{"slug":"us-colorado-ai-act-developer-disclosure-to-attorney-general","id":"AIPT-OBL-0089","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0089","title":"Developers must notify the Attorney General and deployers of discovered algorithmic discrimination","short_title":"Developer notice to the Attorney General","category":"incident_handling","summary":"Within 90 days after a developer discovers, through ongoing testing or a credible report from a deployer, that a high-risk AI system it developed has caused or is reasonably likely to have caused algorithmic discrimination, it must disclose this to the Colorado Attorney General and to all known deployers or other developers of the system, without unreasonable delay.\n","practical_action":"Route bias findings and deployer complaints into an incident process with a 90-day regulatory and customer notification clock.\n","is_binding":true,"applies_from":null,"section":null,"source_reference":"C.R.S. 6-1-1702(5)","official_source_url":"https://leg.colorado.gov/bills/sb24-205","review_status":"pending_review","confidence_level":"high","last_verified_at":null,"reviewed_by":null,"actors":["provider"],"sectors":["employment","financial_services","healthcare","education","public_services"],"use_cases":["hiring_and_hr","health","finance_and_credit","education","public_services"],"applicability":[{"description":"Developers of high-risk AI systems that become aware of algorithmic discrimination caused by their system.","actors":["provider"],"conditions":null}],"evidence_examples":[{"title":"Discrimination incident log with notification dates","description":null,"artifact_type":"register"},{"title":"Attorney General and deployer notification letters","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MANAGE 4.3, GOVERN 6.2","note":"Incident communication to authorities and downstream parties.","confidence_level":"medium","is_original":true},{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 10.2; Annex A.8.4","note":"Corrective action and incident communication.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"ai-incident-management-and-reporting","title":"AI incident management and regulatory reporting","kind":"process","relationship":"satisfies","note":"Discrimination findings treated as reportable incidents with the 90-day clock.","confidence_level":"high","url":"https://aipolicytracker.org/controls/ai-incident-management-and-reporting"},{"slug":"post-market-monitoring-and-drift-detection","title":"Post-deployment monitoring and drift detection","kind":"technical","relationship":"supports","note":"Ongoing testing is one of the discovery routes the statute names.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/post-market-monitoring-and-drift-detection"}],"url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-disclosure-to-attorney-general","policy":{"slug":"us-colorado-ai-act","title":"Colorado Senate Bill 24-205: Consumer Protections for Artificial Intelligence (Colorado AI Act)","status":"repealed","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/policies/us-colorado-ai-act"}}