Colorado Passes Legislation to Regulate Use of AI in Consequential Decision Making

June 6, 2024 Advisory

*IP Practice Project Manager George Bailey also contributed to this advisory.

On May 17, 2024, the Colorado legislature passed SB 24-205 to protect employees and consumers by prohibiting developers of high-risk artificial intelligence (AI) systems from engaging in “algorithmic discrimination” in consequential decision-making. This prohibition also applies to organizations that deploy these high-risk AI systems. Gov. Jared Polis signed the bill into law on May 17, 2024.

Algorithmic discrimination occurs when AI treats individuals differently in an unlawful manner based on their membership in a protected class, such as religion, sex, or race. A high-risk AI system is defined as any system that makes or plays a substantial role in making a consequential decision, which is defined as “a decision that has a material legal or similarly significant effect on the provision or denial to any consumer, or the cost or terms of” the following services:

  • Educational enrollment or opportunity
  • Employment or employment opportunities
  • Financial or lending service
  • Essential government services
  • Health care services
  • Housing
  • Insurance
  • Legal services

However, an AI system is not considered high-risk if it is intended to perform narrow procedural tasks or track decision-making patterns or changes in those patterns. The statute also lists several technologies that do not qualify as high-risk AI systems – so long as those technologies do not make or play a substantial role in making a consequential decision – including anti-malware, anti-virus, cybersecurity, networking and firewall technologies.

Developers, including any organization that substantially modifies an AI system, must use reasonable care to prevent known or reasonably foreseeable risks of algorithmic discrimination arising from the use of high-risk AI systems. There is a rebuttable presumption of compliance if a developer provides deployers with certain documentation, including:

  • A general statement of foreseeable risks and known harmful or inappropriate uses of the high-risk AI system
  • Documentation disclosing:
    • A summary of the data used to train the AI
    • The known or reasonably foreseeable risks, limitations and intended benefits of the high-risk AI system
  • The purpose of the high-risk AI system
  • Measures taken to mitigate the risk of algorithmic discrimination
  • Any other documentation necessary to assist deployers in complying with the statute

Deployers of these technologies may take advantage of a rebuttable presumption if they demonstrate compliance with the following requirements, among others:

  • Implement a risk management policy and program to assess and regularly review the possibility of algorithmic discrimination
  • Complete an impact assessment for the use of the high-risk AI system
  • Provide a notice to all applicants, clients or consumers that includes:
    • A high-risk AI system is being used in to make or play a substantial role in making a consequential decision
    • The purpose of the system
    • The contact information of the deployer
    • Information regarding the consumer’s ability to opt out of the processing of personal data concerning the consumer for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects

Both developers and deployers must report the actual occurrence or likelihood of the occurrence of algorithmic discrimination to the Colorado Attorney General within 90 days of discovery. Only the Colorado Attorney General can bring legal action against a developer or deployer under this statute; there is no private right of action under the statute.

Not all deployers are subject to the statute's requirements. For example, organizations with fewer than 50 full-time employees are exempt if they disclose the intended use of AI to consumers, among other requirements that apply to both the deployer and the high-risk AI system.

The law will take effect on Feb. 1, 2026. The Colorado Attorney General may promulgate rules under the statute, which may change or expand the obligations of developers and deployers imposed by the law.

Lawyers in Armstrong Teasdale’s Artificial Intelligence practice will continue to monitor for developments in this space. Please contact your regular AT lawyer on one of the listed authors for questions specific to your organization.

Contact Us
  • Worldwide
  • Boston, MA
  • Chicago, IL
  • Denver, CO
  • Dublin, Ireland
  • Edwardsville, IL
  • Jefferson City, MO
  • Kansas City, MO
  • Las Vegas, NV
  • London, England
  • Miami, FL
  • New York, NY
  • Orange County, CA
  • Philadelphia, PA
  • Princeton, NJ
  • Salt Lake City, UT
  • St. Louis, MO
  • Washington, D.C.
  • Wilmington, DE
abstract image of world map
Boston, MA
800 Boylston St.
30th Floor
Boston, MA 02199
Google Maps
Boston, Massachusetts
Chicago, IL
100 North Riverside Plaza
Suite 1500
Chicago, IL 60606-1520
Google Maps
Chicago, Illinois
Denver, CO
4643 S. Ulster St.
Suite 800
Denver, CO 80237
Google Maps
Denver, Colorado
Dublin, Ireland
Fitzwilliam Hall, Fitzwilliam Place
Dublin 2, Ireland
Google Maps
Edwardsville, IL
115 N. Second St.
Edwardsville, IL 62025
Google Maps
Edwardsville, Illinois
Jefferson City, MO
101 E. High St.
First Floor
Jefferson City, MO 65101
Google Maps
Jefferson City, Missouri
Kansas City, MO
2345 Grand Blvd.
Suite 1500
Kansas City, MO 64108
Google Maps
Kansas City, Missouri
Las Vegas, NV
7160 Rafael Rivera Way
Suite 320
Las Vegas, NV 89113
Google Maps
Las Vegas, Nevada
London, England
Royal College of Surgeons of England
38-43 Lincoln’s Inn Fields
London, WC2A 3PE
Google Maps
Miami, FL
355 Alhambra Circle
Suite 1200
Coral Gables, FL 33134
Google Maps
Photo of Miami, Florida
New York, NY
7 Times Square, 44th Floor
New York, NY 10036
Google Maps
New York City skyline
Orange County, CA
19800 MacArthur Boulevard
Suite 300
Irvine, CA 92612
Google Maps
Philadelphia, PA
2005 Market Street
29th Floor, One Commerce Square
Philadelphia, PA 19103
Google Maps
Philadelphia, Pennsylvania
Princeton, NJ
100 Overlook Center
Second Floor
Princeton, NJ 08540
Google Maps
Princeton, New Jersey
Salt Lake City, UT
222 South Main St.
Suite 1830
Salt Lake City, UT 84101
Google Maps
Salt Lake City, Utah
St. Louis, MO
7700 Forsyth Blvd.
Suite 1800
St. Louis, MO 63105
Google Maps
St. Louis, Missouri
Washington, D.C.
1717 Pennsylvania Avenue NW
Suite 400
Washington, DC 20006
Google Maps
Photo of Washington, D.C. with the Capitol in the foreground and Washington Monument in the background.
Wilmington, DE
1007 North Market Street
Wilmington, DE 19801
Google Maps
Wilmington, Delaware