A Bill for an Act
Page 1, Line 101Concerning artificial intelligence systems.
Bill Summary
(Note: This summary applies to this bill as introduced and does not reflect any amendments that may be subsequently adopted. If this bill passes third reading in the house of introduction, a bill summary that applies to the reengrossed version of this bill will be available at http://leg.colorado.gov.)
In 2024, the general assembly enacted Senate Bill 24-205, which created consumer protections in interactions with artificial intelligence systems (provisions).
The provisions include a definition of "consequential decision", which definition determines the types of artificial intelligence systems that are considered high-risk artificial intelligence systems for the purpose of the provisions and, therefore, regulated under current law. The bill narrows the definition of "consequential decision" to only include decisions related to employment or public safety.
The bill also:
- Changes the effective date of the provisions from February 1, 2026, to August 1, 2027;
- Exempts businesses with fewer than 250 employees from the provisions;
- Exempts businesses with less than $5 million in annual revenue from the provisions; and
- Exempts local governments with fewer than 100,000 residents from the provisions.
Page 2, Line 1Be it enacted by the General Assembly of the State of Colorado:
Page 2, Line 2SECTION 1. In Colorado Revised Statutes, 6-1-1701, amend (3); repeal (8); and add (10.5) as follows:
Page 2, Line 36-1-1701. Definitions. As used in this part 17, unless the context otherwise requires:
Page 2, Line 4(3) "Consequential decision" means a decision that has a material
Page 2, Line 5legal or similarly significant effect on
the provision or denial to anyPage 2, Line 6
consumer of, or the cost or terms of:Page 2, Line 7
(a) Education enrollment or an education opportunity;(b) Employment or an employment opportunity;Page 2, Line 8
(c) A financial or lending service;(d) An essential government service;Page 2, Line 9
(e) Health-care services;(f) Housing;Page 2, Line 10
(g) Insurance; or(h) A legal service.Page 2, Line 11(8)
"Health-care services" has the same meaning as provided in 42 U.S.C. sec. 234 (d)(2).Page 2, Line 12(10.5) "Local government" means a home rule or statutory municipality, county, or special district.
Page 3, Line 1SECTION 2. In Colorado Revised Statutes, 6-1-1702, amend (1),
Page 3, Line 2(2) introductory portion, (3)(a), (4)(a) introductory portion, (5) introductory portion, and (7) as follows:
Page 3, Line 36-1-1702. Developer duty to avoid algorithmic discrimination
Page 3, Line 4- required documentation. (1) On and after
February 1, 2026Page 3, Line 51, 2027, a developer of a high-risk artificial intelligence system shall use
Page 3, Line 6reasonable care to protect consumers from any known or reasonably
Page 3, Line 7foreseeable risks of algorithmic discrimination arising from the intended
Page 3, Line 8and contracted uses of the high-risk artificial intelligence system. In any
Page 3, Line 9enforcement action brought on or after
February 1, 2026Page 3, Line 10by the attorney general pursuant to section 6-1-1706, there is a rebuttable
Page 3, Line 11presumption that a developer used reasonable care as required under this
Page 3, Line 12section if the developer complied with this section and any additional
Page 3, Line 13requirements or obligations as set forth in rules
promulgatedPage 3, Line 14(2) On and after
February 1, 2026Page 3, Line 15provided in subsection (6) of this section, a developer of a high-risk
Page 3, Line 16artificial intelligence system shall make available to the deployer or other developer of the high-risk artificial intelligence system:
Page 3, Line 17(3) (a) Except as provided in subsection (6) of this section, a
Page 3, Line 18developer that offers, sells, leases, licenses, gives, or otherwise makes
Page 3, Line 19available to a deployer or other developer a high-risk artificial
Page 3, Line 20intelligence system on or after
February 1, 2026Page 3, Line 21make available to the deployer or other developer, to the extent feasible,
Page 3, Line 22the documentation and information, through artifacts such as model cards,
Page 3, Line 23dataset cards, or other impact assessments, necessary for a deployer, or
Page 4, Line 1for a third party contracted by a deployer, to complete an impact assessment pursuant to section 6-1-1703 (3).
Page 4, Line 2(4) (a) On and after
February 1, 2026Page 4, Line 3developer shall make available, in a manner that is clear and readily
Page 4, Line 4available on the developer's website or in a public use case inventory, a statement summarizing:
Page 4, Line 5(5) On and after
February 1, 2026Page 4, Line 6of a high-risk artificial intelligence system shall disclose to the attorney
Page 4, Line 7general, in a form and manner prescribed by the attorney general, and to
Page 4, Line 8all known deployers or other developers of the high-risk artificial
Page 4, Line 9intelligence system, any known or reasonably foreseeable risks of
Page 4, Line 10algorithmic discrimination arising from the intended uses of the high-risk
Page 4, Line 11artificial intelligence system without unreasonable delay but no later than ninety days after the date on which:
Page 4, Line 12(7) On and after
February 1, 2026Page 4, Line 13general may require that a developer disclose to the attorney general, no
Page 4, Line 14later than ninety days after the request and in a form and manner
Page 4, Line 15prescribed by the attorney general, the statement or documentation
Page 4, Line 16described in subsection (2) of this section. The attorney general may
Page 4, Line 17evaluate such statement or documentation to ensure compliance with this
Page 4, Line 18part 17, and the statement or documentation is not subject to disclosure
Page 4, Line 19under the "Colorado Open Records Act", part 2 of article 72 of title 24.
Page 4, Line 20In a disclosure pursuant to this subsection (7), a developer may designate
Page 4, Line 21the statement or documentation as including proprietary information or
Page 4, Line 22a trade secret. To the extent that any information contained in the
Page 4, Line 23statement or documentation includes information subject to
Page 4, Line 24attorney-client privilege or work-product protection, the disclosure does not constitute a waiver of the privilege or protection.
Page 5, Line 1SECTION 3. In Colorado Revised Statutes, 6-1-1703, amend (1),
Page 5, Line 2(2)(a) introductory portion, (3)(a), (3)(c), (3)(g), (4)(a) introductory
Page 5, Line 3portion, (4)(b) introductory portion, (5)(a) introductory portion, (7), and (9) as follows:
Page 5, Line 46-1-1703. Deployer duty to avoid algorithmic discrimination
Page 5, Line 5- risk management policy and program. (1) On and after
February 1,Page 5, Line 6
2026Page 5, Line 7system shall use reasonable care to protect consumers from any known or
Page 5, Line 8reasonably foreseeable risks of algorithmic discrimination. In any
Page 5, Line 9enforcement action brought on or after
February 1, 2026Page 5, Line 10by the attorney general pursuant to section 6-1-1706, there is a rebuttable
Page 5, Line 11presumption that a deployer of a high-risk artificial intelligence system
Page 5, Line 12used reasonable care as required under this section if the deployer
Page 5, Line 13complied with this section and any additional requirements or obligations
Page 5, Line 14as set forth in rules
promulgatedPage 5, Line 15(2) (a) On and after
February 1, 2026Page 5, Line 16as provided in subsection (6) of this section, a deployer of a high-risk
Page 5, Line 17artificial intelligence system shall implement a risk management policy
Page 5, Line 18and program to govern the deployer's deployment of the high-risk
Page 5, Line 19artificial intelligence system. The risk management policy and program
Page 5, Line 20must specify and incorporate the principles, processes, and personnel that
Page 5, Line 21the deployer uses to identify, document, and mitigate known or
Page 5, Line 22reasonably foreseeable risks of algorithmic discrimination. The risk
Page 5, Line 23management policy and program must be an iterative process planned,
Page 5, Line 24implemented, and regularly and systematically reviewed and updated over
Page 6, Line 1the life cycle of a high-risk artificial intelligence system, requiring
Page 6, Line 2regular, systematic review and updates. A risk management policy and
Page 6, Line 3program implemented and maintained pursuant to this subsection (2) must be reasonable considering:
Page 6, Line 4(3) (a) Except as provided in subsections (3)(d), (3)(e), and (6) of this section:
Page 6, Line 5(I) A deployer, or a third party contracted by the deployer, that
Page 6, Line 6deploys a high-risk artificial intelligence system on or after
February 1,Page 6, Line 7
2026Page 6, Line 8(II) On and after
February 1, 2026Page 6, Line 9or a third party contracted by the deployer, shall complete an impact
Page 6, Line 10assessment for a deployed high-risk artificial intelligence system at least
Page 6, Line 11annually and within ninety days after any intentional and substantial
Page 6, Line 12modification to the high-risk artificial intelligence system is made available.
Page 6, Line 13(c) In addition to the information required under subsection (3)(b)
Page 6, Line 14of this section, an impact assessment completed pursuant to this
Page 6, Line 15subsection (3) following an intentional and substantial modification to a
Page 6, Line 16high-risk artificial intelligence system on or after
February 1, 2026Page 6, Line 17August 1, 2027, must include a statement disclosing the extent to which
Page 6, Line 18the high-risk artificial intelligence system was used in a manner that was
Page 6, Line 19consistent with, or varied from, the developer's intended uses of the high-risk artificial intelligence system.
Page 6, Line 20(g) On or before
February 1, 2026Page 6, Line 21annually thereafter, a deployer, or a third party contracted by the deployer,
Page 6, Line 22must review the deployment of each high-risk artificial intelligence
Page 7, Line 1system deployed by the deployer to ensure that the high-risk artificial intelligence system is not causing algorithmic discrimination.
Page 7, Line 2(4) (a) On and after
February 1, 2026Page 7, Line 3later than the time that a deployer deploys a high-risk artificial
Page 7, Line 4intelligence system to make, or be a substantial factor in making, a consequential decision concerning a consumer, the deployer shall:
Page 7, Line 5(b) On and after
February 1, 2026Page 7, Line 6that has deployed a high-risk artificial intelligence system to make, or be
Page 7, Line 7a substantial factor in making, a consequential decision concerning a
Page 7, Line 8consumer shall, if the consequential decision is adverse to the consumer, provide to the consumer:
Page 7, Line 9(5) (a) On and after
February 1, 2026Page 7, Line 10as provided in subsection (6) of this section, a deployer shall make
Page 7, Line 11available, in a manner that is clear and readily available on the deployer's website, a statement summarizing:
Page 7, Line 12(7) If a deployer deploys a high-risk artificial intelligence system
Page 7, Line 13on or after
February 1, 2026Page 7, Line 14that the high-risk artificial intelligence system has caused algorithmic
Page 7, Line 15discrimination, the deployer, without unreasonable delay, but no later than
Page 7, Line 16ninety days after the date of the discovery, shall send to the attorney
Page 7, Line 17general, in a form and manner prescribed by the attorney general, a notice disclosing the discovery.
Page 7, Line 18(9) On and after
February 1, 2026Page 7, Line 19general may require that a deployer, or a third party contracted by the
Page 7, Line 20deployer, disclose to the attorney general, no later than ninety days after
Page 7, Line 21the request and in a form and manner prescribed by the attorney general,
Page 7, Line 22the risk management policy implemented pursuant to subsection (2) of
Page 8, Line 1this section, the impact assessment completed pursuant to subsection (3)
Page 8, Line 2of this section, or the records maintained pursuant to subsection (3)(f) of
Page 8, Line 3this section. The attorney general may evaluate the risk management
Page 8, Line 4policy, impact assessment, or records to ensure compliance with this part
Page 8, Line 517, and the risk management policy, impact assessment, and records are
Page 8, Line 6not subject to disclosure under the "Colorado Open Records Act", part 2
Page 8, Line 7of article 72 of title 24. In a disclosure pursuant to this subsection (9), a
Page 8, Line 8deployer may designate the statement or documentation as including
Page 8, Line 9proprietary information or a trade secret. To the extent that any
Page 8, Line 10information contained in the risk management policy, impact assessment,
Page 8, Line 11or records includes information subject to attorney-client privilege or
Page 8, Line 12work-product protection, the disclosure does not constitute a waiver of the privilege or protection.
Page 8, Line 13SECTION 4. In Colorado Revised Statutes, 6-1-1704, amend (1) as follows:
Page 8, Line 146-1-1704. Disclosure of an artificial intelligence system to
Page 8, Line 15consumer. (1) On and after
February 1, 2026Page 8, Line 16except as provided in subsection (2) of this section, a deployer or other
Page 8, Line 17developer that deploys, offers, sells, leases, licenses, gives, or otherwise
Page 8, Line 18makes available an artificial intelligence system that is intended to
Page 8, Line 19interact with consumers shall ensure the disclosure to each consumer who
Page 8, Line 20interacts with the artificial intelligence system that the consumer is interacting with an artificial intelligence system.
Page 8, Line 21SECTION 5. In Colorado Revised Statutes, 6-1-1705, add (10) as follows:
Page 8, Line 226-1-1705. Compliance with other legal obligations -
Page 8, Line 23exemptions - definitions - rules. (10) Notwithstanding any
Page 9, Line 1provision of this part 17 to the contrary, this part 17 does not apply to a person that is:
Page 9, Line 2(a) A local government with a total population of fewer than one hundred thousand residents; or
Page 9, Line 3(b) A business with:
(I) Fewer than two hundred fifty employees; or
Page 9, Line 4(II) Less than five million dollars in annual revenue in the previous calendar year.
Page 9, Line 5SECTION 6. Act subject to petition - effective date. This act
Page 9, Line 6takes effect at 12:01 a.m. on the day following the expiration of the
Page 9, Line 7ninety-day period after final adjournment of the general assembly; except
Page 9, Line 8that, if a referendum petition is filed pursuant to section 1 (3) of article V
Page 9, Line 9of the state constitution against this act or an item, section, or part of this
Page 9, Line 10act within such period, then the act, item, section, or part will not take
Page 9, Line 11effect unless approved by the people at the general election to be held in
Page 9, Line 12November 2026 and, in such case, will take effect on the date of the official declaration of the vote thereon by the governor.