This page is a plain-language summary written for nonprofit leaders. It is not legal advice, and reading it does not create an attorney-client relationship. For a decision about whether the Colorado AI Act applies to a specific system in your organization, talk to a qualified attorney and read the statute itself: Colorado Senate Bill 24-205.