Developers must notify the Attorney General and deployers of discovered algorithmic discrimination
Download: JSON · MarkdownUnder Colorado AI Act, C.R.S. 6-1-1702(5)
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 9 sections
In brief
Developers must notify the Attorney General and deployers of discovered algorithmic discrimination is a legal requirement under the Colorado AI Act in Colorado (United States) (C.R.S. 6-1-1702(5)). The record carries 2 evidence examples and mappings to 2 frameworks. In practice: Route bias findings and deployer complaints into an incident process with a 90-day regulatory and customer notification clock.
- Instrument
- Colorado AI Act
- Jurisdiction
- Colorado (United States)
- Nature
- Legal requirement
- Source reference
- C.R.S. 6-1-1702(5)
- Who it binds
- Provider / developer
- Evidence examples
- 2
- Framework mappings
- NIST AI Risk Management Framework 1.0, ISO/IEC 42001:2023
- Controls that meet it
- 2
- Official source
- Open official text
- Verification
- Pending review · source-linked
What does it require?
Within 90 days after a developer discovers, through ongoing testing or a credible report from a deployer, that a high-risk AI system it developed has caused or is reasonably likely to have caused algorithmic discrimination, it must disclose this to the Colorado Attorney General and to all known deployers or other developers of the system, without unreasonable delay.
Practical action
Route bias findings and deployer complaints into an incident process with a 90-day regulatory and customer notification clock.
Who does it apply to?
Developers of high-risk AI systems that become aware of algorithmic discrimination caused by their system.
Which controls meet this duty?
Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.
-
satisfiesProcessIncident coordinator · continuousAI incident management and regulatory reporting
Serves 14 recorded duties · evidence: AI incident response playbook, AI incident record, Incident report to an authority
Discrimination findings treated as reportable incidents with the 90-day clock.
-
supportsTechnical measureAI system owner · continuousPost-deployment monitoring and drift detection
Serves 10 recorded duties · evidence: Post-market monitoring plan, Monitoring dashboard or periodic monitoring report, Monitoring review decision
Ongoing testing is one of the discovery routes the statute names.
Templates that cover this duty
Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.
- AI Incident Response Playbook and Log
Procedure · DOCX and XLSX · v3
- ISO/IEC 42001 Gap Assessment and Statement of Applicability
Assessment · XLSX · v3
- NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk
Crosswalk · XLSX · v5
- AI Audit Evidence Tracker
Register · XLSX · v1
What evidence would a reviewer expect?
| Evidence | Type | Notes |
|---|---|---|
| Discrimination incident log with notification dates | register | |
| Attorney General and deployer notification letters | document |
Framework mappings
Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.
See every Colorado (United States) duty mapped this way →
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| NIST AI RMF 1.0 | MANAGE 4.3, GOVERN 6.2 | Incident communication to authorities and downstream parties. | medium |
| ISO/IEC 42001:2023 | Clause 10.2; Annex A.8.4 | Corrective action and incident communication. | medium |
Frequently asked questions
Is this a legal requirement?
Yes. It is a legal requirement under Colorado AI Act (C.R.S. 6-1-1702(5)).
Who must comply with this obligation?
Developers of high-risk AI systems that become aware of algorithmic discrimination caused by their system.
What evidence shows compliance?
A reviewer would expect: Discrimination incident log with notification dates; Attorney General and deployer notification letters.
Which frameworks map to this obligation?
It is mapped to NIST AI Risk Management Framework 1.0 MANAGE 4.3, GOVERN 6.2, ISO/IEC 42001:2023 Clause 10.2; Annex A.8.4. These are editorial crosswalks with a stated confidence, not official mappings.
Which controls satisfy this obligation?
AI incident management and regulatory reporting; Post-deployment monitoring and drift detection.
What should an organisation do in practice?
Route bias findings and deployer complaints into an incident process with a 90-day regulatory and customer notification clock.
Cite this record
AIPolicyTracker (2026). “Developers must notify the Attorney General and deployers of discovered algorithmic discrimination (Colorado AI Act)” [AIPT-OBL-0089, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0089 (accessed 8 November 2026). Data licensed CC BY 4.0.
Permanent id AIPT-OBL-0089: it never changes or gets reused, and its address keeps working if this page moves.
Cite the official text alongside it: SB24-205 Consumer Protections for Artificial Intelligence, Colorado General Assembly, https://leg.colorado.gov/bills/sb24-205.
BibTeX
@misc{aipolicytracker2026_developersmustnotifythea,
author = {{AIPolicyTracker}},
title = {{Developers must notify the Attorney General and deployers of discovered algorithmic discrimination (Colorado AI Act)}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-disclosure-to-attorney-general}},
url = {https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-disclosure-to-attorney-general},
urldate = {2026-11-08},
note = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}
Change history
No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.
Similar obligations in other instruments
- Report serious incidents to market surveillance authorities — EU AI Act, European Union
- Providers must take corrective action and inform the supply chain about non-conforming high-risk AI — EU AI Act, European Union
- Providers of systemic-risk GPAI models must track and report serious incidents to the AI Office — EU AI Act, European Union
- Report critical safety incidents to the Office of Emergency Services — California SB 53, California (United States)
- Implement reasonable security safeguards and notify breaches — India DPDP Act, India
- Deployers must notify the Attorney General of discovered algorithmic discrimination — Colorado AI Act, Colorado (United States)
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.