The Colorado AI Act Has a Small Business Exemption — Does Your Firm Qualify?

Here's the test.

---

What Most Coverage Gets Wrong About Colorado's AI Law

General trade coverage treats Colorado's Consumer Protections for Artificial Intelligence Act (CPAIA, also called CAIA) as a blanket business obligation. The headlines focus on penalty exposure and compliance checklists aimed at enterprise deployers. Even some compliance-focused coverage has understated or omitted the small business exemption entirely.

The result: owners of 5-30 person professional services firms have been reading about $20,000 stacking penalties and impact assessments, concluding that they need to build compliance programs they may not actually need — while still missing the lighter obligations that do apply to them.

The Colorado small business exemption doesn't eliminate your obligations. But it dramatically reduces them. And understanding exactly what it covers — and what it doesn't — is more useful than a generic compliance checklist written for firms ten times your size.

---

The Small Business Deployer Exemption: What It Is

Under CAIA, businesses that interact with AI-powered systems fall into two categories: developers (who build and train AI systems) and deployers (who use AI systems to make or inform decisions about people). Most professional services firms — accounting, legal, consulting, staffing, marketing — are deployers, not developers. You're using tools built by others, not building your own models.

The small business deployer exemption applies to firms with fewer than 50 full-time employees throughout the period they're using a high-risk AI system. If your firm meets that threshold and satisfies three conditions, you're exempt from the most burdensome CAIA requirements.

---

The Three Conditions You Must Meet

The exemption isn't automatic. Three conditions apply. All three must be satisfied.

Condition 1: Fewer than 50 full-time employees

This is a headcount test based on full-time equivalents, not just job titles. Part-time employees count proportionally. The threshold applies throughout the period you're deploying the high-risk AI system — not just on June 30, 2026. If you're at 47 FTEs now and expect to grow, monitor that number.

For most 5-30 person firms, this condition is straightforwardly satisfied.

Condition 2: You have not used your own data to train or substantially customize the AI system

This is the condition most firms misread. Using AI with client documents is not the same as training AI on client data.

• Running a client contract through Claude for analysis: not training
• Uploading financial statements to Thomson Reuters Ready to Review: not training
• Using CoCounsel to research case law with client facts: not training
• Working with a vendor to fine-tune a model on your proprietary billing history, client intake data, or internal knowledge base to change the model's behavior: that's training

Standard prompting — even detailed, sophisticated system prompts — does not constitute custom training. What matters is whether you have taken steps to modify the underlying model's behavior using your own data. Most small professional services firms have not.

Condition 3: You are using the AI system within its intended purpose

This means using the tool as the vendor designed it. Using Claude to draft, research, summarize, and analyze. Using Clio AI for matter management and document review. Using a staffing ATS's built-in AI screening features as the vendor built them.

What it does not mean: building a custom decision engine that materially changes how the tool behaves, or using a general-purpose AI tool to make high-stakes automated decisions the vendor didn't design it for.

If you meet all three conditions, you're exempt from the most burdensome CAIA obligations — publishing a website statement disclosing high-risk AI use, conducting your own annual impact assessments, implementing a written risk management policy, and most consumer disclosure obligations before a consequential decision is made.

---

What You Still Have to Do Even If You Qualify for the Exemption

The small business exemption is not a blanket pass. Two obligations remain:

Post-decision adverse notice. If your firm uses a high-risk AI system and that AI contributes to an adverse consequential decision affecting a Colorado consumer — a candidate who isn't placed, a client who is declined for a service — you must notify that person after the fact. This is a lighter disclosure than the pre-decision disclosure full deployers must make, but it is real.

Practical example: An accounting firm that uses an AI tool to help assess client creditworthiness for referral decisions must notify a Colorado client if the AI-assisted assessment led to an adverse outcome.

Developer impact assessment access. If a Colorado consumer asks for the impact assessment related to the AI system used to make a decision about them, you must be able to provide it. You don't have to create one yourself — you need to have obtained it from your AI vendor and be able to produce it.

These are lighter obligations than the full compliance stack. But they are still obligations. "Small business exemption" does not mean "no obligations."

---

Does Your Firm Qualify? A 3-Question Test

Use this framework to assess your firm's status under CAIA. This is not legal advice — but it's the right starting point before engaging counsel.

---

Question 1: Does your firm have fewer than 50 full-time employees?

If yes → continue to Question 2. If no → full CAIA obligations apply. See our AI compliance deadline guide.

---

Question 2: Does your firm use off-the-shelf AI tools — such as Claude, ChatGPT, CoCounsel, Thomson Reuters AI, or Clio AI — without training those tools on your own proprietary data?

If yes → continue to Question 3. If no → full CAIA obligations likely apply. The threshold is whether you've done custom training or substantial customization, not whether you use client data as input.

---

Question 3: Are you using those AI tools within their intended scope — drafting, research, document review, scheduling, analysis — rather than building custom decision engines?

If yes → your firm likely qualifies for the small business deployer exemption under CAIA.

If no → review with counsel whether your custom use case puts you outside the exemption.

---

If you answered yes to all three: you are likely exempt from the most burdensome CAIA requirements, but you still have two obligations (post-decision notice and impact assessment access). See the action steps below.

---

Which Professional Services Firms Are Most Likely to Qualify

Most small professional services firms using commercial AI tools qualify. Here are concrete examples:

• 15-person accounting firm using Claude and Thomson Reuters Ready to Review for client advisory work → likely exempt. No custom training; using tools as designed.
• 30-person staffing firm using Bullhorn with standard AI screening features → likely exempt. Verify whether Bullhorn's AI screening tools meet the "high-risk AI system" threshold for consequential employment decisions — if they do, the exemption applies only if you haven't customized the screening logic.
• 12-person law firm using Clio Work and Microsoft Copilot for document drafting → likely exempt. These are standard productivity applications used within intended scope.
• 8-person consulting firm using ChatGPT for research and proposal drafting → likely exempt. General productivity use, no custom training.
• 20-person marketing agency using AI for content generation and SEO analysis → likely exempt, particularly because content creation doesn't typically meet the "consequential decision" threshold that triggers high-risk classification.

---

Which Firms Don't Qualify

The exemption does not apply if:

• Your firm has 50 or more FTEs. Full-time equivalents, not just job titles. Check your actual headcount against the threshold.
• Your firm has done custom training or fine-tuning on proprietary data. This applies to firms that have worked with vendors to build AI models trained on their own client data, billing history, or intake records to change how the model performs.
• Your firm has built workflows that materially change the AI model's base behavior. Standard system prompts do not qualify. Custom AI implementations designed to produce outputs the vendor didn't build the model for may.
• Note: Adding a custom system prompt, using the API instead of the chat interface, or integrating an AI tool via a third-party connector does not by itself disqualify you. The question is model behavior modification, not deployment method.

---

What to Do Now

Three steps, in priority order:

1. Confirm your FTE count. Count full-time equivalents — not just headcount. If you're at 45 and expecting growth before June 30, flag this now.

2. Audit your AI tool stack for custom training. For each AI tool your firm uses that touches consequential decisions (hiring, client assessment, financial analysis), confirm in writing with your vendor: have we done any fine-tuning, custom training, or substantial customization of the underlying model? Most small firms will find the answer is no. Get it in writing anyway.

3. Obtain developer impact assessments for high-risk tools. Contact the vendors of any AI tools that qualify as high-risk systems and request their impact assessment documentation. You don't have to publish it — but you need to be able to produce it if a Colorado consumer asks. Most major AI vendors (Anthropic, Microsoft, Thomson Reuters, Clio) have this documentation available.

One addition: review your engagement letters and service agreements. Even with the small business exemption, you should have language that acknowledges AI tool use in your practice. This is separate from the CAIA requirement — it's client relationship management and, increasingly, professional responsibility.

---

A Note on Illinois: The Law With No Exemption

The contrast with Illinois matters, because our previous coverage of the compliance deadline hub noted "no small-firm exemption" in a way that applied to both Colorado and Illinois. That was accurate for Illinois — but not for Colorado.

Illinois HB 3773 (effective January 1, 2026) requires employers to notify job applicants and employees when AI is used to make or influence employment decisions. It has no small-firm exemption. Every employer in Illinois subject to the law must comply, regardless of size.

If your firm places candidates in Illinois using any AI screening tool — even as a small firm, even with off-the-shelf tools — you have Illinois disclosure obligations today.

The Colorado exemption does not apply there.

---

The Bottom Line

For most 5-30 person professional services firms using commercial AI tools without custom training: you likely qualify for Colorado's small business deployer exemption. That means the $20,000-per-violation compliance stack — annual impact assessments, website disclosure statements, written risk management policies — probably doesn't apply to you.

What does apply: notifying Colorado consumers when AI contributes to an adverse decision about them, and being able to provide the developer's impact assessment if asked.

That's a manageable compliance obligation, not an emergency. Confirm your FTE count, audit your tools for custom training, and get the impact assessment documentation from your vendors before June 30.

And if Illinois applies to your firm: that compliance clock is already running.

---

Consult qualified legal counsel for advice specific to your firm's situation. CAIA interpretation is still evolving, and this article reflects the law as written and leading compliance guidance as of April 2026.

Related: Colorado's AI Act Deadline Is Still On Despite Trump's Executive Order | AI Compliance Deadlines for Professional Services Firms in 2026