Deployers must notify the Attorney General of discovered algorithmic discrimination

Practical action

Add a 90-day Attorney General notification step to the incident playbook for consequential-decision systems.

Who does it apply to?

Deployers of high-risk AI systems that discover the system has caused algorithmic discrimination.

Actors

Deployer / user organisation

Sectors

Employment and HRFinancial services and creditHealthcare and life sciencesEducation and trainingPublic services and government

Use cases

AI in hiring and employmentAI in healthcareAI in finance, credit and insuranceAI in educationAI in public services

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesProcessIncident coordinator · continuous
  AI incident management and regulatory reporting

  Serves 14 recorded duties · evidence: AI incident response playbook, AI incident record, Incident report to an authority

  Discrimination discovery treated as a reportable incident with the statutory clock.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• AI Incident Response Playbook and Log

  Procedure · DOCX and XLSX · v3

• ISO/IEC 42001 Gap Assessment and Statement of Applicability

  Assessment · XLSX · v3

• NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk

  Crosswalk · XLSX · v5

• AI Audit Evidence Tracker

  Register · XLSX · v1

All 6 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every Colorado (United States) duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Deployers must notify the Attorney General of discovered algorithmic discrimination (Colorado AI Act)” [AIPT-OBL-0092, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0092 (accessed 8 November 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0092: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: SB24-205 Consumer Protections for Artificial Intelligence, Colorado General Assembly, https://leg.colorado.gov/bills/sb24-205.

@misc{aipolicytracker2026_deployersmustnotifytheat,
  author       = {{AIPolicyTracker}},
  title        = {{Deployers must notify the Attorney General of discovered algorithmic discrimination (Colorado AI Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-disclosure-to-attorney-general}},
  url          = {https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-disclosure-to-attorney-general},
  urldate      = {2026-11-08},
  note         = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}

Change history

Similar obligations in other instruments

• Report serious incidents to market surveillance authorities — EU AI Act, European Union
• Providers must take corrective action and inform the supply chain about non-conforming high-risk AI — EU AI Act, European Union
• Providers of systemic-risk GPAI models must track and report serious incidents to the AI Office — EU AI Act, European Union
• Report critical safety incidents to the Office of Emergency Services — California SB 53, California (United States)
• Implement reasonable security safeguards and notify breaches — India DPDP Act, India
• Developers must notify the Attorney General and deployers of discovered algorithmic discrimination — Colorado AI Act, Colorado (United States)