Colorado Artificial Intelligence Law: Deployer Disclosure Requirements
Melissa Krasnow | June 18, 2024
The Colorado artificial intelligence (AI) law ("Colorado AI law") will take effect on February 1, 2026. This article discusses the Colorado AI law deployer notification and disclosure, as well as deployer or other developer disclosure requirements.
Deployer Notification and Disclosure Requirements
On and after February 1, 2026, and no later than the time that a deployer deploys a high-risk AI system to make, or be a substantial factor in making, a consequential decision concerning a consumer, the deployer shall (i) notify the consumer that the deployer has deployed a high-risk AI system to make, or be a substantial factor in making, a consequential decision before the decision is made, (ii) provide to the consumer a statement disclosing the purpose of the high-risk AI system and the nature of the consequential decision; the contact information for the deployer; a description, in plain language, of the high-risk AI system; and instructions on how to access the statement required by C.R.S. § 6-1-1703(5)(a), and (iii) provide to the consumer information, if applicable, regarding the consumer's right to opt out of the processing of personal data concerning the consumer for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer under C.R.S. § 6-1-1306(1)(a)(i)(c). C.R.S. § 6-1-1703(4)(a).
On and after February 1, 2026, a deployer that has deployed a high-risk AI system to make, or be a substantial factor in making, a consequential decision concerning a consumer shall, if the consequential decision is adverse to the consumer, provide to the consumer (i) a statement disclosing the principal reason or reasons for the consequential decision, including (a) the degree to which, and manner in which, the high-risk AI system contributed to the consequential decision, (b) the type of data that was processed by the high-risk AI system in making the consequential decision, and (c) the source or sources of the data described in C.R.S. § 6-1-1703(4)(b)(i)(b), (ii) an opportunity to correct any incorrect personal data that the high-risk AI system processed in making, or as a substantial factor in making, the consequential decision, and (iii) an opportunity to appeal an adverse consequential decision concerning the consumer arising from the deployment of a high-risk AI system, which appeal must, if technically feasible, allow for human review unless providing the opportunity for appeal is not in the best interest of the consumer, including in instances in which any delay might pose a risk to the life or safety of such consumer. C.R.S. § 6-1-1703(4)(b).
Except as provided in C.R.S. § 6-1-170(4)(c)(ii), a deployer shall provide the notice, statement, contact information, and description required by C.R.S. § 6-1-1703(4)(a) and (4)(b) (a) directly to the consumer, (b) in plain language, (c) in all languages in which the deployer, in the ordinary course of the deployer's business, provides contracts, disclaimers, sale announcements, and other information to consumers, and (d) in a format that is accessible to consumers with disabilities. C.R.S. § 6-1-1703(4)(c)(i). If the deployer is unable to provide the notice, statement, contact information, and description required by C.R.S. § 6-1-1703(4)(a) and (4)(b) directly to the consumer, the deployer shall make the notice, statement, contact information, and description available in a manner that is reasonably calculated to ensure that the consumer receives the notice, statement, contact information, and description. C.R.S. § 6-1-1703(4)(c)(ii).
On and after February 1, 2026, and except as provided in C.R.S. § 6-1-1703(6), a deployer shall make available, in a manner that is clear and readily available on the deployer's website, a statement summarizing (i) the types of high-risk AI systems that are currently deployed by the deployer, (ii) how the deployer manages known or reasonably foreseeable risks of algorithmic discrimination that may arise from the deployment of each high-risk AI system described pursuant to C.R.S. § 6-1-170(5)(a)(i), and (iii) in detail, the nature, source, and extent of the information collected and used by the deployer. C.R.S. § 6-1-1703(5)(a). A deployer shall periodically update the statement described in C.R.S. § 6-1-1703(5)(a). C.R.S. § 6-1-1703(5)(b).
C.R.S. § 6-1-1703(2),(3), and (5) do not apply to a deployer if, at the time the deployer deploys a high-risk AI system and at all times while the high-risk AI system is deployed, (a) the deployer (i) employs fewer than 50 full-time equivalent employee, and (ii) does not use the deployer's own data to train the high-risk AI system, (b) the high-risk AI system (i) is used for the intended uses that are disclosed to the deployer as required by C.R.S. § 6-1-1702(2)(a), and (ii) continues learning based on data derived from sources other than the deployer's own data, and (c) the deployer makes available to consumers any impact assessment that (i) the developer of the high-risk AI system has completed and provided to the deployer, and (ii) includes information that is substantially similar to the information in the impact assessment required under C.R.S. § 6-1-1703(3)(b). C.R.S. § 6-1-1703(6).
On and after February 1, 2026, a deployer of a high-risk AI system shall use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination. C.R.S. § 6-1-1702(1). In any enforcement action brought on or after February 1, 2026, by the Colorado attorney general pursuant to C.R.S. § 6-1-1706, there is a rebuttable presumption that a deployer of a high-risk AI system used reasonable care as required hereunder if the deployer complied herewith and any additional requirements or obligations as set forth in rules promulgated by the Colorado attorney general pursuant to C.R.S. § 6-1-1707. C.R.S. § 6-1-1703(1).
If a deployer deploys a high-risk AI system on or after February 1, 2026, and subsequently discovers that the high-risk AI system has caused algorithmic discrimination, the deployer, without unreasonable delay, but no later than 90 days after the date of the discovery, shall send to the Colorado attorney general, in a form and manner prescribed by the Colorado attorney general, a notice disclosing the discovery. C.R.S. § 6-1-1703(7).
Nothing in C.R.S. § 6-1-1703(2) to (5) and (7) requires a deployer to disclose a trade secret or information protected from disclosure by state or federal law. C.R.S. § 6-1-1703(8). Trade secret has the meaning set forth in C.R.S. § 7-74-102(4). C.R.S. § 6-1-1701(12). To the extent that a deployer withholds information pursuant hereto or C.R.S. § 6-1-1705(5), the deployer shall notify the consumer and provide a basis for the withholding. C.R.S. § 6-1-1703(8).
On and after February 1, 2026, the Colorado attorney general may require that a deployer, or a third party contracted by the deployer, disclose to the Colorado attorney general, no later than 90 days after the request and in a form and manner prescribed by the Colorado attorney general, the risk management policy implemented pursuant to C.R.S. § 6-1-1703(2), the impact assessment completed pursuant to C.R.S. § 6-1-1703(3), or the records maintained pursuant to C.R.S. § 6-1-1703(3)(f). C.R.S. § 6-1-1703(9).
The Colorado attorney general may evaluate the risk management policy, impact assessment, or records to ensure compliance with the Colorado AI law, and the risk management policy, impact assessment, and records are not subject to disclosure under the "Colorado Open Records Act," Part 2 of Article 72 of Title 24. C.R.S. § 6-1-1703(9). In a disclosure pursuant hereto, a deployer may designate the statement or documentation as including proprietary information or a trade secret. C.R.S. § 6-1-1703(9). To the extent that any information contained in the risk management policy, impact assessment, or records include information subject to attorney-client privilege or work-product protection, the disclosure does not constitute a waiver of the privilege or protection. C.R.S. § 6-1-1703(9).
Deployer or Other Developer Disclosure Requirements
On and after February 1, 2026, and except as provided in C.R.S. § 6-1-1704(2), a deployer or other developer that deploys, offers, sells, leases, licenses, gives, or otherwise makes available an AI system that is intended to interact with consumers shall ensure the disclosure to each consumer who interacts with the AI system that the consumer is interacting with an AI system. C.R.S. § 6-1-1704(1). The foregoing disclosure is not required under circumstances in which it would be obvious to a reasonable person that the person is interacting with an AI system. C.R.S. § 6-1-1704(2).
Opinions expressed in Expert Commentary articles are those of the author and are not necessarily held by the author's employer or IRMI. Expert Commentary articles and other IRMI Online content do not purport to provide legal, accounting, or other professional advice or opinion. If such advice is needed, consult with your attorney, accountant, or other qualified adviser.
