Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.
15 of 117 obligations match · Download these as CSV
A consumer who receives an adverse consequential decision may obtain meaningful review by a person with the authority and information to change the outcome. Scope and timing follow the enrolled bill.
Colorado AI Act · C.R.S. 6-1-1703(3)
Deployers must complete an impact assessment before deployment, annually, and within 90 days of any intentional and substantial modification, covering purpose, risks of algorithmic discrimination and mitigation, data categories, performance metrics, transparency measures and post-deployment monitoring, and retain assessments for at least three years.
Colorado AI Act · C.R.S. 6-1-1703(7)
If a deployer discovers that a high-risk AI system it uses has caused algorithmic discrimination, it must send a notice to the Colorado Attorney General within 90 days of the discovery, in the form the Attorney General prescribes, without unreasonable delay.
Colorado AI Act · C.R.S. 6-1-1702(5)
Within 90 days after a developer discovers, through ongoing testing or a credible report from a deployer, that a high-risk AI system it developed has caused or is reasonably likely to have caused algorithmic discrimination, it must disclose this to the Colorado Attorney General and to all known deployers or other developers of the system, without unreasonable delay.
Deployers must retain records showing how automated decision-making technology was used in consequential decisions, for three years, according to secondary reporting on the enrolled bill.
Colorado AI Act · C.R.S. 6-1-1703(2)
Deployers of high-risk AI must implement a risk-management policy and programme governing deployment, specifying principles, processes and personnel used to identify, document and mitigate known or reasonably foreseeable risks of algorithmic discrimination, and reasonable in light of recognised frameworks such as the NIST AI RMF or ISO/IEC 42001.
Colorado AI Act · C.R.S. 6-1-1703(1)
A deployer of a high-risk AI system must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. A deployer that runs the required risk-management programme, completes impact assessments, gives consumer notices and makes the required disclosures benefits from a rebuttable presumption of reasonable care; some deployers with fewer than 50 employees are relieved of parts of the programme and assessment duties when they rely on the developer's impact assessment.
Colorado AI Act · C.R.S. 6-1-1702(1)
A developer of a high-risk AI system must use reasonable care to protect consumers from any known or reasonably foreseeable risk of algorithmic discrimination arising from the intended and contracted uses of the system. A developer that meets the documentation, public-statement and Attorney General disclosure duties in the rest of section 6-1-1702 benefits from a rebuttable presumption that it used reasonable care.
Colorado AI Act · C.R.S. 6-1-1702
Developers must make available to deployers a general statement of intended uses, documentation of known or reasonably foreseeable risks of algorithmic discrimination, training-data summaries, limitations, performance evaluation and mitigation measures, and information needed for deployer impact assessments, and must publish a public statement describing their high-risk systems and how they manage discrimination risks.
Developers of automated decision-making technology must provide deployers with the documentation the statute lists, so that deployers can meet their notice, disclosure and review duties.
Colorado AI Act · C.R.S. 6-1-1704
Any developer or deployer that makes an AI system available to consumers that is intended to interact with them must disclose to each consumer that they are interacting with an AI system, unless that would be obvious to a reasonable person. This duty is not limited to high-risk systems and covers chatbots and voice agents offered to Colorado consumers.
Colorado AI Act · C.R.S. 6-1-1703(5)
A deployer must make available on its website, or in another public way, a clear and readily available statement summarising the types of high-risk AI systems it currently deploys, how it manages known or reasonably foreseeable risks of algorithmic discrimination from those systems, and the nature, source and extent of the information it collects and uses. The statement must be updated periodically.
After an adverse consequential decision, the deployer must tell the consumer that automated decision-making technology was used, give the principal reasons for the decision, and explain how to obtain human review.
Colorado AI Act · C.R.S. 6-1-1703(4)
Before a high-risk system makes a consequential decision, deployers must notify the consumer that AI is used, describe its purpose and nature, and provide contact and opt-out information where applicable. After an adverse decision they must state the principal reasons, the data used and its sources, and offer an opportunity to correct data and to appeal for human review where feasible.
Deployers must tell a consumer, before the decision is made, that automated decision-making technology will be used to make or materially influence a consequential decision about them. The exact content and timing of the notice follow the enrolled bill, which a reviewer must read.
Filters
A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.
No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.
Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.
Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.
