Colorado recently enacted its Artificial Intelligence law, launching a new era of state AI laws.
What do you need to know?
- The bill is effective February 1, 2026 and enforceable by the Attorney General.
- This is a comprehensive AI bill that applies directly to the private sector.
- Like EU AI Act, the gating item is “high risk AI” defined as: an AI system that has been specifically developed and marketed or internationally and substantially modified to make or to be a substantial factor in making a consequential decision.
- Like U.S. state privacy laws, a consequential decision is a decision that has a material legal or similarly significant effects on a consumer’s access to or availability, cost or terms of things like education, employment, essential goods or services, financial or lending service, healthcare, housing, insurance or legal services.
- Like EU AI Act, it allocates responsibility to “developers” and “deployers.” This means service providers are directly implicated.
- The focus (key violation): reasonable care to avoid algorithmic discrimination, with extensive to-do’s, for a presumption of non-discrimination.
Developers need to:
- Provide deployers information and documentation necessary to complete an impact assessment (evaluation; data governance, mitigation).
- Provide deployers and the public information on the types of high-risk systems that the developer has developed or intentionally and substantially modified and makes available.
- Report to the Attorney General’s Office any known or reasonably foreseeable risk of algorithmic discrimination within 90 days after the discovery or receipt of a credible report from deployer.
Deployers need to:
- Implement a risk management policy and program (NIST AI RMF recommended).
- Complete an impact assessment at least annually and within 90 days of substantial change.
- Notify a consumer of specified items if the system makes a consequential decision concerning a consumer (including a description of the system, purpose , decision, human involvement, data, right to opt out of profiling).
- Make a publicly available statement summarizing the types of high-risk systems currently deployed.
- Disclose to the AG the discovery of algorithmic discrimination within 90 days.
The impact assessment is similar to the U.S. state law required DPIA and needs to include:
- Purpose, intended use, context & benefits.
- Known or reasonably foreseeable risks of algorithmic discrimination & mitigation steps.
- Categories of data processed & outputs to customize high risk AI system.
- Metrics used to evaluate performance and limitations.
- Description of transparency measures taken.
- Post deployment monitoring and safeguards including oversight.