Colorado Enacts Landmark AI Regulation Law

Colorado Enacts Landmark AI Regulation Law

According to an article by the law firm Akin Gump, Colorado Governor Jared Polis has signed S.B. 205 into law, establishing strict regulations for high-risk AI systems. This law, which will be effective February 1, 2026, requires AI developers and deployers to manage risks and prevent algorithmic discrimination and could potentially set a precedent similar to the GDPR in privacy law.

Akin Gump summarizes aspects of the law as follows:

Scope and Definitions: The law broadly defines AI systems and applies to developers and deployers in Colorado. High-risk AI systems are those significantly affecting legal or similarly important decisions in areas such as education, employment, finance, government services, healthcare, housing, insurance, and legal services. The law addresses “algorithmic discrimination,” prohibiting any AI-driven unfair treatment based on protected characteristics like age, race, gender, and more.

Requirements for AI Developers: Developers must use “reasonable care” to protect consumers from algorithmic discrimination. They must provide detailed documentation about AI systems, including their intended uses, limitations, training data, and measures to prevent discrimination. Developers must also disclose known risks to the Colorado Attorney General (AG) and deployers.

Requirements for AI Deployers: Deployers are tasked with risk management, including annual impact assessments to identify and mitigate discrimination risks. They must maintain comprehensive documentation and update it with any significant modifications to the AI system. Consumer transparency is crucial, requiring deployers to notify consumers when AI systems are used in significant decision-making and to provide opportunities for appeal and correction of errors.

Enforcement: The AG will exclusively enforce the law, treating violations as unfair trade practices. The law includes exemptions for smaller deployers with specific conditions. Compliance can be demonstrated through adherence to the National Institute of Standards and Technology (NIST) guidelines or equivalent frameworks.

Implications: Colorado’s legislation represents a significant advancement in AI regulation, aligning with existing consumer protection and privacy laws. It serves as a model for other states, promoting consumer awareness and protection in AI deployment.