Understanding Colorado's AI Act: Key Points for Enterprises Adopting High-Risk AI

On May 17th, 2024, Colorado Governor Jared Polis signed Senate Bill 24-205 into law, introducing the “Colorado Artificial Intelligence (AI) Act.” This landmark legislation, effective February 1, 2026, makes  Colorado one of the first U.S. states to implement cross-sector legislation on the use and development of AI systems in the private and public sectors. 

Companies deploying  AI systems dealing with employment, education enrollment, financial or lending services, essential government services, healthcare services, housing, insurance, or legal services are likely to be affected by the obligations required by the Colorado AI Act. 

The Colorado AI Act primarily targets “high-risk” AI systems that make “consequential decisions,” with the aim of preventing those systems from furthering algorithmic discrimination. For high-risk AI systems, the Colorado AI Act outlines documentation requirements for developers before the system is made available to deployers, and ongoing transparency, and risk management requirements to mitigate algorithmic discrimination. 

Exclusions from the high-risk category include:

• AI systems intended perform narrow procedural tasks; 
• AI systems intended to detect decision-making patterns or deviations from prior decision-making patterns, and are not intended to replace or influence human assessment;
• specific technologies, including anti-fraud, anti-malware, and cybersecurity technologies, among other low-risk technologies; and, 
• technology that communicates with consumers in natural language for the purpose of providing users with iformation, making referrals or recommendations, and  answering questions and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful.  

Scope and Relevance to Enterprises

The Colorado AI Act focuses on high-risk AI systems that make "consequential decisions." These are decisions with “substantial legal or significant impacts” on consumers in sectors such as employment, healthcare, insurance, financial services, and essential government services. 

Key Requirements for Developers

Developers are defined as: a person doing business in Colorado who develops or intentionally and substantially modifies an AI system.

Developers must: 

• provide extensive documentation to the deployer or other developers using the high-risk AI system including summaries of data used, known limitations, and details on performance evaluation and discrimination mitigation; and,
• publish a statement summarizing the high-risk AI system and risk management measures on the developer's website or in a public use case inventory.

Key Requirements for Deployers

‍Deployers are defined as:  means a person doing business in Colorado that deploys a high-risk artificial intelligence system.  

Deployers must:

• implement robust risk management policies and programs for high-risk AI systems;
• conduct and document impact assessments for these systems;
• notify consumers if a high-risk AI system has been deployed and provide an opportunity to opt out; and 
• publish a statement summarizing the types of high-risk systems deployed and how foreseeable algorithmic discrimination risks are managed. 

Any discovered algorithmic discrimination must be reported to the Attorney General within 90 days. In the case of developers, they must also notify all known deployers or other developers of the high-risk  artificial intelligence system within 90 days.

Definitions and Exemptions

Understanding the Act's definitions is crucial for compliance:

• High-risk AI system: any  artificial intelligence system that makes or is a substantial factor in making a consequential decision. 
• Algorithmic discrimination: any unlawful differential treatment based on protected characteristics.
• Consequential decision:  a decision that has a significant legal or similar impact on providing, denying, or altering the cost or terms of:  some text
  • education enrollment or an education opportunity;  
  • employment or an employment opportunity;  
  • a financial or lending service;  
  • an essential government service; 
  • health-care services;  
  • housing;  
  • insurance; or  
  • a legal service.

Exemptions include AI systems performing narrow procedural tasks or those used for anti-fraud, cybersecurity, or similar technical functions unless they influence consequential decisions.

Enforcement and Compliance

The Colorado Attorney General’s office is responsible for enforcement, with the authority to implement further rules and requirements. Both developers and deployers must demonstrate compliance with risk management requirements and will be subject to scrutiny by the Attorney General.

The statute takes effect on February 1, 2026.

Conclusion

For enterprises adopting high-risk AI, the Colorado AI Act introduces requirements aimed at preventing discrimination and ensuring transparency and accountability. Compliance will involve thorough documentation, proactive risk management, and public disclosure practices. 

Enterprises should not delay to align their AI systems and policies with Colorado’s AI Act and sector-specific regulations already in effect in Colorado and other states. Enterprises that innovate with safeguards in place can build products more efficiently in the long run, ensuring compliance with regulatory requirements. Credo AI can help you start this journey and accelerate your AI adoption goals.

Reach out today to discover how Credo AI can support you and your enterprise with comprehensive AI risk management solutions.

‍