A Bill for an Act
Page 1, Line 101Concerning measures effective no later than June 30, 2026, to
Page 1, Line 102increase transparency for algorithmic systems.
Bill Summary
(Note: This summary applies to this bill as introduced and does not reflect any amendments that may be subsequently adopted. If this bill passes third reading in the house of introduction, a bill summary that applies to the reengrossed version of this bill will be available at http://leg.colorado.gov.)
In 2024, the general assembly enacted Senate Bill 24-205, which created consumer protections in interactions with artificial intelligence systems (provisions). The bill eliminates these provisions and:
- Defines "algorithmic decision system" (system) to mean any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making;
- Requires a developer of a system to, on and after February 1, 2026, provide certain disclosures to a deployer of the system;
- Requires a deployer of a system to, on and after February 1, 2026, provide certain disclosures to an individual who is or will be affected by a decision made, informed, or influenced by a system and provide the individual with a procedure to correct the accuracy of data that was used by the system;
- Provides that a developer and deployer of a system are jointly and severally liable for a violation of any law that results from the deployer's use of the developer's system;
- Requires a person that makes available a generative artificial intelligence system to disclose to an individual interacting with the generative artificial intelligence system that the individual is interacting with a generative artificial intelligence system;
- Clarifies that a violation of the bill's requirements is an unfair or deceptive trade practice under the "Colorado Consumer Protection Act"; and
- Permits the attorney general to adopt rules implementing the provisions of the bill.
This Unofficial Version Includes Committee
Amendments Not Yet Adopted on Second Reading
Page 2, Line 1Be it enacted by the General Assembly of the State of Colorado:
Page 2, Line 2SECTION 1. In Colorado Revised Statutes, repeal and reenact, with amendments, part 17 of article 1 of title 6 as follows:
Page 2, Line 3PART 17
ALGORITHMIC SYSTEMS
Page 2, Line 46-1-1701. Short title.The short title of this part 17 is the "Colorado Artificial Intelligence Sunshine Act".
Page 2, Line 56-1-1702. Definitions - rules.As used in this part 17, unless the context otherwise requires:
Page 2, Line 6(1) (a) "Algorithmic decision system" means any
Page 3, Line 1technology, including software or programs derived from
Page 3, Line 2machine learning, statistics, other data-processing techniques,
Page 3, Line 3or artificial intelligence, that processes personal
Page 3, Line 4characteristics and uses the output to assist, inform, or replace
Page 3, Line 5human decision-making with respect to a decision described in
Page 3, Line 6section 6-1-1704 (1). "Algorithmic decision system" includes a
Page 3, Line 7technology used to generate a score, ranking, classification, or
Page 3, Line 8prediction about an individual the human reviewer considers when making a decision described in section 6-1-1704 (1).
Page 3, Line 9(b) "Algorithmic decision system" does not include the following:
Page 3, Line 10(I) Databases, spreadsheets, or other tools that merely
Page 3, Line 11organize data already in the possession of the human user of the system;
Page 3, Line 12(II) Junk email filters;
(III) Firewalls;
Page 3, Line 13(IV) Anti-virus software;
(V) Calculators;
Page 3, Line 14(VI) Spell-checking;
(VII) Anti-malware;
Page 3, Line 15(VIII) Artificial-intelligence-enabled video games;
(IX) Cybersecurity;
Page 3, Line 16(X) Data storage;
(XI) Internet domain registration;
Page 3, Line 17(XII) Internet website loading;
(XIII) Networking;
Page 3, Line 18(XIV) Spam call and robocall filtering;
(XV) Web caching;
Page 4, Line 1(XVI) Web hosting or similar technology; or
Page 4, Line 2(XVII) Technologies that are solely used to order office
Page 4, Line 3supplies, schedule meetings, automate inventory tracking, or
Page 4, Line 4perform, assist, or administer similar ministerial administrative support functions.
Page 4, Line 5(2) "Assist, inform, or replace human decision-making"
Page 4, Line 6means to use information as a contributing factor in a decision described in section 6-1-1704 (1).
Page 4, Line 7(3) (a) "Biometric identifier" means data generated by the
Page 4, Line 8technological processing, measurement, or analysis of an
Page 4, Line 9individual's biological, physical, or behavioral characteristics,
Page 4, Line 10which data can be processed for the purpose of uniquely identifying the individual.
Page 4, Line 11(b) "Biometric identifier" includes:
(I) A fingerprint;
Page 4, Line 12(II) A voiceprint;
(III) A scan or record of an eye retina or iris;
Page 4, Line 13(IV) A facial map, facial geometry, or facial template; or
Page 4, Line 14(V) Other unique biological, physical, or behavioral patterns or characteristics.
Page 4, Line 15(4) "Deploy" means to use an algorithmic decision system in a decision described in section 6-1-1704 (1).
Page 4, Line 16(5) "Deployer" means a person doing business in this state that deploys an algorithmic decision system.
Page 4, Line 17(6) "Develop" means to design, build, or train an
Page 4, Line 18algorithmic decision system or to knowingly and materially
Page 5, Line 1modify, adapt, or combine an existing machine-based system or
Page 5, Line 2computational process for use as an algorithmic decision system.
Page 5, Line 3(7) "Developer" means a person or the person's agent doing business in this state that:
Page 5, Line 4(a) Develops an algorithmic decision system; or
Page 5, Line 5(b) Sells, leases, distributes, or otherwise makes available an algorithmic decision system to a deployer.
Page 5, Line 6(8) "Personal characteristics" include:
Page 5, Line 7(a) Personal data, as defined in section 6-1-1303 (17)(a), but without regard to the requirements of section 6-1-1303 (17)(b);
Page 5, Line 8(b) Sensitive data, as defined in section 6-1-1303 (24);
Page 5, Line 9(c) Genetic information, as defined in section 10-3-1104.6 (2)(c);
Page 5, Line 10(d) A biometric identifier;
Page 5, Line 11(e) An individual's economic situation, health, personal
Page 5, Line 12preferences, affiliations, interests, reliability, behavior, location, or movements; and
Page 5, Line 13(f) Inferences associated with a group, band, class, or tier of individuals to which the individual belongs.
Page 5, Line 14(9) "Plain language" means communication that is:
Page 5, Line 15(a) Clear, concise, and easy to understand for the
Page 5, Line 16intended audience, including people with disabilities, people with limited education, and English language learners; and
Page 5, Line 17(b) Available in English, Spanish, and any other relevant languages required by the attorney general by rule.
Page 5, Line 186-1-1703. Disclosure requirements for developers of
Page 6, Line 1algorithmic decision systems - exemption. (1) On and after
Page 6, Line 2February 1, 2026, a developer shall, consistent with any form
Page 6, Line 3and manner prescribed by the attorney general, provide to each deployer of the developer's algorithmic decision system:
Page 6, Line 4(a) An analysis of whether and how any intended uses, or
Page 6, Line 5reasonably foreseeable uses or misuses, of the algorithmic
Page 6, Line 6decision system pose a known or reasonably foreseeable risk of violating this article 1 or parts 3 to 8 of article 34 of title 24;
Page 6, Line 7(b) A description of any steps taken by the developer to
Page 6, Line 8mitigate any identified risks of violations of this article 1 or parts 3 to 8 of article 34 of title 24;
Page 6, Line 9(c) A statement describing the intended uses and
Page 6, Line 10reasonably foreseeable misuses of the algorithmic decision system; and
Page 6, Line 11(d) All other information necessary to allow the
Page 6, Line 12deployer to comply with the deployer's obligations under this part 17.
Page 6, Line 13(2) This part 17 does not apply to a developer if the developer:
Page 6, Line 14(a) Distributes all components of an algorithmic decision
Page 6, Line 15system developed by the developer pursuant to terms allowing
Page 6, Line 16a recipient to freely access, use, study, modify, and share the components or modified versions of the components; or
Page 6, Line 17(b) Participates in the development or distribution of an
Page 6, Line 18algorithmic decision system in which all components of the
Page 6, Line 19algorithmic decision system developed by the developer are
Page 6, Line 20distributed pursuant to terms allowing a recipient to freely
Page 7, Line 1access, use, study, modify, and share the components or modified versions of the components.
Page 7, Line 26-1-1704. Disclosure requirements for deployers of
Page 7, Line 3algorithmic decision systems - exemption - definition. (1) On and
Page 7, Line 4after February 1, 2026, a deployer shall, either directly or
Page 7, Line 5through a developer or other third party, provide the
Page 7, Line 6disclosures required by subsection (2) of this section directly to
Page 7, Line 7an individual who is or will be affected by a decision made,
Page 7, Line 8informed, or influenced by an algorithmic decision system, which
Page 7, Line 9decision has a material legal or similarly significant effect on
Page 7, Line 10the provision or denial to the individual of, or the cost or terms of:
Page 7, Line 11(a) Education enrollment or an education opportunity;
(b) Employment or an employment opportunity;
Page 7, Line 12(c) A financial or lending service;
(d) An essential government service;
Page 7, Line 13(e) A health-care service;
(f) Housing;
Page 7, Line 14(g) Insurance; or
(h) A legal service.
Page 7, Line 15(2) (a) Before a deployer deploys an algorithmic decision
Page 7, Line 16system to make, inform, or influence a decision affecting an
Page 7, Line 17individual as described in subsection (1) of this section, the
Page 7, Line 18deployer shall provide the individual with a notice, in plain
Page 7, Line 19language and consistent with any form and manner prescribed
Page 7, Line 20by the attorney general, that the deployer will be using an
Page 7, Line 21algorithmic decision system to make, inform, or influence a decision concerning the individual, which notice must include:
Page 8, Line 1(I) The name of the developer or developers of the algorithmic decision system;
Page 8, Line 2(II) The trade name and version number of the algorithmic decision system;
Page 8, Line 3(III) The nature of the decision and the stage in the
Page 8, Line 4decision-making process during which the algorithmic decision system will be used; and
Page 8, Line 5(IV) The contact information for the deployer.
Page 8, Line 6(b) As soon as practicable, and no later than thirty days
Page 8, Line 7after the deployment of an algorithmic decision system to make,
Page 8, Line 8inform, or influence a decision as described in subsection (1) of
Page 8, Line 9this section, a deployer shall provide an affected individual, in
Page 8, Line 10plain language and consistent with any form and manner prescribed by the attorney general, with:
Page 8, Line 11(I) A list of the types, categories, and sources of personal
Page 8, Line 12characteristics associated with the individual that were
Page 8, Line 13analyzed, predicted, input into, inferred, or collected by the algorithmic decision system;
Page 8, Line 14(II) A list of the twenty personal characteristics of the
Page 8, Line 15individual that most substantially influenced the output of the
Page 8, Line 16algorithmic decision system or, if the algorithmic decision
Page 8, Line 17system's output was influenced by fewer than twenty personal
Page 8, Line 18characteristics, a list of all personal characteristics that influenced the output; and
Page 8, Line 19(III) Information on how the individual can exercise their
Page 8, Line 20rights pursuant to section 6-1-1705.
Page 9, Line 1(3) (a) As used in this section, "financial or lending
Page 9, Line 2service" means a financial or lending service for consumer or
Page 9, Line 3household purposes with respect to the opening or closing of
Page 9, Line 4banking, credit union, credit card, or other accounts, or the
Page 9, Line 5interest rates, payment schedules, minimum payment amounts,
Page 9, Line 6and other material terms and conditions of such accounts, but excluding:
Page 9, Line 7(I) Individual banking or credit union account
Page 9, Line 8transactions, including routine checking accounts, savings accounts, and debit and credit card transactions;
Page 9, Line 9(II) Securities transactions and accounts, as the term "security" is defined in section 11-51-201 (17);
Page 9, Line 10(III) Derivatives transactions and accounts, as the term
Page 9, Line 11"derivatives transaction" is defined in 17 CFR 270.18f-4, as that section existed on July 1, 2025; and
Page 9, Line 12(IV) Services provided to an individual acting in their
Page 9, Line 13capacity as an "accredited investor", as defined in 17 CFR 230.501, as that section existed on July 1, 2025.
Page 9, Line 14(b) This section does not apply to a system or tool to the
Page 9, Line 15extent it is an anti-fraud system or tool used by an institution
Page 9, Line 16insured by the federal deposit insurance corporation or
Page 9, Line 17national credit union administration in accordance with 15
Page 9, Line 18U.S.C. sec. 6801 to prevent, detect, or respond to unlawful and
Page 9, Line 19malicious conduct or to comply with federal or state law for credit decisions.
Page 9, Line 20(c) A deployer that is an institution insured by the
Page 9, Line 21federal deposit insurance corporation or national credit union
Page 10, Line 1administration satisfies the requirements of subsection (2)(b) of this section by providing an individual with:
Page 10, Line 2(I) Separate notices for each decision; or
Page 10, Line 3(II) A combined notice providing the required information
Page 10, Line 4for each decision concerning the individual within the preceding thirty days.
Page 10, Line 5(4) Subsections (2)(b)(II) and (2)(b)(III) of this section and section 6-1-1705 do not apply to a deployer if:
Page 10, Line 6(a) The deployer is a public entity;
Page 10, Line 7(b) The information subject to the disclosures required by
Page 10, Line 8subsections (2)(b)(II) and (2)(b)(III) of this section and section
Page 10, Line 96-1-1705 is available through a request for records pursuant to
Page 10, Line 10the "Colorado Open Records Act", part 2 of article 72 of title 24; and
Page 10, Line 11(c) The deployer provides the individual with instructions
Page 10, Line 12on how to file a request for records pursuant to the "Colorado
Page 10, Line 13Open Records Act" with the public entity regarding what
Page 10, Line 14personal characteristics about the individual were used in the decision.
Page 10, Line 156-1-1705. Individual right to access and correct data used by
Page 10, Line 16an algorithmic decision system - procedures. (1) An individual
Page 10, Line 17affected by a decision made, informed, or influenced by an
Page 10, Line 18algorithmic decision system, as described in section 6-1-1704 (1), has a right to:
Page 10, Line 19(a) Access any personal characteristics of the individual
Page 10, Line 20that were analyzed by, predicted by, input into, inferred by, or
Page 10, Line 21collected by an algorithmic decision system; and
(b) Challenge and correct any inaccurate data.
Page 11, Line 1(2) A deployer or developer that has access to an
Page 11, Line 2individual's data shall create reasonable, accessible, and
Page 11, Line 3concise procedures in plain language to allow the individual to
Page 11, Line 4exercise the individual's rights pursuant to subsection (1) of this section.
Page 11, Line 56-1-1706. Disclosure requirements - generative artificial
Page 11, Line 6intelligence systems - definition. (1) Pursuant to any requirements
Page 11, Line 7established by the attorney general, a person that deploys,
Page 11, Line 8offers, sells, leases, licenses, gives, or otherwise makes
Page 11, Line 9available a generative artificial intelligence system that is
Page 11, Line 10intended to interact with an individual shall disclose to each
Page 11, Line 11individual who interacts with the generative artificial
Page 11, Line 12intelligence system the fact that the individual is interacting with a generative artificial intelligence system.
Page 11, Line 13(2) As used in this section, "generative artificial
Page 11, Line 14intelligence system" means an artificial intelligence system that:
Page 11, Line 15(a) Is trained on data;
Page 11, Line 16(b) Interacts with an individual using text, audio, or visual communication; and
Page 11, Line 17(c) Generates unscripted outputs similar to outputs created by a human, with limited or no human oversight.
Page 11, Line 186-1-1707. Joint and several liability for a developer and
Page 11, Line 19deployer of an algorithmic decision system. (1) Notwithstanding
Page 11, Line 20the requirements regarding liability in section 13-21-111.5, on
Page 11, Line 21and after the effective date of this part 17, as amended, the
Page 12, Line 1developer and deployer of an algorithmic decision system are
Page 12, Line 2jointly and severally liable for a violation of law facilitated by the deployer's use of the algorithmic decision system.
Page 12, Line 3(2) Notwithstanding subsection (1) of this section, a
Page 12, Line 4developer is not jointly and severally liable if the developer
Page 12, Line 5can demonstrate that the violation of law resulted from a
Page 12, Line 6misuse of the algorithmic decision system by the deployer, the
Page 12, Line 7developer took all reasonable steps available, contractual or otherwise, to prevent the misuse, and the developer:
Page 12, Line 8(a) Did not intend and could not have reasonably foreseen the misuse; or
Page 12, Line 9(b) Specifically disallowed the misuse in disclosures pursuant to section 6-1-1703 (1).
Page 12, Line 10(3) Nothing in this section limits, displaces, or otherwise
Page 12, Line 11affects any liability that a developer may have in the
Page 12, Line 12developer's own right, separate and apart from liability under
Page 12, Line 13this section, for a violation of state or federal law. Compliance
Page 12, Line 14with the requirements of this part 17 is not a defense to, and
Page 12, Line 15does not otherwise excuse, noncompliance with any applicable law.
Page 12, Line 166-1-1708. Enforcement. (1) A violation of this part 17
Page 12, Line 17constitutes an unfair or deceptive trade practice pursuant to section 6-1-105 (1)(hhhh).
Page 12, Line 18(2) This part 17 does not provide the basis for a private right of action.
Page 12, Line 19(3) Nothing in this part 17 preempts or otherwise affects
Page 12, Line 20any other right, claim, remedy, presumption, or defense
Page 13, Line 1available at law or in equity, including any right available
Page 13, Line 2pursuant to laws governing anti-discrimination, competition, privacy, or unfair and deceptive acts and practices.
Page 13, Line 36-1-1709. Rules.The attorney general may adopt rules as necessary to implement and enforce this part 17.
Page 13, Line 4SECTION 2. Safety clause. The general assembly finds,
Page 13, Line 5determines, and declares that this act is necessary for the immediate
Page 13, Line 6preservation of the public peace, health, or safety or for appropriations for
Page 13, Line 7the support and maintenance of the departments of the state and state institutions.