Colorado Reenacts Artificial Intelligence Act

The Colorado General Assembly repealed and replaced the Artificial Intelligence Act (the Act), with significant changes, as a result of the U.S. Department of Justice’s recent intervention in federal litigation related to the former version of the Act. 

The following definitions, among others, were added or revised:

• Replaces the definition of “high-risk artificial intelligence system” with “automated decision-making technology or ADMT,” which is generally defined as technology that processes personal data and uses computation to generate output (e.g., predictions, rankings, scores) that is used to make or assist a decision or determination concerning an individual;
• Adds a definition for “covered domains,” which include, among other things, real estate transactions and financial and lending services; and
• Revises the definitions of “consequential decision,” which means a decision that relates to an individual’s access to or eligibility for, among other things, housing, or financial or lending services.

The Act requires developers and deployers of ADMT to provide certain information or notices including the following:

• Developers of an ADMT that is used to materially influence consequential decisions in a covered domain must provide a deployer of the ADMT with technical documentation describing (i) the ADMT’s intended uses, (ii) categories of training data, (iii) known limitations and risks, and (iv) instructions for appropriate use, monitoring, and human review;
• Prior to a deployer using ADMT that materially influences a consequential decision, the deployer must provide a notice to consumers that the deployer uses ADMT and how the consumer can obtain additional information; and
• If use of the ADMT results in an adverse outcome for the consumer, the deployer must provide a plain language description of the consequential decision and the role ADMT played in the decision within 30 days of the adverse outcome.  Consumers have the right to know the personal data used by the ADMT, correct errors in personal data, and request meaningful human review and reconsideration.

The Attorney General is required to adopt rules specifying the content of post-adverse outcome disclosures.  Additionally, the Attorney General may enforce the Act under the Colorado Consumer Protection Act, but must provide a developer or deployer with a 60-day notice and opportunity to cure any alleged violations before bringing a lawsuit.

The Act applies to applicable consequential decisions made on or after January 1, 2027.