# Deployers must implement a risk management policy and programme

- **Record type**: Obligation
- **Instrument**: Colorado Senate Bill 24-205: Consumer Protections for Artificial Intelligence (Colorado AI Act)
- **Jurisdiction**: Colorado (United States)
- **Category**: risk_management
- **Binding**: Yes
- **Provision**: C.R.S. 6-1-1703(2)

## In brief

Deployers must implement a risk management policy and programme is a legal requirement under the Colorado AI Act in Colorado (United States) (C.R.S. 6-1-1703(2)). The record carries 1 evidence example and mappings to 2 frameworks. In practice: Adopt an AI risk policy referencing NIST AI RMF or ISO/IEC 42001 and keep programme records.

## What the duty requires

Deployers of high-risk AI must implement a risk-management policy and programme governing deployment, specifying principles, processes and personnel used to identify, document and mitigate known or reasonably foreseeable risks of algorithmic discrimination, and reasonable in light of recognised frameworks such as the NIST AI RMF or ISO/IEC 42001.

## What an organisation does about it

Adopt an AI risk policy referencing NIST AI RMF or ISO/IEC 42001 and keep programme records.

## Controls that meet this duty

- AI risk assessment and lifecycle risk register (satisfies): https://aipolicytracker.org/controls/ai-risk-assessment
- AI governance policy and accountability structure (satisfies): https://aipolicytracker.org/controls/ai-governance-policy-and-accountability

## Parent instrument

- Colorado Senate Bill 24-205: Consumer Protections for Artificial Intelligence (Colorado AI Act)
  - Record: https://aipolicytracker.org/policies/us-colorado-ai-act
  - Context file: https://aipolicytracker.org/policies/us-colorado-ai-act.md

## Provenance

- **Permanent id**: AIPT-OBL-0084 (https://aipolicytracker.org/id/AIPT-OBL-0084; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/obligations/us-colorado-deployer-risk-management-program
- **Official source**: https://leg.colorado.gov/bills/sb24-205
- **Provision**: C.R.S. 6-1-1703(2)
- **Review status**: pending review
- **Confidence**: medium
- **Facts last confirmed**: never confirmed against the official source
- **Retrieved**: 2026-10-27
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "Deployers must implement a risk management policy and programme (Colorado AI Act)" [AIPT-OBL-0084, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0084 (accessed 27 October 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.