Amendment vs bill Committee Amendment vs Engrossed

Struck = removed from the bill ยท added = the amendment's new text.

Previous
Latest
Second Regular Session Seventy-fourth General Assembly STATE OF COLORADO ENGROSSED This Version Includes All Amendments Adopted on Second Reading in the House of Introduction LLS NO.
SB205_H_SA.001 HOUSE COMMITTEE OF REFERENCE REPORT _______________________________ May 4, 2024 Chair of Committee Date Committee on State, Civic, Military, & Veterans Affairs After consideration on the merits, the Committee recommends the following:
24-0922.03 Josh Schultz x5486 SENATE BILL 24-205 SENATE SPONSORSHIP Rodriguez, HOUSE SPONSORSHIP (None), Senate Committees House Committees Judiciary A BILL FOR AN ACT C ONCERNING CONSUMER PROTECTIONS IN INTERACTIONS WITH ARTIFICIAL INTELLIGENCE SYSTEMS .
SB24-205 be amended as follows, and as so amended, be referred to the Committee of the Whole with favorable recommendation:
Bill Summary (Note:
Amend reengrossed bill, page 7, line 15 after "NICATES " insert "WITH CONSUMERS ".
This summary applies to this bill as introduced and does notreflectanyamendmentsthatmaybesubsequentlyadopted.Ifthisbill passes third reading in the house of introduction, a bill summary that applies to the reengrossed version of this bill will be available at http://leg.colorado.gov.) The bill requires a developer of a high-risk artificial intelligence system (high-risk system) to use reasonable care to avoid algorithmic discrimination in the high-risk system.
Page 13, lines 6 and 7, strike "R CONFIDENTIAL OR PROPRIETARY INFORMATION ," and substitute " INFORMATION PROTECTED FROM DISCLOSURE BY STATE OR FEDERAL LAW ,".
There isarebuttablepresumption that a developer used reasonable care if the developer complied with g specified provisions in the bill, including:
Page 13, line 11, before "inserNOLATERTHANNINETYDAYS AFTER THE REQUEST AND ".
d ! Making available to a deployer of the high-risk system a e 4 T R 0 A n , Shading denotes HOUSE amendment.
Page 22, lines 21 and 22, strike "CONFIDENTIAL OR PROPRIETARY INFORMATION ." and substitute " INFORMATION PROTECTED FROM DISCLOSURE BY STATE OR FEDERAL LAW .
Double underlining denotes SENATE amendment.
TO THE EXTENT THAT A DEPLOYERWITHHOLDSINFORMATIONPURSUANTTOTHISSUBSECTION (8), THE DEPLOYER SHALL NOTIFY THE CONSUMER AND PROVIDE A BASIS FOR THE WITHHOLDING .".
E d y Capital letters or bold & italic numbers indicate new material to be added to existing law.
Page 22, line 25, before "nsertNO LATER THAN NINETY DAYS AFTER THE REQUEST AND ".
Dashes through the words or numbers indicate deletions from existing law.
Page 26, line 16, strike "OLOGY ;" and substituTECHNOLOGY IF THE STANDARDS ARE SUBSTANTIALLY EQUIVALENT OR MORE STRINGENT THAN THE REQUIREMENTS OF THIS PART 16;".
e A statement disclosing specified information about the high-risk system;
Page 27, strike lines 23 through 27 and substitute:
! Making available to a deployer of the high-risk system information and documentation necessary to complete an impact assessment of the high-risk system;
"(7) A N INSURER ,AS DEFINED IN SECTION 10-1-102 (13),A FRATERNALBENEFIT SOCIETY ,ASDESCRIBEDINSECTION 10-14-102,ORA DEVELOPEROFANARTIFICIALINTELLIGENCESYSTEMUSEDBYANINSURER IS IN FULL COMPLIANCE WITH THIS PART 16 IF THE INSURER, THE FRATERNAL BENEFIT SOCIETY , OR THE DEVELOPER IS SUBJECT TO THE REQUIREMENTSOFSECTION 10-3-1104.9ANDANYRULESADOPTEDBYTHE COMMISSIONER OF INSURANCE PURSUANT TO SECTION 10-3-1104.9.".
! Making a publicly available statement summarizing the typesofhigh-risksystemsthatthedeveloperhasdeveloped or intentionally and substantially modified and currently makes available to a deployer and how the developer manages any known or reasonably foreseeable risks of algorithmic discrimination that may arise from the developmentorintentionalandsubstantialmodificationof each of these high-risk systems;
Page 28, strike lines 1 through 4.
and ! Disclosing to the attorneygeneral and known deployers of the high-risk system any known or reasonably foreseeable risk of algorithmic discrimination, within 90 days after the discoveryor receipt of a credible report fromthe deployer, that the high-risk system has caused or is reasonablylikely to have caused.
Page 30, line 2, after "DVERS " inserAND CURES ".
The bill also requires a deployer of a high-risk system to use reasonable care to avoid algorithmic discrimination in the high-risk system.Thereisarebuttablepresumptionthatadeployerusedreasonable care if the deployer complied with specified provisions in the bill, including:
** *** ** *** ** -2-
! Implementing a risk management policy and program for the high-risk system;
! Completing an impact assessment of the high-risk system;
! Notifying a consumer of specified items if the high-risk system makes a consequential decision concerning a consumer;
! Making a publicly available statement summarizing the types of high-risk systems that the deployer currently deploys and how the deployer manages any known or reasonablyforeseeable risks of algorithmic discrimination that may arise from deployment of each of these high-risk systems;
and ! Disclosing to the attorney general the discovery of algorithmic discrimination, within 90 days after the discovery, that the high-risk system has caused or is reasonably likely to have caused.
A developer of a general purpose artificial intelligence model (general purpose model) is required to create and maintain specified documentation for the general purpose model, including:
! A policy to comply with federal and state copyright laws;
and -2- 205 ! A detailed summary concerning the content used to train the general purpose model.
A developer of a general purpose model must create, implement, maintain, and make available to deployers who intend to integrate the general purpose model into the deployers' artificial intelligence systems documentation and information that:
! Enables the deployers to understand the capabilities and limitations of the general purpose model;
! Discloses the technical requirements for the general purposemodeltobeintegratedintothedeployers'artificial intelligence systems;
! Discloses the design specifications of, and training processes for, the general purpose model, including the training methodologies and techniques for the general purpose model;
! Discloses the key design choices for the general purpose model, including the rationale and assumptions made;
! Discloses what the general purpose model is designed to optimize for and the relevance of the different parameters, as applicable;
and ! Provides a description of the data that was used for purposes of training, testing, and validation, as applicable.
If an artificial intelligence system, including a general purpose model,generatesormanipulatessyntheticdigitalcontent,thebillrequires the developer to:
! Ensure that the outputs of the artificial intelligence system aremarkedinamachine-readableformatanddetectableas synthetic digital content;
and ! Ensure that the developer's technical solutions are effective, interoperable, robust, and reliable.
If an artificial intelligence system, including a general purpose model,generatesormanipulatessyntheticdigitalcontent,thebillrequires thedeployeroftheartificialintelligencesystemtodisclosetoaconsumer that the synthetic digital content has been artificially generated or manipulated.
Theattorneygeneralanddistrictattorneyshaveexclusiveauthority to enforce thebill.During the period fromJuly1, 2025, through June 30, 2026, the attorney general or a district attorney, prior to initiating any action for a violation of the provisions of the bill, shall issue a notice of violation to the alleged violator and, if the attorney general or district attorneydeterminesthatacureispossible,providetheallegedviolator60 days to cure the violation before bringing an enforcement action.
The bill provides an affirmative defense for a developer or deployer if:
! The developer or deployer of the high-risk system or -3- 205 generative system involved in a potential violation has implemented and maintained a program that is in compliance with a nationallyor internationallyrecognized risk management framework for artificial intelligence systemsthatthebillortheattorneygeneraldesignates;and ! The developer or deployer takes specified measures to discover and correct violations of the bill.
Be it enacted by the General Assembly of the State of Colorado:
SECTION1.
InColoradoRevisedStatutes,addpart16toarticle 1 of title 6 as follows:
PART 16 ARTIFICIAL INTELLIGENCE 6-1-1601.
Show all 242 changed rows (202 more)
Previous
Latest
Definitions.
AS USED IN THIS PART16,UNLESS THE CONTEXT OTHERWISE REQUIRES :
(1) (a) "ALGORITHMIC DISCRIMINATION"MEANS ANY CONDITION IN WHICH THE USE OFAN ARTIFICIALINTELLIGENCE SYSTEM MATERIALLY INCREASES THE RISK OF AN UNLAWFUL DIFFERENTIAL TREATMENT OR IMPACT THAT DISFAVORS AN INDIVIDUAL OR GROUP OF INDIVIDUALS ON THE BASIS OF THEIR ACTUAL OR PERCEIVED AGE ,COLOR , DISABILIT, ETHNICITY GENETICINFORMATION ,LIMITEDPROFICIENCYINTHE E NGLISH LANGUAGE ,NATIONALORIGIN ,RACE ,RELIGION,REPRODUCTIVE HEALTH , SEX VETERANSTATUS ,OROTHERCLASSIFICATIONPROTECTEDUNDERTHE LAWS OF THIS STATE OR FEDERAL LAW .
(b) "A LGORITHMIC DISCRIMINATION" DOES NOT INCLUDE:
(I) T HE OFFER ,LICENSE, OR USE OF A HIGH RISK ARTIFICIAL INTELLIGENCE SYSTEM BY A DEVELOPER OR DEPLOYER FOR THE SOLE PURPOSE OF :
(A) T HEDEVELOPER 'SORDEPLOYER SSELF-TESTINGTOIDENTIFY , MITIGATE , OR PREVENT DISCRIMINATION OR OTHERWISE ENSURE -4- 205 COMPLIANCE WITH STATE AND FEDERAL LAW ;OR (B) EXPANDINGANAPPLICANT CUSTOMER ,ORPARTICIPANTPOOL TO INCREASE DIVERSITY OR REDRESS HISTORICAL DISCRIMINATIO;OR (II) ANACTOROMISSIONBYORONBEHALFOFAPRIVATECLUBOR OTHERESTABLISHMENTTHATISNOTINFACTOPENTOTHEPUBLIC ,ASSET FORTH IN T ITLEIIOF THE FEDERAL "CIVILRIGHTS A CT OF 1964", 42 U.S.C.
SEC.
2000a (eAS AMENDED .
(2) "A RTIFICIAL INTELLIGENCE SYSTEM" MEANS ANY MACHINE -BASEDSYSTEMTHAT FORANYEXPLICITORIMPLICITOBJECTIVE , INFERS FROM THE INPUTS THE SYSTEM RECEIVES HOW TO GENERATE OUTPUTS , INCLUDING CONTENT , DECISIONS, PREDICTIONS, OR RECOMMENDATIONS , THAT CAN INFLUENCE PHYSICAL OR VIRTUAL ENVIRONMENTS .
(3) "CONSEQUENTIAL DECISION "MEANS A DECISION THAT HAS A MATERIAL LEGAL OR SIMILARLY SIGNIFICANT EFFECT ON THE PROVISION OR DENIAL TO ANY CONSUMER OF ,OR THE COST OR TERMS OF:
(a) EDUCATION ENROLLMENT OR AN EDUCATION OPPORTUNITY ;
(b) EMPLOYMENT OR AN EMPLOYMENT OPPORTUNITY ;
(c) A FINANCIAL OR LENDING SERVIC;
(d) A N ESSENTIAL GOVERNMENT SERVICE;
(e) HEALTH -CARE SERVICES;
(f) HOUSING ;
(g) INSURANCE ;OR (h) A LEGAL SERVICE.
(4) "C ONSUMER " MEANS AN INDIVIDUAL WHO IS A C OLORADO RESIDENT .
(5) "D EPLOY" MEANS TO USE A HIGH -RISK ARTIFICIAL -5- 205 INTELLIGENCE SYSTEM .
(6) "DEPLOYER" MEANS A PERSONDOINGBUSINESSIN THIS STATE THAT DEPLOYS A HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTE.
(7) "DVELOPER "MEANSAPERSONDOINGBUSINESSINTHISSTATE THAT DEVELOPS OR INTENTIONALLY AND SUBSTANTIALLY MODIFIES AN ARTIFICIAL INTELLIGENCE SYSTEM.
(8) "HEALTH -CARE SERVICES " HAS THE SAME MEANING AS PROVIDED IN 42 U.S.C.SEC.
234 (d)(2).
(9)(a) "HGH-RISKARTIFICIALINTELLIGENCESYSTEM "MEANSANY ARTIFICIALINTELLIGENCE SYSTEM THAT ,WHEN DEPLOYED ,MAKES ,OR IS A SUBSTANTIAL FACTOR IN MAKING ,A CONSEQUENTIAL DECISION .
(b) "HIGH RISK ARTIFICIAL INTELLIGENCE SYSTEM " DOES NOT INCLUDE :
(I) A N ARTIFICIAL INTELLIGENCE SYSTEM IF THE ARTIFICIAL INTELLIGENCE SYSTEM IS INTENDED TO:
(A) PERFORM A NARROW PROCEDURAL TASK ;OR (B) DETECT DECISION MAKING PATTERNS OR DEVIATIONS FROM PRIORDECISION -MAKINGPATTERNSANDISNOTINTENDEDTOREPLACEOR INFLUENCE A PREVIOUSLY COMPLETED HUMAN ASSESSMENT WITHOUT SUFFICIENT HUMAN REVIEW ;OR (II) TEFOLLOWINGTECHNOLOGIES ,UNLESSTHETECHNOLOGIES , WHEN DEPLOYED ,MAKE ,OR ARE A SUBSTANTIAL FACTOR IN MAKING ,A CONSEQUENTIAL DECISION :
(A) A NT-FRAUD TECHNOLOGY THAT DOES NOT USE FACIAL RECOGNITION TECHNOLOGY ;
(B) ANTI-MALWARE ;
(C) ANTI-VIRUS;
-6- 205 (D) A RTIFICIAL INTELLIGEN-ENABLED VIDEO GAMES ;
(E) CALCULATORS ;
(F) CYBERSECURITY ;
(G) D ATABASES;
(H) D ATA STORAGE;
(I) FREWALL ;
(J) ITERNET DOMAIN REGISTRATION ;
(K) INTERNET WEBSITE LOADING;
(L) NETWORKING ;
(M) S PAM-AND ROBOCALL FILTERING;
(N) SPELL-CHECKING ;
(O) SPREADSHEETS ;
(P) W EB CACHING;
(Q) W EB HOSTING OR ANY SIMILAR TECHNOLOGY;OR (R) TECHNOLOGY THAT COMMUNICATES IN NATURAL LANGUAGE FOR THE PURPOSE OF PROVIDING USERS WITH INFORMATION ,MAKING REFERRALS OR RECOMMENDATIONS ,AND ANSWERING QUESTIONS AND IS SUBJECT TO AN ACCEPTED USE POLICY THAT PROHIBITS GENERATING CONTENT THAT IS DISCRIMINATORY OR HARMFUL.
(10) (a) "ITENTIONAL AND SUBSTANTIAL MODIFICATION "OR "INTENTIONALLY AND SUBSTANTIALLY MODIFIES"MEANS A DELIBERATE CHANGEMADETO ANARTIFICIALINTELLIGENCESYSTEMTHATRESULTSIN ANY NEW REASONABLY FORESEEABLE RISK OF ALGORITHMIC DISCRIMINATION.
(b) "ITENTIONAL AND SUBSTANTIAL MODIFICATION " OR "INTENTIONALLY AND SUBSTANTIALLY MODIFIES" DOES NOT INCLUDE A CHANGEMADETOAHIGH -RISKARTIFICIALINTELLIGENCESYSTEM,ORTHE -7- 205 PERFORMANCE OF A HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTE,IF:
(I) THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM CONTINUES TO LEARN AFTER THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM :S (A) O FFERED,SOLD ,LEASED, LICENSED,GIVEN ,OR OTHERWISE MADE AVAILABLE TO A DEPLOYER ;OR (B) D EPLOYED ;
(II) THE CHANGE IS MADE TO THE HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEM AS A RESULT OF ANY LEARNING DESCRIBED IN SUBSECTION (10)(b)(IOF THIS SECTIO;
(III) TE CHANGE WAS PREDETERMINED BY THE DEPLOYER ,OR A THIRD PARTY CONTRACTED BY THE DEPLOYER ,WHEN THE DEPLOYER OR THIRD PARTY COMPLETED AN INITIAL IMPACT ASSESSMENT OF SUCH HIGH RISK ARTIFICIAL INTELLIGENCE SYSTEM PURSUANT TO SECTION 6-1-1603 (3)AND (IV) T HE CHANGE IS INCLUDED IN TECHNICAL DOCUMENTATION FOR THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTE.
(11) (a) "SBSTANTIAL FACTOR " MEANS A FACTOR THAT :
(I) ASSISTS IN MAKING A CONSEQUENTIAL DECISION;
(II) SCAPABLEOFALTERINGTHEOUTCOMEOFACONSEQUENTIAL DECISION ;AND (III) I GENERATED BY AN ARTIFICIAL INTELLIGENCE SYSTEM.
(b) "SUBSTANTIALFACTOR "INCLUDESANYUSE OFANARTIFICIAL INTELLIGENCE SYSTEM TO GENERATE ANY CONTENT , DECISION, PREDICTION ,OR RECOMMENDATION CONCERNING A CONSUMER THAT IS USED AS A BASIS TO MAKE ACONSEQUENTIALDECISIONCONCERNINGTHE CONSUMER .
(12) "T RADE SECRET" HAS THE MEANING SET FORTH IN SECTION -8- 205 7-74-102 (4).
6-1-1602.
Developerdutytoavoidalgorithmicdiscrimination - required documentation.
(1) ON AND AFTER FEBRUARY 1, 2026,A DEVELOPEROFAHIGH -RISKARTIFICIALINTELLIGENCESYSTEMSHALLUSE REASONABLE CARE TO PROTECT CONSUMERS FROM ANY KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION ARISING FROM THE INTENDED AND CONTRACTED USES OF THE HIGH RISK ARTIFICIAL INTELLIGENCE SYSTEM .
IN ANY ENFORCEMENT ACTION BROUGHT ON OR AFTER FEBRUARY 1,2026,BY THE ATTORNEY GENERAL PURSUANT TO SECTION 6-1-1606,THERE IS A REBUTTABLE PRESUMPTION THAT A DEVELOPER USED REASONABLE CARE AS REQUIRED UNDER THIS SECTION IF THE DEVELOPER COMPLIED WITH THIS SECTION AND ANY ADDITIONAL REQUIREMENTS OR OBLIGATIONS AS SET FORTH IN RULES PROMULGATED BY THE ATTORNEY GENERAL PURSUANT TO SECTION 6-1-1607.
(2) ON AND AFTER FEBRUARY 1,2026,AND EXCEPT AS PROVIDED IN SUBSECTION (6)OF THIS SECTION, A DEVELOPER OF A HIGH RISK ARTIFICIAL INTELLIGENCE SYSTEM SHALL MAKE AVAILABLE TO THE DEPLOYER OR OTHER DEVELOPER OF THE HIGH RISK ARTIFICIAL INTELLIGENCE SYSTEM :
(a) A GENERAL STATEMENT DESCRIBING THE INTENDED USES OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTE;
(b) D OCUMENTATION DISCLOSING :
(I) HIGH-LEVELSUMMARIESOFTHE TYPE OFDATAUSEDTOTRAIN THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTE;
(II) KNOWN OR REASONABLY FORESEEABLE LIMITATIONS OF THE HIGH RISK ARTIFICIAL INTELLIGENCE SYSTEM ,INCLUDING KNOWN OR -9- 205 REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION ARISING FROM THE INTENDED USES OF THE HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEM;
(III) TE PURPOSE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM ;AND (IV) THE INTENDED BENEFITS AND USES OF THE HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTE;
(c) DOCUMENTATION DESCRIBING :
(I) HOW THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM WAS EVALUATED FOR PERFORMANCE AND MITIGATION OF ALGORITHMIC DISCRIMINATION BEFORE THE HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEM WAS OFFERED ,SOLD,LEASED ,LICENSED,GIVEN,OR OTHERWISE MADE AVAILABLE TO THE DEPLOYER ;
(II) THE DATA GOVERNANCE MEASURES USED TO COVER THE TRAINING DATASETS AND THE MEASURES USED TO EXAMINE THE SUITABILITY OF DATA SOURCES ,POSSIBLE BIASES,AND APPROPRIATE MITIGATION;
(III) THE INTENDED OUTPUTS OF THE HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEM;
(IV) T HE MEASURES THE DEVELOPER HAS TAKEN TO MITIGATE KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION THAT MAY ARISE FROM THE DEPLOYMENT OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYST;AND (V) H OW THE HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEM SHOULDBEUSEDORMONITOREDBYANINDIVIDUALWHENTHEHIGH -RISK ARTIFICIALINTELLIGENCESYSTEMISUSEDTOMAKE ,ORISASUBSTANTIAL FACTOR IN MAKING,A CONSEQUENTIAL DECISION;AND -10- 205 (d) A NY ADDITIONAL DOCUMENTATION THAT IS REASONABLY NECESSARY TO ASSIST THE DEPLOYER IN UNDERSTANDING THE OUTPUTS AND MONITOR THE PERFORMANCE OF THE HIGH RISK ARTIFICIAL INTELLIGENCE SYSTEM FOR RISKS OF ALGORITHMIC DISCRIMINATI.N (3) (a) ECEPT AS PROVIDED IN SUBSECTIO(6)OF THIS SECTI,N A DEVELOPER THAT OFFERS , SELL, LEASES, LICENSES, GIVES,OR OTHERWISE MAKES AVAILABLE TO A DEPLOYER OR OTHER DEVELOPER A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM ON OR AFTFEBRUARY 1, 2026,SHALL MAKE AVAILABLE TO THE DEPLOYER OR OTHER DEVELOPER, TO THE EXTENT FEASIBLE ,THE DOCUMENTATION AND INFORMATION , THROUGHARTIFACTSSUCHASMODELCARDS ,DATASETCARDS ,OROTHER IMPACT ASSESSMENTS ,NECESSARY FOR A DEPLOYER ,OR FOR A THIRD PARTY CONTRACTED BY A DEPLOYER , TO COMPLETE AN IMPACT ASSESSMENT PURSUANT TO SECTION 6-1-1603 (3).
(b) A DEVELOPER THAT ALSO SERVES AS A DEPLOYER FOR A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS NOT REQUIRED TO GENERATETHEDOCUMENTATIONREQUIREDBYTHISSECTIONUNLESSTHE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS PROVIDED TO AN UNAFFILIATED ENTITY ACTING AS A DEPLOYE.
(4) (a) O AND AFTER FEBRUARY 1, 2026A DEVELOPER SHALL MAKEAVAILABLE ,INAMANNERTHATISCLEARANDREADILYAVAILABLE ON THE DEVELOPER S WEBSITE OR IN A PUBLIC USE CASE INVENTOR,A STATEMENT SUMMARIZING :
(I) THE TYPES OF HIG-RISK ARTIFICIAL INTELLIGENCE SYSTEMS THAT THE DEVELOPER HAS DEVELOPED OR INTENTIONALLY AND SUBSTANTIALLY MODIFIED AND CURRENTLY MAKES AVAILABLE TO A DEPLOYER OR OTHER DEVELOPER ;AND -11- 205 (II) HOW THE DEVELOPER MANAGES KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION THAT MAY ARISE FROM THE DEVELOPMENT OR INTENTIONAL AND SUBSTANTIAL MODIFICATION OF THE TYPES OF HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMSDESCRIBEDINACCORDANCEWITHSUBSECTION (4)(a)(OFTHIS SECTION.
(b) ADEVELOPER SHALL UPDATE THE STATEMENT DESCRIBED IN SUBSECTION (4)(aOF THIS SECTIO:
(I) AS NECESSARY TO ENSURE THAT THE STATEMENT REMAINS ACCURATE ;AND (II) N O LATER THAN NINETY DAYS AFTER THE DEVELOPER INTENTIONALLY AND SUBSTANTIALLY MODIFIES ANY HIGH RISK ARTIFICIALINTELLIGENCESYSTEMDESCRIBEDINSUBSECTION (4)(a)(OF THIS SECTIO.
(5) O N AND AFTER FEBRUARY 1, 2026,A DEVELOPER OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM SHALL DISCLOSE TO THE ATTORNEY GENERAL ,IN A FORM AND MANNER PRESCRIBED BY THE ATTORNEY GENERAL , AND TO ALL KNOWN DEPLOYERS OR OTHER DEVELOPERS ,OF THE HIG-RISK ARTIFICIAL INTELLIGENCE SYSTEM ANY KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION ARISING FROM THE INTENDED USES OF THE HIGRISK ARTIFICIAL INTELLIGENCE SYSTEM WITHOUT UNREASONABLE DELAY BUT NO LATER THAN NINETY DAYS AFTER THE DATE ON WHIC:
(a) T HE DEVELOPER DISCOVERS THROUGH THE DEVELOPER S ONGOING TESTING AND ANALYSIS THAT THE DEVELOPER 'S HIGHRISK ARTIFICIALINTELLIGENCESYSTEMHASBEENDEPLOYEDANDHASCAUSED OR IS REASONABLY LIKELY TO HAVE CAUSED ALGORITHMIC -12- 205 DISCRIMINATION;OR (b) THE DEVELOPER RECEIVES FROM A DEPLOYER A CREDIBLE REPORTTHATTHEHIGH -RISKARTIFICIALINTELLIGENCESYSTEMHASBEEN DEPLOYED AND HAS CAUSED ALGORITHMIC DISCRIMINATION.
(6) NOTHINGINSUBSECTIONS(2)TO (5OFTHISSECTIONREQUIRES A DEVELOPER TO DISCLOSE A TRADE SECRET OR OTHER CONFIDENTIALOR PROPRIETARY INFORMATION .
(7) ON AND AFTERF EBRUARY 1, 2026THE ATTORNEY GENERAL MAYREQUIRETHATADEVELOPERDISCLOSETOTHEATTORNEYGENERAL , IN A FORM AND MANNER PRESCRIBED BY THE ATTORNEY GENERAL ,THE STATEMENT OR DOCUMENTATION DESCRIBED IN SUBSECTION (2)OF THIS SECTION.THE ATTORNEYGENERALMAYEVALUATE SUCHSTATEMENT OR DOCUMENTATION TO ENSURE COMPLIANCE WITH THIS PART 16,AND THE STATEMENT OR DOCUMENTATION IS NOT SUBJECT TO DISCLOSURE UNDER THE "COLORADO OPEN RECORDS A CT",PART 2OF ARTICLE72 OF TITLE 24.IN A DISCLOSURE PURSUANT TO THIS SUBSECTIO(7),A DEVELOPER MAY DESIGNATE THE STATEMENT OR DOCUMENTATION AS INCLUDING PROPRIETARY INFORMATION OR A TRADE SECRET.
O THE EXTENT THAT ANY INFORMATION CONTAINED IN THE STATEMENT OR DOCUMENTATION INCLUDES INFORMATION SUBJECT TO ATTORNEY -CLIENT PRIVILEGE OR WORK -PRODUCT PROTECTION,THE DISCLOSURE DOES NOT CONSTITUTE A WAIVER OF THE PRIVILEGE OR PROTECTIO.
6-1-1603.
Deployer duty to avoid algorithmic discrimination -riskmanagementpolicyandprogram.(1) O NANDAFTER FEBRUARY 1,2026,A DEPLOYER OF A HIGHRISK ARTIFICIAL INTELLIGENCE SYSTEM SHALLUSEREASONABLECARETOPROTECTCONSUMERSFROMANYKNOWN OR REASONABLY FORESEEABLE RISKS OFALGORITHMIC DISCRIMINATION.
-13- 205 INANYENFORCEMENTACTIONBROUGHTONORAFTER FEBRUARY 1,2026, BYTHE ATTORNEYGENERALPURSUANT TOSECTION 6-1-1606THERE ISA REBUTTABLEPRESUMPTIONTHATADEPLOYEROFAHIGH -RISKARTIFICIAL INTELLIGENCESYSTEMUSEDREASONABLECAREASREQUIREDUNDERTHIS SECTION IF THE DEPLOYER COMPLIED WITH THIS SECTION AND ANY ADDITIONAL REQUIREMENTS OR OBLIGATIONS AS SET FORTH IN RULES PROMULGATED BY THE ATTORNEY GENERAL PURSUANT TO SECTION 6-1-1607.
(2) (a) ON AND AFTER FEBRUARY 1, 2026,AND EXCEPT AS PROVIDED IN SUBSECTION (8)OF THIS SECTION, A DEPLOYER OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM SHALL IMPLEMENT A RISK MANAGEMENT POLICY AND PROGRAM TO GOVERN THE DEPLOYER S DEPLOYMENT OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYST.
HE RISK MANAGEMENT POLICY AND PROGRAM MUST SPECIFY AND INCORPORATE THE PRINCIPLES,PROCESSES,AND PERSONNEL THAT THE DEPLOYER USES TO IDENTIFY, DOCUMENT ,AND MITIGATE KNOWN OR REASONABLYFORESEEABLERISKSOFALGORITHMICDISCRIMINATION .THE RISK MANAGEMENT POLICY AND PROGRAM MUST BE AN ITERATIVE PROCESS PLANNED , IMPLEMENTED , AND REGULARLY AND SYSTEMATICALLY REVIEWED AND UPDATED OVER THE LIFE CYCLE OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, REQUIRING REGULAR , SYSTEMATIC REVIEW AND UPDATES .
ARISK MANAGEMENT POLICY AND PROGRAM IMPLEMENTED AND MAINTAINED PURSUANT TO THIS SUBSECTION (2)MUST BE REASONABLE CONSIDERING:
(I)(A) TEGUIDANCEANDSTANDARDSSETFORTHINTHELATEST VERSION OF THE "ARTIFICIAL NTELLIGENCE R ISK M ANAGEMENT FRAMEWORK " PUBLISHED BY THE NATIONAL INSTITUTE OF STANDARDS -14- 205 AND TECHNOLOGY IN THE U NITEDSTATES DEPARTMENT OF COMMERCE , STANDARD ISO/IEC 42001OF THEINTERNATIONAL ORGANIZATION FOR STANDARDIZATION , OR ANOTHER NATIONALLY OR INTERNATIONALLY RECOGNIZED RISK MANAGEMENT FRAMEWORK FOR ARTIFICIAL INTELLIGENCE SYSTEMS;OR (B) A NY RISK MANAGEMENT FRAMEWORK FOR ARTIFICIAL INTELLIGENCESYSTEMSTHATTHEATTORNEYGENERAL ,INTHEATTORNEY GENERAL S DISCRETION,MAY DESIGNATE;
(II) TE SIZE AND COMPLEXITY OF THE DEPLOYE;
(III) THE NATURE AND SCOPE OF THE HIGH RISK ARTIFICIAL INTELLIGENCE SYSTEMS DEPLOYED BY THE DEPLOYER ,INCLUDING THE INTENDED USES OF THE HIGHRISK ARTIFICIAL INTELLIGENCE SYSTEM;
AND (IV) T HE SENSITIVITY AND VOLUME OF DATA PROCESSED IN CONNECTION WITH THE HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEMS DEPLOYED BY THE DEPLOYER .
(b) A RISK MANAGEMENT POLICY AND PROGRAM IMPLEMENTED PURSUANT TO SUBSECTION (2)(aOFTHISSECTIONMAY COVER MULTIPLE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS DEPLOYED BY THE DEPLOYER .
(3) (a) ECEPT AS PROVIDED IN SUBSECTION(3)(d), (3)(AND (6)OF THIS SECTIO:
(I) A DEPLOYER ,OR A THIRD PARTY CONTRACTED BY THE DEPLOYER ,THATDEPLOYSAHIGH RISKARTIFICIALINTELLIGENCESYSTEM ON OR AFTER FEBRUARY 1, 2026, SHALL COMPLETE AN IMPACT ASSESSMENT FORTHE HIGH-RISKARTIFICIALINTELLIGENCESYSTEM ;AND (II) O AND AFTER FEBRUARY 1, 2026A DEPLOYER ,OR A THIRD -15- 205 PARTY CONTRACTED BY THE DEPLOYER ,SHALL COMPLETE AN IMPACT ASSESSMENT FOR A DEPLOYED HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEM AT LEAST ANNUALLY AND WITHIN NINETY DAYS AFTER ANY INTENTIONAL AND SUBSTANTIAL MODIFICATION TO THE HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEM IS MADE AVAILABL.
(b) A N IMPACT ASSESSMENT COMPLETED PURSUANT TO THIS SUBSECTION (3)MUST INCLUDE ,AT A MINIMUM ,AND TO THE EXTENT REASONABLY KNOWN BY OR AVAILABLE TO THE DEPLOYER :
(I) A STATEMENT BY THE DEPLOYER DISCLOSING THE PURPOSE , INTENDED USE CASES ,AND DEPLOYMENT CONTEXT OF ,AND BENEFITS AFFORDED BY ,THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYST;M (II) AN ANALYSIS OF WHETHER THE DEPLOYMENT OF THE HIGH RISK ARTIFICIAL INTELLIGENCE SYSTEM POSES ANY KNOWN OR REASONABLYFORESEEABLERISKSOFALGORITHMICDISCRIMINATIONAND , IFSO,THE NATURE OFTHEALGORITHMICDISCRIMINATIONANDTHE STEPS THAT HAVE BEEN TAKEN TO MITIGATE THE RISKS;
(III) ADESCRIPTION OF THE CATEGORIES OF DATA THE HI-RISK ARTIFICIAL INTELLIGENCE SYSTEM PROCESSES AS INPUTS AND THE OUTPUTS THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM PRODUCE;
(IV) IF THE DEPLOYER USED DATA TO CUSTOMIZE THE HIG-RISK ARTIFICIALINTELLIGENCE SYSTEM,ANOVERVIEWOFTHE CATEGORIESOF DATA THE DEPLOYER USED TO CUSTOMIZE THE HIGH RISK ARTIFICIAL INTELLIGENCE SYSTEM ;
(V) A NY METRICS USED TO EVALUATE THE PERFORMANCE AND KNOWN LIMITATIONS OF THE HIGH RISK ARTIFICIAL INTELLIGENCE SYSTEM ;
(VI) A DESCRIPTION OF ANY TRANSPARENCY MEASURES TAKEN -16- 205 CONCERNING THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, INCLUDINGANYMEASURESTAKENTODISCLOSETOACONSUMERTHATTHE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS IN USE WHEN THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS IN;AND (VII) ADESCRIPTIONOFTHEPOST -DEPLOYMENTMONITORINGAND USER SAFEGUARDS PROVIDED CONCERNING THE HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEM,INCLUDING THE OVERSIGHT,USE,AND LEARNING PROCESS ESTABLISHED BY THE DEPLOYER TO ADDRESS ISSUES ARISING FROM THE DEPLOYMENT OF THE HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEM .
(c) IN ADDITION TO THE INFORMATION REQUIRED UNDER SUBSECTION (3)(bOFTHISSECTION ANIMPACTASSESSMENTCOMPLETED PURSUANT TO THIS SUBSECTION (3)FOLLOWING AN INTENTIONAL AND SUBSTANTIAL MODIFICATION TO A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM ON OR AFTER FEBRUARY 1, 2026MUST INCLUDE A STATEMENT DISCLOSING THE EXTENT TO WHICH THE HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEM WAS USED IN A MANNER THAT WAS CONSISTENT WITH ,OR VARIED FROM ,THE DEVELOPER 'S INTENDED USES OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYST.M (d) ASINGLE IMPACT ASSESSMENT MAY ADDRESS ACOMPARABLE SET OF HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS DEPLOYED BY A DEPLOYER .
(e) IF A DEPLOYER, OR A THIRD PARTY CONTRACTED BY THE DEPLOYER ,COMPLETES AN IMPACT ASSESSMENT FOR THE PURPOSE OF COMPLYING WITH ANOTHER APPLICABLE LAW OR REGULATION , THE IMPACTASSESSMENTSATISFIESTHEREQUIREMENTSESTABLISHEDINTHIS SUBSECTION (3)IF THE IMPACT ASSESSMENT IS REASONABLY SIMILAR IN -17- 205 SCOPEANDEFFECTTOTHEIMPACTASSESSMENTTHATWOULDOTHERWISE BE COMPLETED PURSUANT TO THIS SUBSECTION(3).
(f) A DEPLOYER SHALL MAINTAIN THE MOST RECENTLY COMPLETED IMPACT ASSESSMENT FOR A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM AS REQUIRED UNDER THIS SUBSECTION (3),ALL RECORDSCONCERNINGEACHIMPACTASSESSMENT ,ANDALLPRIORIMPACT ASSESSMENTS ,IFANY,FORATLEASTTHREEYEARSFOLLOWINGTHEFINAL DEPLOYMENT OF THE HIGH RISK ARTIFICIAL INTELLIGENCE SYST.M (g) ON OR BEFOREF EBRUARY 1,2026,AND AT LEAST ANNUALLY THEREAFTER ,A DEPLOYER , OR A THIRD PARTY CONTRACTED BY THE DEPLOYER , MUST REVIEW THE DEPLOYMENT OF EACH HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEM DEPLOYED BY THE DEPLOYER TO ENSURE THAT THE HIGH RISK ARTIFICIAL INTELLIGENCE SYSTEM IS NOT CAUSING ALGORITHMIC DISCRIMINATION.
(4) (a) O AND AFTER FEBRUARY 1, 2026AND NO LATER THAN THE TIME THAT A DEPLOYER DEPLOYS A HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEM TO MAKE ,OR BE A SUBSTANTIAL FACTOR IN MAKING ,A CONSEQUENTIAL DECISION CONCERNING A CONSUMER , THE DEPLOYER SHALL :
(I) NOTIFYTHE CONSUMERTHATTHEDEPLOYERHASDEPLOYEDA HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM TO MAKE , OR BE A SUBSTANTIAL FACTOR IN MAKING ,A CONSEQUENTIAL DECISION BEFORE THE DECISION IS MAD;
(II) POVIDE TO THE CONSUMER A STATEMENT DISCLOSING THE PURPOSE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM AND THE NATURE OF THE CONSEQUENTIAL DECISION;THE CONTACT INFORMATION FOR THE DEPLOYER ;A DESCRIPTION ,IN PLAIN LANGUAGE ,OF THE -18- 205 HIGH-RISKARTIFICIALINTELLIGENCESYSTEM ;ANDINSTRUCTIONSONHOW TO ACCESS THE STATEMENT REQUIRED BY SUBSECTION (5)(a)OF THIS SECTION;
AND (III) POVIDE TO THE CONSUMER INFORMATION ,IF APPLICABL, REGARDING THE CONSUMER S RIGHT TO OPT OUT OF THE PROCESSING OF PERSONAL DATA CONCERNING THE CONSUMER FOR PURPOSES OF PROFILING IN FURTHERANCE OF DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT EFFECTS CONCERNING THE CONSUMER UNDER SECTION 6-1-1306 (1)(a)(I)(C).
(b) O N AND AFTER FEBRUARY 1, 2026,A DEPLOYER THAT HAS DEPLOYED A HIGH RISK ARTIFICIAL INTELLIGENCE SYSTEM TO MAK,OR BE A SUBSTANTIAL FACTOR IN MAKING ,A CONSEQUENTIAL DECISION CONCERNING A CONSUMER SHALL , IF THE CONSEQUENTIAL DECISION IS ADVERSE TO THE CONSUMER PROVIDE TO THE CONSUMER :
(I) ASTATEMENTDISCLOSINGTHEPRINCIPALREASONORREASONS FOR THE CONSEQUENTIAL DECISION,INCLUDING :
(A) THE DEGREE TO WHICH , AND MANNER IN WHICH ,THE HIGH RISK ARTIFICIAL INTELLIGENCE SYSTEM CONTRIBUTED TO THE CONSEQUENTIAL DECISION ;
(B) THEDATATHATWASPROCESSEDBYTHEHIGH -RISKARTIFICIAL INTELLIGENCE SYSTEM IN MAKING THE CONSEQUENTIAL DECISION;AND (C) T HE SOURCE OR SOURCES OF THE DATA DESCRIBED IN SUBSECTION (4)(b)(I)(BOF THIS SECTIO;
(II) AN OPPORTUNITY TO CORRECT ANY INCORRECT PERSONAL DATATHATTHEHIGH -RISKARTIFICIALINTELLIGENCESYSTEMPROCESSED IN MAKING , OR AS A SUBSTANTIAL FACTOR IN MAKING , THE CONSEQUENTIAL DECISION ;AND -19- 205 (III) AN OPPORTUNITY TO APPEAL AN ADVERSE CONSEQUENTIAL DECISION CONCERNING THE CONSUMER ARISING FROM THE DEPLOYMENT OFA HIGH -RISK ARTIFICIALINTELLIGENCE SYSTE,WHICHAPPEALMUST , IFTECHNICALLYFEASIBLE ALLOWFORHUMANREVIEWUNLESSPROVIDING THE OPPORTUNITY FOR APPEAL IS NOT IN THE BEST INTEREST OF THE CONSUMER ,INCLUDING IN INSTANCES IN WHICH ANY DELAY MIGHT POSE A RISK TO THE LIFE OR SAFETY OF SUCH CONSUME.
(c) (I) THE CONSUMER , BASED ON THE INFORMATION IN THE STATEMENT PROVIDED PURSUANT TO SUBSECTION (4)(b)(I)OF THIS SECTION ,BEARS THE BURDEN OF DEMONSTRATING THAT THERE WAS A MATERIAL ERROR OR OMISSION WARRANTING HUMAN REVIEW PURSUANT TO SUBSECTION (4)(b)(IIIOF THIS SECTIO.
(II) A DEPLOYER THAT HAS DEPLOYED A HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEM TO MAKE , OR BE A SUBSTANTIAL FACTOR IN MAKING ,A CONSEQUENTIAL DECISION CONCERNING A CONSUMER MAY CONTRACTUALLY AGREE TO HAVE A DEVELOPER PROVIDE THE NOTICES AND DISCLOSURES TO AND CONDUCT THE APPEAL PROCESS REQUIRED BY THIS SUBSECTION (4)FOR CONSUMERS .
(d) (I) EXCEPT AS PROVIDED IN SUBSECTION (4)(d)(IIOF THIS SECTION ,ADEPLOYERSHALLPROVIDETHENOTICE STATEMENT ,CONTACT INFORMATION AND DESCRIPTION REQUIRED BY SUBSECTIONS (4)(aAND (4)(b)OF THIS SECTIO:
(A) D IRECTLY TO THE CONSUMER ;
(B) IN PLAIN LANGUAGE ;
(C) IN ALL LANGUAGES IN WHICH THE DEPLOYER ,IN THE ORDINARYCOURSE OFTHE DEPLOYER 'SBUSINESS,PROVIDESCONTRACTS , DISCLAIMERS ,SALE ANNOUNCEMENTS , AND OTHER INFORMATION TO -20- 205 CONSUMERS ;AND (D) I N A FORMAT THAT IS ACCESSIBLE TO CONSUMERS WITH DISABILITIE.
(II) IF THE DEPLOYER IS UNABLE TO PROVIDE THE NOTICE , STATEMENT , CONTACT INFORMATION , AND DESCRIPTION REQUIRED BY SUBSECTIONS (4)(a)AND (4)(b)OF THIS SECTION DIRECTLY TO THE CONSUMER ,THE DEPLOYER SHALL MAKE THE NOTICE , STATEMENT , CONTACTINFORMATION ,ANDDESCRIPTIONAVAILABLEINAMANNERTHAT ISREASONABLYCALCULATEDTOENSURE THATTHECONSUMERRECEIVES THE NOTICE,STATEMENT ,CONTACT INFORMATION ,AND DESCRIPTION.
(5) (a) O N AND AFTER FEBRUARY 1, 2026,AND EXCEPT AS PROVIDED IN SUBSECTION(6)OF THIS SECTIO,A DEPLOYER SHALLMAKE AVAILABLE ,INAMANNERTHATISCLEARANDREADILYAVAILABLEONTHE DEPLOYER 'S WEBSIT,A STATEMENT SUMMARIZING :
(I) THE TYPES OF HIG-RISK ARTIFICIAL INTELLIGENCE SYSTEMS THAT ARE CURRENTLY DEPLOYED BY THE DEPLOYER ;
(II) H OW THE DEPLOYER MANAGES KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION THAT MAY ARISE FROM THE DEPLOYMENT OF EACH HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEMDESCRIBEDPURSUANTTOSUBSECTION (5)(a)(OFTHISSECTION ;
AND (III) I DETAIL ,THE NATURE , SOURCE, AND EXTENT OF THE INFORMATION COLLECTED AND USED BY THE DEPLOYER .
(b) A DEPLOYER SHALL PERIODICALLY UPDATE THE STATEMENT DESCRIBED IN SUBSECTION(5)(a)OF THIS SECTIO.
(6) SUBSECTIONS (2) AND (3)OF THIS SECTION AND THIS SUBSECTION (6)DO NOT APPLY TO A DEPLOYER IF ,AT THE TIME THE -21- 205 DEPLOYER DEPLOYS A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM AND AT ALLTIMES WHILE THE HIGHRISK ARTIFICIAL INTELLIGENCE SYSTEM IS DEPLOYED :
(a) THE DEPLOYER :
(I) E MPLOYS FEWER THAN FIFTY FULL -TIME EQUIVALENT EMPLOYEES ;AND (II) DOES NOT USE THE DEPLOYER 'S OWN DATA TO TRAIN THE HIGH RISK ARTIFICIAL INTELLIGENCE SYSTE;
(b) THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYST:M (I) I USED FOR THE INTENDED USES THAT ARE DISCLOSED TO THE DEPLOYER AS REQUIRED BY SECTION 6-1-1602 (2)(aAND (II) C ONTINUES LEARNING BASED ON DATA DERIVED FROM SOURCES OTHER THAN THE DEPLOYER 'S OWN DATA;AND (c) THEDEPLOYERMAKESAVAILABLETOCONSUMERSANYIMPACT ASSESSMENT THAT :
(I) THE DEVELOPER OF THE HIG-RISK ARTIFICIAL INTELLIGENCE SYSTEM HAS COMPLETED AND PROVIDED TO THE DEPLOYER ;AND (II) ICLUDESINFORMATIONTHAT ISSUBSTANTIALLYSIMILARTO THE INFORMATION IN THE IMPACT ASSESSMENT REQUIRED UNDER SUBSECTION (3)(b)OF THIS SECTIO.
(7) IADEPLOYERDEPLOYSAHIGH -RISKARTIFICIALINTELLIGENCE SYSTEMONORAFTER FEBRUARY 1,2026,ANDSUBSEQUENTLYDISCOVERS THAT THE HIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEM HAS CAUSED ALGORITHMICDISCRIMINATION ,THEDEPLOYER ,WITHOUTUNREASONABLE DELAY ,BUT NO LATER THAN NINETY DAYS AFTER THE DATE OF THE DISCOVERY ,SHALL SEND TO THE ATTORNEY GENERAL ,IN A FORM AND MANNERPRESCRIBEDBYTHE ATTORNEYGENERAL ,ANOTICE DISCLOSING -22- 205 THE DISCOVERY.
(8) NOTHING IN SUBSECTION(2)TO (5)AND (7)OF THIS SECTION REQUIRES A DEPLOYER TO DISCLOSE A TRADE SECRET OR OTHER CONFIDENTIAL OR PROPRIETARY INFORMATION.
(9) ON AND AFTERF EBRUARY 1, 2026THE ATTORNEY GENERAL MAYREQUIRETHATADEPLOYER ,ORATHIRDPARTYCONTRACTEDBYTHE DEPLOYER ,DISCLOSE TO THE ATTORNEY GENERAL , IN A FORM AND MANNER PRESCRIBED BY THE ATTORNEY GENERAL , THE RISK MANAGEMENT POLICY IMPLEMENTED PURSUANT TO SUBSECTION (2)OF THIS SECTION, THE IMPACT ASSESSMENT COMPLETED PURSUANT TO SUBSECTION (3)OF THIS SECTION , OR THE RECORDS MAINTAINED PURSUANT TO SUBSECTION (3)(fOF THIS SECTION.
THE ATTORNEY GENERAL MAY EVALUATE THE RISK MANAGEMENT POLICY , IMPACT ASSESSMENT ,OR RECORDS TO ENSURE COMPLIANCE WITH THIS PART16, ANDTHERISKMANAGEMENTPOLICY ,IMPACTASSESSMENT ,ANDRECORDS ARENOTSUBJECTTODISCLOSUREUNDERTHE "COLORADO O PENR ECORDS A CT",PART2 OFARTICLE72 OF TITL24.IN A DISCLOSURE PURSUANT TO THIS SUBSECTION(9),A DEPLOYER MAY DESIGNATE THE STATEMENT OR DOCUMENTATIONASINCLUDINGPROPRIETARYINFORMATIONORATRADE SECRET.TOTHEEXTENTTHATANYINFORMATIONCONTAINEDINTHERISK MANAGEMENT POLICY , IMPACT ASSESSMENT , OR RECORDS INCLUDE INFORMATION SUBJECT TO ATTORNEY -CLIENT PRIVILEGE OR WORK -PRODUCT PROTECTION,THE DISCLOSURE DOES NOT CONSTITUTE A WAIVER OF THE PRIVILEGE OR PROTECTIO.
6-1-1604.
Disclosure of an artificial intelligence system to consumer.
(1) O N AND AFTER FEBRUARY 1, 2026AND EXCEPT AS PROVIDED IN SUBSECTION(2)OF THIS SECTIO, A DEPLOYER OR OTHER -23- 205 DEVELOPER THAT DEPLOYS ,OFFERS,SELLS,LEASES,LICENSES,GIVES,OR OTHERWISE MAKES AVAILABLE AN ARTIFICIAL INTELLIGENCE SYSTEM THAT IS INTENDED TO INTERACT WITH CONSUMERS SHALL ENSURE THE DISCLOSURE TO EACH CONSUMER WHO INTERACTS WITH THE ARTIFICIAL INTELLIGENCE SYSTEM THAT THE CONSUMER IS INTERACTING WITH AN ARTIFICIAL INTELLIGENCE SYSTEM.
(2) DISCLOSURE ISNOT REQUIREDUNDERSUBSECTION (1OFTHIS SECTION UNDER CIRCUMSTANCES IN WHICH IT WOULD BE OBVIOUS TO A REASONABLEPERSONTHATTHEPERSONISINTERACTINGWITHAHIGH -RISK ARTIFICIAL INTELLIGENCE SYSTEM.
6-1-1605.
Compliance with other legal obligations - definitions.
(1) OTHING IN THIS PAR16 RESTRICTS A DEVELOPER'S,A DEPLOYER 'S,OR OTHER PERSON S ABILITY T:
(a) COMPLY WITH FEDERAL , STATE, OR MUNICIPAL LAWS , ORDINANCES ,OR REGULATIONS ;
(b) C OMPLY WITH A CIVI,CRIMINAL ,OR REGULATORY INQUIRY , INVESTIGATION ,SUBPOENA , OR SUMMONS BY A FEDERAL , A STATE, A MUNICIPAL ,OR OTHER GOVERNMENTAL AUTHORITY ;
(c) COOPERATEWITHALAWENFORCEMENTAGENCYCONCERNING CONDUCT OR ACTIVITY THAT THE DEVELOPER ,DEPLOYER , OR OTHER PERSON REASONABLY AND IN GOOD FAITH BELIEVES MAY VIOLATE FEDERAL ,STATE ,OR MUNICIPAL LAWS,ORDINANCES OR REGULATIONS ;
(d) IVESTIGATE ,ESTABLISH,EXERCISE PREPAREFOR ORDEFEND LEGAL CLAIMS ;
(e) T AKE IMMEDIATE STEPS TO PROTECT AN INTEREST THAT IS ESSENTIAL FOR THE LIFE OR PHYSICAL SAFETY OF A CONSUMER OR ANOTHER INDIVIDUAL ;
-24- 205 (f) BYANYMEANSOTHER THAN THE USE OFFACIALRECOGNITION TECHNOLOGY ,PREVENT ,DETECT ,PROTECT AGAINST ,OR RESPOND TO SECURITYINCIDENTS ,IDENTITYTHEFT,FRAUD ,HARASSMENT ,MALICIOUS OR DECEPTIVE ACTIVITIE,OR ILLEGAL ACTIVIT;INVESTIGATE,REPORT , OR PROSECUTE THE PERSONS RESPONSIBLE FOR ANY SUCH ACTION ;OR PRESERVE THE INTEGRITY OR SECURITY OF SYSTEM;
(g) E NGAGE IN PUBLIC OR PEER -REVIEWED SCIENTIFIC OR STATISTICAL RESEARCH IN THE PUBLIC INTEREST THAT ADHERES TO ALL OTHER APPLICABLE ETHICS AND PRIVACY LAWS AND IS CONDUCTED IN ACCORDANCE WITH 45 CFR 46, AS AMENDED , OR RELEVANT REQUIREMENTS ESTABLISHED BY THE FEDERAL FOOD AND DRUG ADMINISTRATION ;
(h) CONDUCTRESEARCH ,TESTINGANDDEVELOPMENTACTIVITIES REGARDINGANARTIFICIALINTELLIGENCESYSTEMORMODEL ,OTHERTHAN TESTING CONDUCTED UNDER REAL -WORLD CONDITIONS , BEFORE THE ARTIFICIALINTELLIGENCESYSTEMORMODELISPLACEDONTHE MARKET , DEPLOYED ,OR PUT INTO SERVIC,AS APPLICABLE;OR (i) ASSIST ANOTHER DEVELOPER ,DEPLOYER ,OR OTHER PERSON WITH ANY OF THE OBLIGATIONS IMPOSED UNDER THIS PART16.
(2) THE OBLIGATIONS IMPOSED ON DEVELOPERS,DEPLOYERS ,OR OTHERPERSONSUNDERTHISPART 16 DONOTRESTRICT ADEVELOPER S,A DEPLOYER ',OR OTHER PERSON S ABILITY T:
(a) EFFECTUATE A PRODUCT RECALL ;OR (b) IDENTIFY AND REPAIR TECHNICAL ERRORS THAT IMPAIR EXISTING OR INTENDED FUNCTIONALITY.
(3) THE OBLIGATIONS IMPOSED ON DEVELOPERS,DEPLOYERS ,OR OTHER PERSONS UNDER THIS PART16 DONOT APPLY WHERE COMPLIANCE -25- 205 WITH THIS PART 16 BY THE DEVELOPER, DEPLOYER, OR OTHER PERSON WOULD VIOLATE AN EVIDENTIARY PRIVILEGE UNDER THE LAWS OF THIS STATE .
(4) N OTHING IN THIS PART16 IMPOSES ANY OBLIGATION ON A DEVELOPER ,A DEPLOYER ,OR OTHER PERSON THAT ADVERSELY AFFECTS THE RIGHTS OR FREEDOMS OF A PERSON ,INCLUDING THE RIGHTS OF A PERSON TO FREEDOM OF SPEECH OR FREEDOM OF THE PRESS THAT ARE GUARANTEED IN :
(a) THEFIRSTAMENDMENTTOTHE U NITEDSTATESCONSTITUTION ;
OR (b) SECTION 10OF ARTICLEIIOF THE STATE CONSTITUTION.
(5) N OTHING IN THIS PART 16 APPLIES TO A DEVELOPER ,A DEPLOYER ,OR OTHER PERSON :
(a) INSOFAR AS THE DEVELOPER ,DEPLOYER ,OR OTHER PERSON DEVELOPS , DEPLOYS, PUTS INTO SERVICE ,OR INTENTIONALLY AND SUBSTANTIALLY MODIFIES , AS APPLICABLE, A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM :
(I) TATHASBEENAPPROVED ,AUTHORIZED ,CERTIFIE,CLEARED , OR GRANTED BY A FEDERAL AGENCY ,SUCH AS THE FEDERAL FOOD AND DRUG ADMINISTRATION OR THE FEDERAL AVIATION ADMINISTRATION , ACTING WITHIN THE SCOPE OF THE FEDERAL AGENCYS AUTHORITY;
OR (II) IOMPLIANCEWITHSTANDARDSESTABLISHEDBYAFEDERAL AGENCY ,INCLUDING STANDARDS ESTABLISHED BY THE FEDERAL OFFICE OF THE NATIONAL COORDINATOR FOR HEALTH INFORMATION TECHNOLOGY ;
(b) C ONDUCTING RESEARCH TO SUPPORT AN APPLICATION FOR APPROVAL OR CERTIFICATION FROM A FEDERAL AGENCY,INCLUDING THE -26- 205 FEDERAL AVIATION ADMINISTRATION ,THE FEDERAL COMMUNICATIONS COMMISSION ,OR THE FEDERAL FOOD AND DRUG ADMINISTRATION OR RESEARCH TO SUPPORT AN APPLICATION OTHERWISE SUBJECT TO REVIEW BY THE FEDERAL AGENCY;
(c) P ERFORMING WORK UNDER ,OR IN CONNECTION WITH , A CONTRACT WITH THE U NITEDSTATES DEPARTMENT OF COMMERCE ,THE U NITED S TATES DEPARTMENT OF DEFENSE , OR THE NATIONAL AERONAUTICS AND SPACE ADMINISTRATION ,UNLESS THE DEVELOPER , DEPLOYER ,OR OTHER PERSON IS PERFORMING THE WORK ON A HIRISK ARTIFICIAL INTELLIGENCE SYSTEM THAT IS USED TO MAKE ,OR IS A SUBSTANTIALFACTORINMAKING ,ADECISIONCONCERNINGEMPLOYMENT OR HOUSING;OR (d) THAT IS A COVERED ENTITY WITHIN THE MEANING OF THE FEDERAL "HEALTH INSURANCE PORTABILITYAND A CCOUNTABILITY ACT OF 1996", 42 U.S.CSECS.
1320dTO 1320d-9,AND THE REGULATIONS PROMULGATED UNDER THE FEDERAL ACT ,AS BOTH MAY BE AMENDED FROMTIMETOTIME ,ANDISPROVIDINGHEALTH -CARERECOMMENDATIONS THAT :
(I) ARE GENERATED BY AN ARTIFICIAL INTELLIGENCE SYST;M (II) REQUIRE A HEALTH CARE PROVIDER TO TAKE ACTION TO IMPLEMENT THE RECOMMENDATIONS ;AND (III) AE NOT CONSIDERED TO BE HIGH RI.K (6) NOTHING IN THIS PART 16 APPLIES TO ANY ARTIFICIAL INTELLIGENCE SYSTEM THAT IS ACQUIRED BY OR FOR THE FEDERAL GOVERNMENTORANYFEDERALAGENCYORDEPARTMENT INCLUDINGTHE U NITED STATES DEPARTMENT OF COMMERCE , THE U NITED STATES DEPARTMENT OF DEFENSE ,OR THE NATIONAL AERONAUTICS AND SPACE -27- 205 ADMINISTRATION ,UNLESS THE ARTIFICIAL INTELLIGENCE SYSTEM IS A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM THAT IS USED TO MORE IS A SUBSTANTIAL FACTOR IN MAKING , A DECISION CONCERNING EMPLOYMENT OR HOUSING .
(7) A N INSURER ,AS DEFINED IN SECTION 10-1-102 (13)OR FRATERNAL BENEFIT SOCIETY,AS DEFINED IN SECTION10-14-102,IS IN FULL COMPLIANCE WITH THIS PART 16 IF THE INSURER OR FRATERNAL BENEFIT SOCIETY HAS IMPLEMENTED AND MAINTAINS A WRITTEN ARTIFICIALINTELLIGENCE SYSTEMS PROGRAM IN ACCORDANCE WITH ALL REQUIREMENTSESTABLISHEDBYTHE COMMISSIONEROFINSURANCE AND THE REQUIREMENTS ESTABLISHED BY THE COMMISSIONER OF INSURANCE ARE SUBSTANTIALLY EQUIVALENT OR MORE STRINGENT THAN THE REQUIREMENTS OF THIS PART16.
(8) (a) AANK ,OUT OF-STATE BANK CREDIT UNION CHARTERED BY THE STATE OF COLORADO ,FEDERAL CREDIT UNION, OUT-OF-STATE CREDIT UNION,OR ANY AFFILIATE OR SUBSIDIARY THEREOF,IS IN FULL COMPLIANCE WITH THIS PART 16 IF THE BANK,OUT -OFSTATE BANK , CREDITUNIONCHARTEREDBYTHESTATEOF COLORADO ,FEDERALCREDIT UNION ,OUT-OF-STATE CREDIT UNION,OR AFFILIATE OR SUBSIDIARY IS SUBJECT TO EXAMINATION BY A STATE OR FEDERAL PRUDENTIAL REGULATOR UNDER ANY PUBLISHED GUIDANCE OR REGULATIONS THAT APPLY TO THE USE OFHIG-RISKARTIFICIALINTELLIGENCE SYSTEMS AND THE GUIDANCE OR REGULATIONS :
(I) IPOSEREQUIREMENTSTHATARESUBSTANTIALLYEQUIVALENT TO OR MORE STRINGENT THAN THE REQUIREMENTS IMPOSED IN THIS PART 16;AND (II) AT A MINIMUM ,REQUIRE THE BANK, OUT-OF-STATE BANK, -28- 205 CREDITUNIONCHARTEREDBYTHESTATEOF COLORADO ,FEDERALCREDIT UNION,OUT -OF-STATE CREDIT UNION,OR AFFILIATE OR SUBSIDIARY TO:
(A) R EGULARLY AUDIT THE BANK 'S,OUT -OF-STATE BANK 'S, CREDIT UNION CHARTERED BY THE STATE OF C OLORADO 'S,FEDERAL CREDIT UNION S, OUT-OF-STATE CREDIT UNION S, OR AFFILIATE'S OR SUBSIDIARY'S USE OF HIG-RISK ARTIFICIAL INTELLIGENCE SYSTEMS FOR COMPLIANCE WITH STATE AND FEDERALANTIDISCRIMINATION LAWS AND REGULATIONS APPLICABLE TO THE BANK ,OUT OF STATE BANK ,CREDIT UNIONCHARTEREDBYTHESTATEOF C OLORADO ,FEDERALCREDITUNION , OUT-OF-STATE CREDIT UNION,OR AFFILIATE OR SUBSIDIARY;AND (B) MITIGATEANYALGORITHMICDISCRIMINATIONCAUSEDBYTHE USE OF A HIG-RISK ARTIFICIAL INTELLIGENCE SYSTEM OR ANY RISK OF ALGORITHMIC DISCRIMINATION THAT IS REASONABLY FORESEEABLE AS A RESULT OF THE USE OF A HIG-RISK ARTIFICIAL INTELLIGENCE SYSTE.
(b) AS USED IN THIS SUBSECTION(8):
(I) "A FFILIATE" HAS THE MEANING SET FORTH IN SECTION 11-101-401(3.5).
(II) "BNK "HASTHEMEANINGSETFORTHINSECTION 11-101-401 (5).
(III) "CEDIT UNION "HAS THE MEANING SET FORTH IN SECTION 11-30-101 (1)(a).
(IV) "O UT-OF-STATE BANK " HAS THE MEANING SET FORTH IN SECTION11-101-401 (50).
(9) I A DEVELOPER,A DEPLOYER ,OR OTHER PERSON ENGAGES IN ANACTIONPURSUANTTOANEXEMPTIONSETFORTHINTHISSECTION ,THE DEVELOPER , DEPLOYER , OR OTHER PERSON BEARS THE BURDEN OF DEMONSTRATING THAT THE ACTION QUALIFIES FOR THE EXEMPTION .
-29- 205 6-1-1606.
Enforcement by attorney general.
(1) NOTWITHSTANDING SECTION 6-1-103,THE ATTORNEY GENERAL HAS EXCLUSIVE AUTHORITY TO ENFORCE THIS PART16.
(2) EXCEPT AS PROVIDED IN SUBSECTION(3OF THIS SECTION,A VIOLATION OF THE REQUIREMENTS ESTABLISHED IN THIS PART 16 CONSTITUTESANUNFAIRTRADEPRACTICEPURSUANTTOSECTION 6-1-105 (1)(eeee).
(3) N ANY ACTION COMMENCED BY THE ATTORNEY GENERAL TO ENFORCE THIS PART 16, IT IS AN AFFIRMATIVE DEFENSE THAT THE DEVELOPER ,DEPLOYER ,OR OTHER PERSON:
(a) DISCOVERS A VIOLATION OF THIS PA16 AS A RESULT O:
(I) F EEDBACK THAT THE DEVELOPER , DEPLOYER, OR OTHER PERSON ENCOURAGES DEPLOYERS OR USERS TO PROVIDE TO THE DEVELOPER ,DEPLOYER ,OR OTHER PERSON;
(II) ADVERSARIAL TESTING OR RED TEAMING,AS THOSE TERMS ARE DEFINED OR USED BY THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY ;OR (III) A INTERNAL REVIEW PROCESS;AND (b) S OTHERWISE IN COMPLIANCE WITH:
(I) TE LATEST VERSION OFTHE"A RTIFICIAINTELLIGENCE RISK M ANAGEMENT FRAMEWORK "PUBLISHEDBYTHENATIONALINSTITUTEOF STANDARDS AND TECHNOLOGY IN THE UNITED STATES DEPARTMENT OF COMMERCE AND STANDARD ISO/IEC 42001 OF THE INTERNATIONAL O RGANIZATION FORS TANDARDIZATION ;
(II) ANOTHER NATIONALLY OR INTERNATIONALLY RECOGNIZED RISKMANAGEMENTFRAMEWORKFORARTIFICIALINTELLIGENCESYSTEMS ;
OR -30- 205 (III) ANY RISK MANAGEMENT FRAMEWORK FOR ARTIFICIAL INTELLIGENCESYSTEMSTHATTHEATTORNEYGENERAL ,INTHEATTORNEY GENERAL S DISCRETION,MAY DESIGNATE AND , IF DESIGNATED,SHALL PUBLICLY DISSEMINATE.
(4) A DEVELOPER ,A DEPLOYER ,OR OTHER PERSON BEARS THE BURDEN OF DEMONSTRATING TO THE ATTORNEY GENERAL THAT THE REQUIREMENTS ESTABLISHED IN SUBSECTION(3)OF THIS SECTION HAVE BEEN SATISFIE.
(5) N OTHING IN THIS PART16,INCLUDING THE ENFORCEMENT AUTHORITY GRANTED TO THE ATTORNEY GENERAL UNDER THIS SECTION, PREEMPTS OR OTHERWISE AFFECTS ANY RIGHT , CLAIM , REMEDY , PRESUMPTION , OR DEFENSE AVAILABLE AT LAW OR IN EQUITY .
A REBUTTABLE PRESUMPTION OR AFFIRMATIVE DEFENSE ESTABLISHED UNDER THIS PART 16 APPLIES ONLY TO AN ENFORCEMENT ACTION BROUGHT BY THE ATTORNEY GENERAL PURSUANT TO THIS SECTION AND DOES NOT APPLY TO ANY RIGHT , CLAIM,REMEDY ,PRESUMPTION, OR DEFENSE AVAILABLE AT LAW OR IN EQUIT.
(6) THIS PART16DOES NOT PROVIDE THE BASIS FO,AND IS NOT SUBJECT TO,A PRIVATE RIGHT OF ACTION FOR VIOLATIONS OF THIS PART 16 OR ANY OTHER LAW.
6-1-1607.
Rules.(1) TATTORNEYGENERALMAYPROMULGATE RULES AS NECESSARY FOR THE PURPOSE OF IMPLEMENTING AND ENFORCING THIS PART16,INCLUDING:
(a) THE DOCUMENTATION AND REQUIREMENTS FOR DEVELOPERS PURSUANT TO SECTION 6-1-1602 (2);
(b) THE CONTENTS OF AND REQUIREMENTS FOR THE NOTICES AND DISCLOSURESREQUIREDBYSECTIONS 6-1-1602(5)AND (7);6-1-1603(4), -31- 205 (5), (7AND (9)AND 6-1-1604;
(c) TECONTENTANDREQUIREMENTSOFTHERISKMANAGEMENT POLICY AND PROGRAM REQUIRED BY SECTION6-1-1603 (2);
(d) THE CONTENT AND REQUIREMENTS OF THE IMPACT ASSESSMENTS REQUIRED BY SECTION6-1-1603 (3);
(e) TEREQUIREMENTSFORTHEREBUTTABLEPRESUMPTIONSSET FORTH IN SECTIONS6-1-1602AND 6-1-1603AND (f) HEREQUIREMENTSFORTHEAFFIRMATIVEDEFENSESETFORTH IN SECTION 6-1-1606 (3),INCLUDING THE PROCESS BY WHICH THE ATTORNEY GENERAL WILL RECOGNIZE ANY OTHER NATIONALLY OR INTERNATIONALLY RECOGNIZED RISK MANAGEMENT FRAMEWORK FOR ARTIFICIAL INTELLIGENCE SYSTEM.
SECTION 2.
In Colorado Revised Statutes, 6-1-105, add (1)(eeee) as follows:
6-1-105.
Unfair or deceptive trade practices.
(1) A person engages in a deceptive trade practice when, in the course of the person's business, vocation, or occupation, the person:
(eeee) VIOLATES PART16OF THIS ARTICL1.
SECTION 3.
Safety clause.
The general assembly finds, determines, and declares that this act is necessary for the immediate preservationofthepublicpeace,health,orsafetyorforappropriationsfor the support and maintenance of the departments of the state and state institutions.
-32- 205