Colorado Consumer Protections for Artificial Intelligence Systems

The burdens of the Colorado AI Act fall on developers and deployers of these decision-making systems. Under the Colorado AI Act, developers of this type of AI must use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination, and must provide specific documentation to deployers or other developers of high-risk AI systems, including a general statement describing the reasonably foreseeable uses and known harmful or inappropriate uses of the system. They must also detail the system’s training data, limitations, purpose, intended benefits, and uses and include documents necessary to assist in understanding how to monitor algorithmic decisions for bias.

Entities that deploy these decision-making AI systems to affect the relevant categories of benefit are obligated with a new affirmative duty of reasonable care protecting consumers from known or reasonably foreseeable risk of algorithmic discrimination. The duty of care includes a number of consumer notifications, ongoing programs, and system analysis reports.

Deployers must develop and apply a new risk management program for AI decision making, and provide consumers with notice that an AI decision-making system is being used. The latter obligation includes statements about the purpose of the system, the nature of its decisions, and a notice of consumers right to opt out of processing. In cases where the consumer is on the wrong side of a decision facilitated by AI, the deployer must include a clear, effective statement disclosing the reasons for the decision, the data used to make the decision, and must provide both an opportunity to appeal the decision and to correct any incorrect data.

Annual data impact assessments for each decision-making AI system will soon be required for anyone deploying them in Colorado.

The Colorado AI Act does not have a private right of action and violations may be enforced by the state attorney general as an unfair trade practice.

Companies that train, sell or license decision-making AI system, and companies that use those systems will have a new set of requirements, notices and explanations to make to Colorado consumers by 2026.

Organizations should examine how AI is employed within their operations and work with legal counsel to determine if those activities may fall under the Colorado AI Act.