Colorado Enacts Artificial Intelligence Law
May 28, 2024
By: Colin A. Walker and J. Mark Smith
Artificial Intelligence (“AI”) is rapidly becoming an important part of everyday life, especially in business. While it can be very useful, AI does pose certain risks. Legislatures across the country have been considering legislation to regulate AI. Here, Mark Smith, of Fairfield and Woods, P.C.’s Intellectual Property Department, tells us about a new AI law enacted by the Colorado Legislature.
On May 17, 2024, Governor Jared Polis signed Senate Bill 24-205, “Consumer Protections for Artificial Intelligence,” one of the first state laws to regulate AI systems. The main focus of the new law is to regulate the development and use of “High Risk Artificial Intelligence Systems,” which is defined as an artificial intelligence system that makes or is a substantial factor in making a decision that has a “material legal or similarly significant effect on the provision or denial to any consumer” of education, employment, financial or lending services, essential government services, healthcare, housing, insurance or legal services. The risk of AI algorithms that the statute seeks to address is discrimination based on a protected classification, such as race, religion, sex, etc.
The law applies to both the developer of the AI system and those who deploy and use it, imposing duties on both to avoid any algorithmic discrimination.The act requires transparency and disclosure of any AI program’s involvement in these consequential decisions, with notice to the consumer that the algorithm has played some role in the decision. It also provides a right to appeal the decision to a human appeal panel, if technically feasible.
The act requires notice to consumers that they are interacting with an AI system, which must be in plain language. Audits or impact assessments of the high-risk system must be conducted by the deployer, similar to those under EU laws and the recent Office of Management and Budget regulations for federal use of AI. There are additional provisions for impact assessment. Developers will have added burdens, including providing deployers with information about their high-risk systems.These include assessment of foreseeable misuses and known harmful uses. The disclosure must provide known limitations and risks of algorithmic discrimination. Finally, there must be disclosure of the system’s performance and any evaluations and bias mitigation measures taken.
Some of the statute’s provisions do not apply to small businesses, those with fewer than 50 employees.The standard of care is “reasonable care” with some safe harbors if statutory guidelines are met. Enforcement is exclusively by the Colorado Attorney General. There is no private right of action, except that Section 6-1-105 of the Unfair Trade Practices Act provides that violation of this AI statute will be a violation of the Unfair Trade Practices Act, if occurring in the course of a business or occupation. Employers have some defenses, including an affirmative defense for employers who discover and correct a violation.
In signing the law, the Governor cautioned that the act should be adjusted to avoid unnecessary restrictions on new technologies. The Governor asked the legislature to improve and “fine tune” the provisions as well as conform with evidence-based findings and recommendations prior to the effective date, February 1, 2026.