Developers must use reasonable care to avoid algorithmic discrimination
Download: JSON · MarkdownUnder Colorado AI Act, C.R.S. 6-1-1702(1)
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 9 sections
In brief
Developers must use reasonable care to avoid algorithmic discrimination is a legal requirement under the Colorado AI Act in Colorado (United States) (C.R.S. 6-1-1702(1)). A developer of a high-risk AI system must use reasonable care to protect consumers from any known or reasonably foreseeable risk of algorithmic discrimination arising from the intended and contracted uses of the system.
- Instrument
- Colorado AI Act
- Jurisdiction
- Colorado (United States)
- Nature
- Legal requirement
- Source reference
- C.R.S. 6-1-1702(1)
- Who it binds
- Provider / developer
- Evidence examples
- 2
- Framework mappings
- NIST AI Risk Management Framework 1.0, ISO/IEC 42001:2023
- Controls that meet it
- 2
- Official source
- Open official text
- Verification
- Pending review · source-linked
What does it require?
A developer of a high-risk AI system must use reasonable care to protect consumers from any known or reasonably foreseeable risk of algorithmic discrimination arising from the intended and contracted uses of the system. A developer that meets the documentation, public-statement and Attorney General disclosure duties in the rest of section 6-1-1702 benefits from a rebuttable presumption that it used reasonable care.
Practical action
Run and record a discrimination-risk assessment for each high-risk system before release and keep it current so the statutory presumption can be claimed.
Who does it apply to?
Developers doing business in Colorado that develop or intentionally and substantially modify a high-risk AI system.
Which controls meet this duty?
Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.
-
satisfiesProcessAI system owner · once per ai systemAI risk assessment and lifecycle risk register
Serves 12 recorded duties · evidence: AI system risk assessment, Per-system AI risk register, Residual-risk acceptance
Identifies and treats discrimination risk per system.
-
supportsTechnical measureQuality or testing lead · at launch and on material changeAccuracy, robustness, fairness and security testing
Serves 15 recorded duties · evidence: Pre-release test report, Test plan and acceptance criteria, Release test sign-off
Disparate-impact testing across protected classes.
Templates that cover this duty
Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.
- AI Risk Register (MIT AI Risk Repository taxonomy)
Register · XLSX · v4
- AI Impact Assessment
Assessment · DOCX and XLSX · v5
- ISO/IEC 42001 Gap Assessment and Statement of Applicability
Assessment · XLSX · v3
- NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk
Crosswalk · XLSX · v5
What evidence would a reviewer expect?
| Evidence | Type | Notes |
|---|---|---|
| Algorithmic discrimination risk assessment | report | |
| Bias evaluation results and mitigation record | record |
Framework mappings
Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.
See every Colorado (United States) duty mapped this way →
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| NIST AI RMF 1.0 | MAP 1.1, MEASURE 2.11, MANAGE 1.3 | Fairness and bias evaluated and managed. | medium |
| ISO/IEC 42001:2023 | Clause 6.1.2, 6.1.3 | AI risk assessment and treatment. | medium |
Frequently asked questions
Is this a legal requirement?
Yes. It is a legal requirement under Colorado AI Act (C.R.S. 6-1-1702(1)).
Who must comply with this obligation?
Developers doing business in Colorado that develop or intentionally and substantially modify a high-risk AI system.
What evidence shows compliance?
A reviewer would expect: Algorithmic discrimination risk assessment; Bias evaluation results and mitigation record.
Which frameworks map to this obligation?
It is mapped to NIST AI Risk Management Framework 1.0 MAP 1.1, MEASURE 2.11, MANAGE 1.3, ISO/IEC 42001:2023 Clause 6.1.2, 6.1.3. These are editorial crosswalks with a stated confidence, not official mappings.
Which controls satisfy this obligation?
AI risk assessment and lifecycle risk register; Accuracy, robustness, fairness and security testing.
What should an organisation do in practice?
Run and record a discrimination-risk assessment for each high-risk system before release and keep it current so the statutory presumption can be claimed.
Cite this record
AIPolicyTracker (2026). “Developers must use reasonable care to avoid algorithmic discrimination (Colorado AI Act)” [AIPT-OBL-0088, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0088 (accessed 8 November 2026). Data licensed CC BY 4.0.
Permanent id AIPT-OBL-0088: it never changes or gets reused, and its address keeps working if this page moves.
Cite the official text alongside it: SB24-205 Consumer Protections for Artificial Intelligence, Colorado General Assembly, https://leg.colorado.gov/bills/sb24-205.
BibTeX
@misc{aipolicytracker2026_developersmustusereasona,
author = {{AIPolicyTracker}},
title = {{Developers must use reasonable care to avoid algorithmic discrimination (Colorado AI Act)}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-reasonable-care}},
url = {https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-reasonable-care},
urldate = {2026-11-08},
note = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}
Change history
No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.
Similar obligations in other instruments
- Operators of high-impact AI must establish and operate a risk management plan — AI Basic Act, South Korea
- Deployers must use reasonable care to avoid algorithmic discrimination — Colorado AI Act, Colorado (United States)
- Apply minimum risk-management practices to high-impact AI — OMB M-25-21, United States
- Establish a risk management system for high-risk AI — EU AI Act, European Union
- Deployers must implement a risk management policy and programme — Colorado AI Act, Colorado (United States)
- Ensure AI systems are safe, secure and robust throughout their lifecycle — UK AI regulation framework, United Kingdom (voluntary)
- Prioritise, respond to and monitor AI risks (Manage) — NIST AI RMF, United States (voluntary)
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.