Deployers must implement a risk management policy and programme

Practical action

Adopt an AI risk policy referencing NIST AI RMF or ISO/IEC 42001 and keep programme records.

Who does it apply to?

Deployers of high-risk AI systems affecting Colorado consumers.

Actors

Deployer / user organisation

Sectors

Employment and HRFinancial services and creditHealthcare and life sciencesEducation and trainingPublic services and government

Use cases

AI in hiring and employmentAI in finance, credit and insurance

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesProcessAI system owner · once per ai system
  AI risk assessment and lifecycle risk register

  Serves 12 recorded duties · evidence: AI system risk assessment, Per-system AI risk register, Residual-risk acceptance

  Per-system identification, documentation and mitigation of algorithmic discrimination risk.

• satisfiesPolicyExecutive sponsor for AI · annual
  AI governance policy and accountability structure

  Serves 16 recorded duties · evidence: AI policy, Board or executive approval of the AI policy, AI governance forum minutes

  The risk-management policy, principles and personnel the statute expects.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• AI Risk Register (MIT AI Risk Repository taxonomy)

  Register · XLSX · v4

• AI Impact Assessment

  Assessment · DOCX and XLSX · v5

• ISO/IEC 42001 Gap Assessment and Statement of Applicability

  Assessment · XLSX · v3

• NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk

  Crosswalk · XLSX · v3

All 6 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every Colorado (United States) duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Deployers must implement a risk management policy and programme (Colorado AI Act)” [AIPT-OBL-0084, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0084 (accessed 27 October 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0084: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: SB24-205 Consumer Protections for Artificial Intelligence, Colorado General Assembly, https://leg.colorado.gov/bills/sb24-205.

@misc{aipolicytracker2026_deployersmustimplementar,
  author       = {{AIPolicyTracker}},
  title        = {{Deployers must implement a risk management policy and programme (Colorado AI Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/us-colorado-deployer-risk-management-program}},
  url          = {https://aipolicytracker.org/obligations/us-colorado-deployer-risk-management-program},
  urldate      = {2026-10-27},
  note         = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}

Change history

Similar obligations in other instruments

• Operators of high-impact AI must establish and operate a risk management plan — AI Basic Act, South Korea
• Deployers must use reasonable care to avoid algorithmic discrimination — Colorado AI Act, Colorado (United States)
• Apply minimum risk-management practices to high-impact AI — OMB M-25-21, United States
• Establish a risk management system for high-risk AI — EU AI Act, European Union
• Developers must use reasonable care to avoid algorithmic discrimination — Colorado AI Act, Colorado (United States)
• Ensure AI systems are safe, secure and robust throughout their lifecycle — UK AI regulation framework, United Kingdom (voluntary)
• Prioritise, respond to and monitor AI risks (Manage) — NIST AI RMF, United States (voluntary)