Deployers must complete impact assessments for high-risk AI

Practical action

Build an impact-assessment template aligned with the statutory elements and calendar the annual refresh.

Who does it apply to?

Deployers of high-risk AI systems.

Actors

Deployer / user organisation

Sectors

Employment and HRFinancial services and creditHealthcare and life sciencesEducation and trainingPublic services and government

Use cases

AI in hiring and employmentAI in healthcareAI in finance, credit and insurance

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesProcessAI system owner · once per ai system
  AI impact and fundamental-rights impact assessment

  Serves 11 recorded duties · evidence: AI impact assessment, Impact assessment approval, Impact assessment procedure and template

  Templated assessment aligned to the statutory elements, refreshed annually and on material change.

• supportsTechnical measureAI system owner · continuous
  Post-deployment monitoring and drift detection

  Serves 10 recorded duties · evidence: Post-market monitoring plan, Monitoring dashboard or periodic monitoring report, Monitoring review decision

  Post-deployment monitoring described in the assessment.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• Fundamental Rights Impact Assessment (FRIA)

  Assessment · DOCX and XLSX · v5

• AI Impact Assessment

  Assessment · DOCX and XLSX · v5

• ISO/IEC 42001 Gap Assessment and Statement of Applicability

  Assessment · XLSX · v3

• NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk

  Crosswalk · XLSX · v3

All 7 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every Colorado (United States) duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Deployers must complete impact assessments for high-risk AI (Colorado AI Act)” [AIPT-OBL-0085, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0085 (accessed 27 October 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0085: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: SB24-205 Consumer Protections for Artificial Intelligence, Colorado General Assembly, https://leg.colorado.gov/bills/sb24-205.

@misc{aipolicytracker2026_deployersmustcompleteimp,
  author       = {{AIPolicyTracker}},
  title        = {{Deployers must complete impact assessments for high-risk AI (Colorado AI Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/us-colorado-deployer-impact-assessment}},
  url          = {https://aipolicytracker.org/obligations/us-colorado-deployer-impact-assessment},
  urldate      = {2026-10-27},
  note         = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}

Change history

Similar obligations in other instruments

• Carry out a fundamental rights impact assessment before deployment — EU AI Act, European Union
• Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits — India DPDP Act, India
• Carry out a data protection impact assessment for high-risk AI processing — ICO AI guidance, United Kingdom
• Conduct a data protection impact assessment for high-risk processing using new technologies — UAE PDPL, United Arab Emirates
• Map context, intended use and potential impacts (Map) — NIST AI RMF, United States (voluntary)
• Operators of high-impact AI should assess its impact on fundamental rights before use — AI Basic Act, South Korea (voluntary)