{"slug":"us-colorado-deployer-risk-management-program","id":"AIPT-OBL-0084","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0084","title":"Deployers must implement a risk management policy and programme","short_title":"Deployer risk management program","category":"risk_management","summary":"Deployers of high-risk AI must implement a risk-management policy and programme governing deployment, specifying principles, processes and personnel used to identify, document and mitigate known or reasonably foreseeable risks of algorithmic discrimination, and reasonable in light of recognised frameworks such as the NIST AI RMF or ISO/IEC 42001.\n","practical_action":"Adopt an AI risk policy referencing NIST AI RMF or ISO/IEC 42001 and keep programme records.","is_binding":true,"applies_from":null,"section":null,"source_reference":"C.R.S. 6-1-1703(2)","official_source_url":"https://leg.colorado.gov/bills/sb24-205","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null,"actors":["deployer"],"sectors":["employment","financial_services","healthcare","education","public_services"],"use_cases":["hiring_and_hr","finance_and_credit"],"applicability":[{"description":"Deployers of high-risk AI systems affecting Colorado consumers.","actors":["deployer"],"conditions":null}],"evidence_examples":[{"title":"AI risk management policy and programme","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"Whole framework (named in the statute)","note":"The statute names the AI RMF as a recognised framework.","confidence_level":"high","is_original":true},{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Whole management system (named in the statute)","note":"The statute names ISO/IEC 42001 as a recognised framework.","confidence_level":"high","is_original":true}],"controls":[{"slug":"ai-risk-assessment","title":"AI risk assessment and lifecycle risk register","kind":"process","relationship":"satisfies","note":"Per-system identification, documentation and mitigation of algorithmic discrimination risk.","confidence_level":"high","url":"https://aipolicytracker.org/controls/ai-risk-assessment"},{"slug":"ai-governance-policy-and-accountability","title":"AI governance policy and accountability structure","kind":"policy","relationship":"satisfies","note":"The risk-management policy, principles and personnel the statute expects.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-governance-policy-and-accountability"}],"url":"https://aipolicytracker.org/obligations/us-colorado-deployer-risk-management-program","policy":{"slug":"us-colorado-ai-act","title":"Colorado Senate Bill 24-205: Consumer Protections for Artificial Intelligence (Colorado AI Act)","status":"repealed","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/policies/us-colorado-ai-act"}}