Colorado AI Act: requirements, deadlines and compliance actions

Deployers of high-risk AI must implement a risk-management policy and programme governing deployment, specifying principles, processes and personnel used to identify, document and mitigate known or reasonably foreseeable risks of algorithmic discrimination, and reasonable in light of recognised frameworks such as the NIST AI RMF or ISO/IEC 42001.

Practical action: Adopt an AI risk policy referencing NIST AI RMF or ISO/IEC 42001 and keep programme records.

Evidence examples: AI risk management policy and programme

Framework mapping (original, editorial): NIST AI RMF 1.0 Whole framework (named in the statute); ISO/IEC 42001:2023 Whole management system (named in the statute)

Open the obligation page →C.R.S. 6-1-1703(2) Pending review (a factual check against the official source, not a legal review)

Deployers must complete an impact assessment before deployment, annually, and within 90 days of any intentional and substantial modification, covering purpose, risks of algorithmic discrimination and mitigation, data categories, performance metrics, transparency measures and post-deployment monitoring, and retain assessments for at least three years.

Practical action: Build an impact-assessment template aligned with the statutory elements and calendar the annual refresh.

Evidence examples: Algorithmic impact assessment

Framework mapping (original, editorial): ISO/IEC 42001:2023 Clause 6.1.4 AI system impact assessment; NIST AI RMF 1.0 MAP 5.x

Open the obligation page →C.R.S. 6-1-1703(3) Pending review (a factual check against the official source, not a legal review)

Before a high-risk system makes a consequential decision, deployers must notify the consumer that AI is used, describe its purpose and nature, and provide contact and opt-out information where applicable. After an adverse decision they must state the principal reasons, the data used and its sources, and offer an opportunity to correct data and to appeal for human review where feasible.

Practical action: Add pre-decision AI notices and an adverse-decision explanation and appeal workflow.

Evidence examples: Consumer notice and adverse-action explanation templates

Framework mapping (original, editorial): NIST AI RMF 1.0 GOVERN 5.x, MANAGE 4.x

Open the obligation page →C.R.S. 6-1-1703(4) Pending review (a factual check against the official source, not a legal review)

Developers must make available to deployers a general statement of intended uses, documentation of known or reasonably foreseeable risks of algorithmic discrimination, training-data summaries, limitations, performance evaluation and mitigation measures, and information needed for deployer impact assessments, and must publish a public statement describing their high-risk systems and how they manage discrimination risks.

Practical action: Prepare a deployer information pack and a public high-risk systems statement.

Evidence examples: Deployer documentation pack; Public statement on high-risk systems

Framework mapping (original, editorial): NIST AI RMF 1.0 GOVERN 1.4, MAP 3.x

Open the obligation page →C.R.S. 6-1-1702 Pending review (a factual check against the official source, not a legal review)

A developer of a high-risk AI system must use reasonable care to protect consumers from any known or reasonably foreseeable risk of algorithmic discrimination arising from the intended and contracted uses of the system. A developer that meets the documentation, public-statement and Attorney General disclosure duties in the rest of section 6-1-1702 benefits from a rebuttable presumption that it used reasonable care.

Practical action: Run and record a discrimination-risk assessment for each high-risk system before release and keep it current so the statutory presumption can be claimed.

Evidence examples: Algorithmic discrimination risk assessment; Bias evaluation results and mitigation record

Framework mapping (original, editorial): NIST AI RMF 1.0 MAP 1.1, MEASURE 2.11, MANAGE 1.3; ISO/IEC 42001:2023 Clause 6.1.2, 6.1.3

Open the obligation page →C.R.S. 6-1-1702(1) Pending review (a factual check against the official source, not a legal review)

Within 90 days after a developer discovers, through ongoing testing or a credible report from a deployer, that a high-risk AI system it developed has caused or is reasonably likely to have caused algorithmic discrimination, it must disclose this to the Colorado Attorney General and to all known deployers or other developers of the system, without unreasonable delay.

Practical action: Route bias findings and deployer complaints into an incident process with a 90-day regulatory and customer notification clock.

Evidence examples: Discrimination incident log with notification dates; Attorney General and deployer notification letters

Framework mapping (original, editorial): NIST AI RMF 1.0 MANAGE 4.3, GOVERN 6.2; ISO/IEC 42001:2023 Clause 10.2; Annex A.8.4

Open the obligation page →C.R.S. 6-1-1702(5) Pending review (a factual check against the official source, not a legal review)

A deployer of a high-risk AI system must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. A deployer that runs the required risk-management programme, completes impact assessments, gives consumer notices and makes the required disclosures benefits from a rebuttable presumption of reasonable care; some deployers with fewer than 50 employees are relieved of parts of the programme and assessment duties when they rely on the developer's impact assessment.

Practical action: Treat each consequential-decision use of AI as a governed system with an owner, a risk record and the statutory paperwork so the presumption is available.

Evidence examples: Deployer compliance checklist per high-risk system

Framework mapping (original, editorial): NIST AI RMF 1.0 GOVERN 1.1, MANAGE 1.3; ISO/IEC 42001:2023 Clause 6.1.2; Annex A.9.2

Open the obligation page →C.R.S. 6-1-1703(1) Pending review (a factual check against the official source, not a legal review)

A deployer must make available on its website, or in another public way, a clear and readily available statement summarising the types of high-risk AI systems it currently deploys, how it manages known or reasonably foreseeable risks of algorithmic discrimination from those systems, and the nature, source and extent of the information it collects and uses. The statement must be updated periodically.

Practical action: Publish an AI-use page listing high-risk systems in plain language and review it whenever a system is added or changed.

Evidence examples: Public statement on high-risk AI use

Framework mapping (original, editorial): NIST AI RMF 1.0 GOVERN 4.2, MAP 5.2; ISO/IEC 42001:2023 Annex A.8.5

Open the obligation page →C.R.S. 6-1-1703(5) Pending review (a factual check against the official source, not a legal review)

If a deployer discovers that a high-risk AI system it uses has caused algorithmic discrimination, it must send a notice to the Colorado Attorney General within 90 days of the discovery, in the form the Attorney General prescribes, without unreasonable delay.

Practical action: Add a 90-day Attorney General notification step to the incident playbook for consequential-decision systems.

Evidence examples: Attorney General notification record

Framework mapping (original, editorial): NIST AI RMF 1.0 MANAGE 4.3; ISO/IEC 42001:2023 Annex A.8.4

Open the obligation page →C.R.S. 6-1-1703(7) Pending review (a factual check against the official source, not a legal review)

Any developer or deployer that makes an AI system available to consumers that is intended to interact with them must disclose to each consumer that they are interacting with an AI system, unless that would be obvious to a reasonable person. This duty is not limited to high-risk systems and covers chatbots and voice agents offered to Colorado consumers.

Practical action: Add an AI disclosure at the start of chatbot, voice and messaging interactions and record where it appears.

Evidence examples: AI interaction disclosure copy and screenshots

Framework mapping (original, editorial): NIST AI RMF 1.0 GOVERN 5.1, MANAGE 4.1; ISO/IEC 42001:2023 Annex A.8.5

Open the obligation page →C.R.S. 6-1-1704 Pending review (a factual check against the official source, not a legal review)