Colorado’s Regulation 28 has teeth. Building owners who ignore benchmarking requirements, miss compliance deadlines, or fail to demonstrate a compliant pathway face real financial exposure starting in 2030. Most building owners we talk to significantly underestimate this risk — or assume enforcement will be lax because the deadlines feel distant.
This guide covers what the regulation actually authorizes, how enforcement works in practice, and what your options are if you’re behind on compliance.
The Enforcement Timeline
Understanding Regulation 28 penalties starts with understanding when enforcement is authorized to begin.
Benchmarking penalties: CDPHE can enforce annual benchmarking requirements starting with the first reporting year. Buildings that fail to submit their annual Portfolio Manager data by the March 31 deadline are already out of compliance. However, CDPHE has historically focused enforcement energy on buildings that miss compliance pathways rather than first-year benchmarking failures.
Performance standard penalties: The bigger exposure is the building performance standard itself. Buildings that fail to demonstrate compliance with a performance pathway by the applicable deadline face civil penalties starting in 2030.
The compliance deadlines under HB 21-1286 and as modified by HB 25-1269:
- Buildings 50,000–99,999 sq ft: December 2026 for Pathway 1 (EUI target) or demonstrating enrollment in Pathways 2, 3, or 4
- Buildings 100,000+ sq ft: December 2027
- Final performance demonstration for all pathways: December 2030
This means 2030 is when CDPHE can begin assessing civil penalties on buildings that haven’t met their performance standard. That’s about four years from now — which sounds comfortable, but energy improvements take time to plan, procure, and construct. Buildings that start in late 2026 or 2027 will be scrambling.
What the Penalties Actually Are
Colorado Revised Statutes Section 25-7-122 authorizes civil penalties for violations of air quality regulations, which includes Regulation 28. The Air Quality Control Commission (AQCC) sets penalty amounts within the statutory framework.
Under AQCC rules, civil penalties for Regulation 28 non-compliance can reach up to $2,000 per day per violation. For a building that remains non-compliant throughout 2030 and into 2031, that exposure compounds quickly.
The calculation isn’t simple — CDPHE considers factors including:
- Severity of the violation (completely missing benchmarking vs. benchmarking but not meeting a performance standard)
- Duration (how long the building has been out of compliance)
- Good-faith efforts (whether the owner attempted compliance, enrolled in a pathway, applied for a variance)
- Building size and owner resources (larger buildings and institutional owners typically face higher penalties)
- Prior violations (repeat offenders receive less leniency)
A building that failed to benchmark for multiple years and took no steps toward compliance could theoretically face six-figure penalties. A building that benchmarked every year, enrolled in an improvement pathway, but fell short of its target due to documented circumstances is in a much better position during any enforcement discussion.
The Variance Process: Your Main Safety Valve
Regulation 28 includes a formal variance process that gives building owners a legitimate path to extended compliance timelines in cases of genuine hardship. This is not a loophole — it’s a structured process with specific eligibility criteria and documentation requirements.
Who can apply for a variance:
Under 5 CCR 1001-32, variances are available to building owners who can demonstrate that:
- Compliance is not technically feasible within the required timeline due to building-specific constraints
- Compliance would impose an undue economic burden relative to the building’s operating condition
- The building is subject to a financial restructuring, foreclosure, or receivership that prevents capital investment
- Unusual circumstances (tenant lease structures, historic preservation requirements, unique building systems) prevent compliance
Variances are not automatically granted. You have to apply, provide documentation, and make a case. CDPHE and the AQCC review variance applications and may approve them conditionally — for example, approving a two-year extension but requiring quarterly progress reports.
How to apply:
Variance applications are submitted to CDPHE’s Air Pollution Control Division. The application requires:
- Identification of the building and its current compliance status
- Documentation of the specific hardship being claimed
- A proposed alternative compliance schedule with specific milestones
- Evidence that the alternative schedule is achievable
Start the variance process before your compliance deadline, not after. An owner who applies for a variance six months before their deadline looks very different to CDPHE than one who applies after receiving an enforcement notice.
Enforcement Process: How CDPHE Actually Acts
CDPHE doesn’t issue penalties without notice. The enforcement process typically follows this sequence:
Step 1: Notice of violation. CDPHE sends a written notice identifying the specific violation — failed benchmarking submission, missed compliance pathway deadline, or failure to demonstrate performance improvement. The notice specifies a compliance schedule and gives the building owner an opportunity to respond.
Step 2: Compliance schedule negotiation. Most cases don’t go to formal enforcement. CDPHE works with building owners to establish a corrective action plan. Owners who engage promptly and cooperatively typically receive extended timelines and reduced penalties.
Step 3: Formal enforcement. If the owner fails to respond, rejects the compliance schedule, or repeatedly misses corrective action milestones, CDPHE can refer the matter to the AQCC for formal enforcement proceedings. This is where civil penalty assessments happen.
Step 4: AQCC hearing. Building owners can request a hearing before the AQCC to contest penalty amounts or enforcement actions. Hearings are formal administrative proceedings. Most building owners with legal counsel settle before reaching this stage.
A realistic note: Colorado has limited enforcement resources, and CDPHE has signaled that it will prioritize education and technical assistance over aggressive enforcement through the mid-2020s. But “low enforcement priority right now” is not a compliance strategy. The regulation is law, penalties are authorized, and enforcement resources can increase as more buildings reach their deadlines.
What “Good Faith” Actually Protects You From
Building owners sometimes ask whether attempting compliance — even unsuccessfully — protects them from penalties.
The answer is: partially, and it depends on what “attempting” means.
What helps:
- Annual benchmarking submitted on time, every year
- Documented enrollment in a compliance pathway (e.g., hiring an engineer for an ASHRAE Level 2 audit under Pathway 2)
- Progress toward improvement targets (showing EUI trending downward)
- Early engagement with CDPHE if you anticipate a problem
- Formal variance application with documentation
What doesn’t help:
- Informal intent to comply without documentation
- Blaming tenants without a documented attempt to collect their energy data
- Claiming financial hardship without financial records supporting it
- Missing your own compliance schedule milestones after agreeing to them
The standard CDPHE applies in penalty mitigation is documented, verifiable effort — not intent.
Special Situations
Buildings changing ownership. Regulation 28 obligations transfer with the building. If you acquire a building that was out of compliance, you inherit the compliance obligation. Buyers should conduct Regulation 28 due diligence as part of commercial real estate transactions — verifying that the seller has benchmarked, identifying any open enforcement actions, and factoring required energy improvements into purchase pricing.
Tenant-occupied buildings. The benchmarking obligation sits with the building owner, not individual tenants. If tenants pay utilities directly, you still need their consumption data. Most commercial leases don’t require tenants to share energy data, which has created a real compliance gap. Some building owners are amending leases to require data sharing at renewal — this is worth doing before your next renewal cycle.
Vacant or partially vacant buildings. Regulation 28 doesn’t exempt vacant buildings from benchmarking. You still need to report energy use for occupied spaces and document vacancy for unoccupied portions. Vacancy can affect your EUI calculation and may support a variance request for performance standards.
Buildings scheduled for demolition or major renovation. A building that is undergoing a major renovation (defined as affecting more than 50% of the building’s energy systems) may be eligible for an alternative compliance timeline. Document the renovation scope and timeline and contact CDPHE before your compliance deadline.
The Bottom Line on Penalty Risk
If you own a covered building in Colorado and you’re not benchmarked, you’re already out of compliance. If you’re benchmarked but haven’t selected a compliance pathway, you have until your deadline to do so. If your deadline is December 2026, that’s eight months from now.
The owners who end up paying penalties are typically ones who ignore the regulation entirely, don’t engage with CDPHE when contacted, and miss their own agreed-upon corrective action milestones. Owners who benchmark, pick a pathway, and document their progress — even imperfect progress — almost always avoid civil penalties.
If you’re behind on compliance and not sure where to start, contact us for a free consultation. We can assess your building’s current status, identify your realistic compliance options, and help you build a documented record of good-faith effort before CDPHE comes looking.
For more on compliance pathways, see our Colorado Regulation 28 compliance pathways guide. For information on financial incentives that offset compliance costs, see our Colorado energy incentives guide.