In recent years, artificial intelligence (AI) technology has become one of the most influential and widely discussed topics in science and technology. From voice assistants to self-driving cars, AI is being widely applied across various fields, making our lives increasingly convenient. However, the proliferation of AI applications and their integration with big data technologies have raised concerns about the risk of algorithmic discrimination within AI systems, such as differential treatment based on age, race, gender, disability, etc.
To address these risks, on May 17, 2024, the Governor of Colorado signed Senate Bill 24-205: A Bill on Protecting Consumer Rights in Interactions with Artificial Intelligence Systems. Unlike other states' AI legislation, this bill specifically targets "high-risk artificial intelligence systems."
The bill aims to regulate consumer rights protection in interactions with AI systems, reduce the risk of algorithmic discrimination, and promote fairness and safety in AI systems. It requires developers or deployers of "high-risk artificial intelligence systems" to take reasonable care to avoid algorithmic discrimination within these systems. If they publicly disclose information about these high-risk AI systems and meet the bill's conditions, they may be deemed to have taken reasonable care. According to the provisions, the bill will officially take effect on February 1, 2026.
I. Basic Concepts
- Algorithmic Discrimination: Unreasonable differential treatment or impact based on personal characteristics such as age, gender, color, race, religion, etc., in AI systems.
- Excludes actions by developers or deployers solely for:
- Self-testing to identify, mitigate, or prevent discrimination, or ensure compliance with state and federal laws.
- Expanding applicant, customer, or participant groups to increase diversity or correct historical discrimination.
- Also excludes usage in private clubs or other non-public places.
- Consequential Decision: Decisions affecting whether to provide services to consumers, service costs, or terms, with substantial legal or similarly significant impacts, involving:
- Educational opportunities
- Employment opportunities
- Financial or loan services
- Government basic services
- Healthcare services
- Housing
- Insurance
- Legal services
- High-Risk Artificial Intelligence Systems: AI systems capable of making or playing a crucial role in making consequential decisions.
- Excludes systems performing specific procedural tasks or used solely to detect decision patterns or deviations without affecting human review.
- Deployer: Individuals or entities conducting business in Colorado and deploying high-risk AI systems.
- Developer: Individuals or entities conducting business in Colorado, primarily responsible for developing or modifying AI systems for specific purposes.
II. Scope of Application
The Colorado AI Bill applies to all developers and deployers of high-risk AI systems conducting business in Colorado, emphasizing "high-risk artificial intelligence systems." It does not cover individuals or entities using general AI systems.
Unlike other states' privacy laws, this bill has no applicability threshold, meaning it applies regardless of company revenue or the number of consumers potentially affected. However, small businesses deploying high-risk AI systems may be conditionally exempt from certain deployer responsibilities if they have fewer than 50 full-time employees, do not use their own data to train high-risk AI systems, limit usage to disclosed purposes, and provide the developer's impact assessment report to consumers.
Notably, the bill imposes duties on both developers and deployers of high-risk AI systems, requiring them to take reasonable care to avoid algorithmic discrimination, creating a "dual liability" scenario.
III. Developer Responsibilities
Developers must "take reasonable measures to protect consumers from any known or reasonably foreseeable algorithmic discrimination risks arising from the intended and agreed uses of high-risk AI systems." Developers must:
- Provide relevant information to users deploying high-risk AI systems, including system purpose, expected benefits, intended uses, operation methods, potential risks, and any known or potential algorithmic discrimination.
- Provide all documents needed for deployers to conduct impact assessments.
- Publicly provide system summary information documents.
- During development and subsequent modifications, provide information on managing any reasonable or foreseeable algorithmic discrimination risks.
- Disclose any known or potential algorithmic discrimination risks to the Colorado Attorney General and deployers within 90 days of discovery.
IV. Deployer Responsibilities
Deployers of high-risk AI systems must implement risk management policies and procedures to manage deployment, including identifying, documenting, and mitigating algorithmic discrimination risks. To be considered as having taken reasonable care, deployers must:
- Conduct annual reviews of each high-risk AI system to eliminate algorithmic discrimination risks.
- Provide consumers with information on significant decisions made by high-risk AI systems and allow consumers to correct any incorrect personal data used in these decisions.
- Disclose any known or potential algorithmic discrimination risks to the Colorado Attorney General within 90 days of discovery.
The bill also requires developers or deployers to inform consumers when they are interacting with an AI system rather than a human.
Regulatory Analysis
The Colorado AI Bill imposes different compliance requirements on developers and deployers to reduce algorithmic discrimination risks. Developers must determine if their AI systems qualify as high-risk and prepare relevant information and documents for deployers. Deployers must take additional measures beyond Colorado's privacy law obligations to protect consumer rights.
While the bill takes effect on February 1, 2026, developers and deployers should prepare documentation and other obligations before the new law becomes effective.
Kaamel's Assistance
Kaamel remains at the forefront of privacy protection, using technology-driven methods to help businesses identify and resolve privacy compliance risks. The innovative Kaamel AI detection engine, based on mainstream regulations and precedents, helps companies quickly identify privacy compliance risks and provides comprehensive solutions to address regulatory and user needs, reducing risks and building trust in the international market.
