Introduction to the Colorado AI Act
The Colorado AI Act (CAIA) will come into effect on February 1, 2026, marking the first comprehensive, risk-based AI regulation law in the United States. This legislation aims to govern the use of AI systems in specific applications by private sector developers and deployers, ensuring transparency, consumer rights, and accountability.
Scope of the CAIA
The CAIA primarily targets the development and deployment of AI systems in what it defines as “high-risk AI systems.” According to the Colorado General Assembly: “The bill requires a developer of a high-risk artificial intelligence system (high-risk system) to use reasonable care to avoid algorithmic discrimination in the high-risk system. There is a rebuttable presumption that a developer used reasonable care if the developer complied with specified provisions in the bill.”
Key Definitions:
- Algorithmic Discrimination: AI systems that result in unlawful differential treatment based on protected statuses.
- High-Risk AI System (HRAIS): AI systems significantly influencing consequential decisions.
- Consequential Decision: Decisions with material legal or significant impacts on consumers’ access to services like education, employment, healthcare, and more.
- Developer: Entities developing or significantly modifying AI systems in Colorado.
- Deployer: Entities deploying high-risk AI systems in Colorado.
- Substantial Factor: AI-generated factors significantly affecting consequential decisions.
Key Provisions of the Law
Algorithmic Discrimination: The CAIA prohibits the use of high-risk AI systems in ways that lead to unlawful differential treatment based on protected classes.
Risk Management: The law mandates that deployers implement and regularly update risk management policies to mitigate algorithmic discrimination risks.
Transparency and Accountability: Developers and deployers must maintain transparency about the use and impact of high-risk AI systems.
Obligations for Developers and Deployers
The CAIA imposes several obligations on both developers and deployers to ensure responsible AI use:
- Duty of Care: Developers and deployers must exercise reasonable care to protect consumers from known or foreseeable risks of algorithmic discrimination.
- Documentation and Disclosure: Developers are required to provide detailed documentation to deployers, including intended uses, known risks, data summaries, and mitigation measures. This documentation must also be available to the attorney general upon request.
- Public Statements: Deployers must publish clear summaries of high-risk AI systems, including risk management strategies and detailed information about the collected data, on their websites. This information must be periodically updated.
- Impact Assessments: Deployers must conduct annual impact assessments detailing the AI system’s purpose, risk of algorithmic discrimination, data usage, performance metrics, and post-deployment monitoring. These assessments must be retained for at least three years.
Consumer Rights
The CAIA provides consumers with several rights to ensure transparency and fairness in the use of AI:
- Notice Prior to Deployment: Consumers must be informed if a high-risk AI system will be used to make consequential decisions about them.
- Right to Explanation: If an adverse decision is made by a high-risk AI system, consumers have the right to receive an explanation detailing the system’s role in the decision, the data used, and its sources.
- Right to Correct and Appeal: Consumers can correct inaccurate personal data used by the AI system and appeal decisions for human review if feasible.
- Form of Notice: Notice must be provided directly to the consumer, in plain language, in all business languages, and in accessible formats for consumers with disabilities.
Enforcement and Compliance
The attorney general holds exclusive authority to enforce the CAIA, including rulemaking and ensuring compliance. Developers and deployers must report any discovered algorithmic discrimination to the attorney general without unreasonable delay. Compliance with nationally recognized risk management frameworks can be used as a defense against enforcement actions.
Exemptions and Special Provisions
Federal Pre-Emption: AI systems approved by federal agencies like the FDA or FAA are exempt from certain CAIA requirements.
Trade Secret Protection: The CAIA allows deployers to withhold trade secrets or protected information, provided they notify the consumer and justify the withholding.
Small Businesses: Small businesses with 50 or fewer full-time employees are exempt from maintaining a risk management program or conducting impact assessments but must still adhere to duty of care and consumer notification requirements.
The CAIA is expected to generate substantial compliance costs and may inspire similar legislation in other states, especially if federal regulations do not emerge soon. This pioneering law sets a significant precedent in the regulation of AI, emphasizing the need for transparency, fairness, and accountability in AI applications.
