Colorado signs artificial intelligence bill

On May 17, Colorado Governor Jared Polis signed Colorado’s Artificial Intelligence Act (SB 205), making the state the first to enact a comprehensive legal framework to regulate artificial intelligence (AI) tools. Developers have until February 1, 2026 to comply with most legal provisions.

Who is covered by the law?

The law covers “developers” and “implementers” of “high-risk artificial intelligence systems” who conduct business in Colorado. It is worth noting that these terms are not necessarily limited to Colorado-based businesses, but may include businesses, regardless of their location, that interact with Colorado residents or contract with entities in Colorado.

The law defines a high-risk AI system as “any artificial intelligence system that, when deployed, makes decisions or is a significant factor in making consequences.” A “consequential decision” is defined as “a decision that has a significant legal effect or similarly significant impact on the provision or denial to any consumer, or the cost or terms of: (a) education enrollment or educational opportunities; (b) employment or employment opportunities; (c) financial or lending service; d) essential government service; (e) health care services; f) apartment; g) insurance; or (h) legal services.”

The law exempts implementers from certain requirements, provided that the implementer employs fewer than 50 full-time equivalent employees, does not use its own data to train the system, uses the system only for purposes specified by the system developer, and makes certain information from the developer available to consumers. It also exempts some banks and insurers that are subject to different industry regulations.

What does the bill require?

• The bill requires developers and implementers of high-risk artificial intelligence systems to exercise due diligence to protect consumers from known or reasonably foreseeable risks of “algorithmic discrimination,” defined as any condition in which the use of an artificial intelligence system results in unlawful differential treatment or impact to the detriment of a member of a protected class. The bill creates a rebuttable presumption of due care, provided that regulated companies disclose certain information about their high-risk systems, including a general summary of training data and steps taken to reduce the risk of harm.
• By February 1, 2026, developers and implementers will be required to post statements on their websites about the types of high-risk AI systems they are developing or deploying, the steps they have taken to manage the risk of algorithmic discrimination, and update those statements as necessary to ensure make sure they are accurate.
• Developers and implementers must notify the Colorado Attorney General and entities deploying their AI tools no later than 90 days after discovering that their systems have caused or are likely to cause algorithmic discrimination, or after receiving a credible report that their system has caused algorithmic discrimination.
• Deployers of AI systems are required to implement “reasonable” risk management policies governing the deployment of high-risk AI systems, which must be systematically reviewed and updated.
• Deployers of high-risk AI systems must also conduct annual “impact assessments” of deployed high-risk AI systems, covering topics such as the purpose and intended uses of the system, known risks, and risk mitigation measures.
• For high-risk AI systems used to make “consistent consumer decisions,” entities deploying those systems must (1) notify the consumer of the use of the AI ​​system before making a decision, (2) disclose information to the consumer such as the purpose of the system, and (3) provide, where appropriate, information on consumers’ right to opt-out. If an AI system plays a role in making a decision that is unfavorable to the consumer, the implementer must disclose the main reasons for that decision.

Penalties and their enforcement

The state attorney general is granted exclusive enforcement authority under the state’s Unfair Trade Practices Act, Colo. Rev. Stat. § 6-1-105. The Attorney General may seek injunctions and civil penalties. The law does not allow class actions or provide private rights of action.

In any action by the Attorney General, it is an affirmative defense to liability if the developer or implementer detects and corrects any violations and is otherwise in compliance with the National Institute of Standards and Technology’s Artificial Intelligence Risk Management Framework, which constitutes another nationally or legally recognized risk. internationally, an artificial intelligence governance framework or a risk management framework designated by the Attorney General.