Attachment E - CO Senate Bill 24-205.pdf

SENATE BILL 24-205

BY SENATOR(S) Rodriguez, Cutter, Michaelson Jenet, Priola, Winter F., Fenberg;

also REPRESENTATIVE(S) Titone and Rutinel, Duran.

CONCERNING CONSUMER PROTECTIONS IN INTERACTIONS WITH ARTIFICIAL

INTELLIGENCE SYSTEMS.

Be it enacted by the General Assembly of the State of Colorado:

SECTION 1. In Colorado Revised Statutes, add part 17 to article 1 of title 6 as follows:

PART 17

ARTIFICIAL INTELLIGENCE

6-1-1701. Definitions. AS USED IN THIS PART 17, UNLESS THE

CONTEXT OTHERWISE REQUIRES:

(1) (a) "ALGORITHMIC DISCRIMINATION" MEANS ANY CONDITION IN

WHICH THE USE OF AN ARTIFICIAL INTELLIGENCE SYSTEM RESULTS IN AN

UNLAWFUL DIFFERENTIAL TREATMENT OR IMPACT THAT DISFAVORS AN

INDIVIDUAL OR GROUP OF INDIVIDUALS ON THE BASIS OF THEIR ACTUAL OR

Capital letters or bold & italic numbers indicate new material added to existing law; dashes through words or numbers indicate deletions from existing law and such material is not part of the act.

PERCEIVED AGE, COLOR, DISABILITY, ETHNICITY, GENETIC INFORMATION,

LIMITED PROFICIENCY IN THE ENGLISH LANGUAGE, NATIONAL ORIGIN, RACE,

RELIGION, REPRODUCTIVE HEALTH, SEX, VETERAN STATUS, OR OTHER

CLASSIFICATION PROTECTED UNDER THE LAWS OF THIS STATE OR FEDERAL

LAW.

(b) "ALGORITHMIC DISCRIMINATION" DOES NOT INCLUDE:

(I) THE OFFER, LICENSE, OR USE OF A HIGH-RISK ARTIFICIAL

INTELLIGENCE SYSTEM BY A DEVELOPER OR DEPLOYER FOR THE SOLE

PURPOSE OF:

(A) THE DEVELOPER'S OR DEPLOYER'S SELF-TESTING TO IDENTIFY,

MITIGATE, OR PREVENT DISCRIMINATION OR OTHERWISE ENSURE

COMPLIANCE WITH STATE AND FEDERAL LAW; OR

(B) EXPANDING AN APPLICANT, CUSTOMER, OR PARTICIPANT POOL

TO INCREASE DIVERSITY OR REDRESS HISTORICAL DISCRIMINATION; OR

(II) AN ACT OR OMISSION BY OR ON BEHALF OF A PRIVATE CLUB OR

OTHER ESTABLISHMENT THAT IS NOT IN FACT OPEN TO THE PUBLIC, AS SET

FORTH IN TITLE II OF THE FEDERAL "CIVIL RIGHTS ACT OF 1964", 42 U.S.C.

SEC. 2000a (e), AS AMENDED.

(2) "ARTIFICIAL INTELLIGENCE SYSTEM" MEANS ANY

MACHINE-BASED SYSTEM THAT, FOR ANY EXPLICIT OR IMPLICIT OBJECTIVE,

INFERS FROM THE INPUTS THE SYSTEM RECEIVES HOW TO GENERATE

OUTPUTS, INCLUDING CONTENT, DECISIONS, PREDICTIONS, OR

RECOMMENDATIONS, THAT CAN INFLUENCE PHYSICAL OR VIRTUAL

ENVIRONMENTS.

(3) "CONSEQUENTIAL DECISION" MEANS A DECISION THAT HAS A

MATERIAL LEGAL OR SIMILARLY SIGNIFICANT EFFECT ON THE PROVISION OR

DENIAL TO ANY CONSUMER OF, OR THE COST OR TERMS OF:

(a) EDUCATION ENROLLMENT OR AN EDUCATION OPPORTUNITY;

(b) EMPLOYMENT OR AN EMPLOYMENT OPPORTUNITY;

(C) A FINANCIAL OR LENDING SERVICE;

PAGE 2-SENATE BILL 24-205

(d) AN ESSENTIAL GOVERNMENT SERVICE;

(e) I IEALTH-CARE SERVICES;

(f) I lousiNG;

(g) INSURANCE; OR

(h) A LEGAL SERVICE.

(4) "CONSUMER" MEANS AN INDIVIDUAL WHO IS A COLORADO

RESIDENT.

(5) "DEPLOY" MEANS TO USE A HIGH-RISK ARTIFICIAL INTELLIGENCE

SYSTEM.

(6) "DEPLOYER" MEANS A PERSON DOING BUSINESS IN THIS STATE

THAT DEPLOYS A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM.

(7) "DEVELOPER" MEANS A PERSON DOING BUSINESS IN THIS STATE

THAT DEVELOPS OR INTENTIONALLY AND SUBSTANTIALLY MODIFIES AN

ARTIFICIAL INTELLIGENCE SYSTEM.

(8) "I IEALTH-CARE SERVICES" HAS THE SAME MEANING AS PROVIDED

IN 42 U.S.C. SEC. 234 (d)(2).

(9) (a) "HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM" MEANS ANY

ARTIFICIAL INTELLIGENCE SYSTEM THAT, WHEN DEPLOYED, MAKES, OR IS A

SUBSTANTIAL FACTOR IN MAKING, A CONSEQUENTIAL DECISION.

(b) "HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM" DOES NOT

INCLUDE:

(I) AN ARTIFICIAL INTELLIGENCE SYSTEM IF THE ARTIFICIAL

INTELLIGENCE SYSTEM IS INTENDED TO:

(A) PERFORM A NARROW PROCEDURAL TASK; OR

(B) DETECT DECISION-MAKING PATTERNS OR DEVIATIONS FROM

PRIOR DECISION-MAKING PATTERNS AND IS NOT INTENDED TO REPLACE OR

PAGE 3-SENATE BILL 24-205

INFLUENCE A PREVIOUSLY COMPLETED HUMAN ASSESSMENT WITHOUT

SUFFICIENT HUMAN REVIEW; OR

(II) THE FOLLOWING TECHNOLOGIES, UNLESS THE TECHNOLOGIES,

WHEN DEPLOYED, MAKE, OR ARE A SUBSTANTIAL FACTOR IN MAKING, A

CONSEQUENTIAL DECISION:

(A) ANTI-FRAUD TECHNOLOGY THAT DOES NOT USE FACIAL

RECOGNITION TECHNOLOGY;

(B) ANTI-MALWARE;

(C) ANTI-VIRUS;

(D) ARTIFICIAL INTELLIGENCE-ENABLED VIDEO GAMES;

(E) CALCULATORS;

(F) CYBERSECURITY;

(G) DATABASES;

(H) DATA STORAGE;

(I) FIREWALL;

(J) INTERNET DOMAIN REGISTRATION;

(K) INTERNET WEBSITE LOADING;

(L) NETWORKING;

(M) SPAM- AND ROBOCALL-FILTERING;

(N) SPELL-CHECKING;

(0) SPREADSHEETS;

(P) WEB CACHING;

PAGE 4-SENATE BILL 24-205

(Q) WEB HOSTING OR ANY SIMILAR TECHNOLOGY; OR

(R) TECHNOLOGY THAT COMMUNICATES WITH CONSUMERS IN

NATURAL LANGUAGE FOR THE PURPOSE OF PROVIDING USERS WITH

INFORMATION, MAKING REFERRALS OR RECOMMENDATIONS, AND

ANSWERING QUESTIONS AND IS SUBJECT TO AN ACCEPTED USE POLICY THAT

PROHIBITS GENERATING CONTENT THAT IS DISCRIMINATORY OR HARMFUL.

(10) (a) "INTENTIONAL AND SUBSTANTIAL MODIFICATION" OR

"INTENTIONALLY AND SUBSTANTIALLY MODIFIES" MEANS A DELIBERATE

CHANGE MADE TO AN ARTIFICIAL INTELLIGENCE SYSTEM THAT RESULTS IN

ANY NEW REASONABLY FORESEEABLE RISK OF ALGORITHMIC

DISCRIMINATION.

(b) "INTENTIONAL AND SUBSTANTIAL MODIFICATION" OR

"INTENTIONALLY AND SUBSTANTIALLY MODIFIES" DOES NOT INCLUDE A

CHANGE MADE TO A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, OR THE

PERFORMANCE OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, IF:

(I) THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM CONTINUES TO

LEARN AFTER THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS:

(A) OFFERED, SOLD, LEASED, LICENSED, GIVEN, OR OTHERWISE MADE

AVAILABLE TO A DEPLOYER; OR

(B) DEPLOYED;

(II) THE CHANGE IS MADE TO THE HIGH-RISK ARTIFICIAL

INTELLIGENCE SYSTEM AS A RESULT OF ANY LEARNING DESCRIBED IN

SUBSECTION (10)(b)(I) OF THIS SECTION;

(III) THE CHANGE WAS PREDETERMINED BY THE DEPLOYER, OR A

THIRD PARTY CONTRACTED BY THE DEPLOYER, WHEN THE DEPLOYER OR

THIRD PARTY COMPLETED AN INITIAL IMPACT ASSESSMENT OF SUCH

HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM PURSUANT TO SECTION

6-1-1703 (3); AND

(IV) THE CHANGE IS INCLUDED IN TECHNICAL DOCUMENTATION FOR

THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM.

PAGE 5-SENATE BILL 24-205

(1 1 ) (a) "SUBSTANTIAL FACTOR" MEANS A FACTOR THAT:

(I) ASSISTS IN MAKING A CONSEQUENTIAL DECISION;

(II) IS CAPABLE OF ALTERING THE OUTCOME OF A CONSEQUENTIAL

DECISION; AND

(III) IS GENERATED BY AN ARTIFICIAL INTELLIGENCE SYSTEM.

(b) "SUBSTANTIAL FACTOR" INCLUDES ANY USE OF AN ARTIFICIAL

INTELLIGENCE SYSTEM TO GENERATE ANY CONTENT, DECISION, PREDICTION,

OR RECOMMENDATION CONCERNING A CONSUMER THAT IS USED AS A BASIS

TO MAKE A CONSEQUENTIAL DECISION CONCERNING THE CONSUMER.

(12) "TRADE SECRET" HAS THE MEANING SET FORTH IN SECTION

7-74-102 (4).

6-1-1702. Developer duty to avoid algorithmic discrimination -required documentation. (1) ON AND AFTER FEBRUARY 1, 2026, A

DEVELOPER OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM SHALL USE

REASONABLE CARE TO PROTECT CONSUMERS FROM ANY KNOWN OR

REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION

ARISING FROM THE INTENDED AND CONTRACTED USES OF THE HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM. IN ANY ENFORCEMENT ACTION BROUGHT

ON OR AFTER FEBRUARY 1, 2026, BY THE ATTORNEY GENERAL PURSUANT TO

SECTION 6-1-1706, THERE IS A REBUTTABLE PRESUMPTION THAT A

DEVELOPER USED REASONABLE CARE AS REQUIRED UNDER THIS SECTION IF

THE DEVELOPER COMPLIED WITH THIS SECTION AND ANY ADDITIONAL

REQUIREMENTS OR OBLIGATIONS AS SET FORTH IN RULES PROMULGATED BY

THE ATTORNEY GENERAL PURSUANT TO SECTION 6-1-1707.

(2) ON AND AFTER FEBRUARY 1, 2026, AND EXCEPT AS PROVIDED IN

SUBSECTION (6) OF THIS SECTION, A DEVELOPER OF A HIGH-RISK ARTIFICIAL

INTELLIGENCE SYSTEM SHALL MAKE AVAILABLE TO THE DEPLOYER OR OTHER

DEVELOPER OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM:

(a) A GENERAL STATEMENT DESCRIBING THE REASONABLY

FORESEEABLE USES AND KNOWN HARMFUL OR INAPPROPRIATE USES OF THE

HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM;

PAGE 6-SENATE BILL 24-205

(b) DOCUMENTATION DISCLOSING:

(I) HIGH-LEVEL SUMMARIES OF THE TYPE OF DATA USED TO TRAIN

THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM;

(II) KNOWN OR REASONABLY FORESEEABLE LIMITATIONS OF THE

HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, INCLUDING KNOWN OR

REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION

ARISING FROM THE INTENDED USES OF THE HIGH-RISK ARTIFICIAL

INTELLIGENCE SYSTEM;

(III) THE PURPOSE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE

SYSTEM;

(IV) THE INTENDED BENEFITS AND USES OF THE HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM; AND

(V) ALL OTHER INFORMATION NECESSARY TO ALLOW THE DEPLOYER

TO COMPLY WITH THE REQUIREMENTS OF SECTION 6-1-1703;

(c) DOCUMENTATION DESCRIBING:

(I) How THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM WAS

EVALUATED FOR PERFORMANCE AND MITIGATION OF ALGORITHMIC

DISCRIMINATION BEFORE THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM

WAS OFFERED, SOLD, LEASED, LICENSED, GIVEN, OR OTHERWISE MADE

AVAILABLE TO THE DEPLOYER;

(II) THE DATA GOVERNANCE MEASURES USED TO COVER THE

TRAINING DATASETS AND THE MEASURES USED TO EXAMINE THE SUITABILITY

OF DATA SOURCES, POSSIBLE BIASES, AND APPROPRIATE MITIGATION;

(III) THE INTENDED OUTPUTS OF THE HIGH-RISK ARTIFICIAL

INTELLIGENCE SYSTEM;

(IV) THE MEASURES THE DEVELOPER HAS TAKEN TO MITIGATE

KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC

DISCRIMINATION THAT MAY ARISE FROM THE REASONABLY FORESEEABLE

DEPLOYMENT OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; AND

PAGE 7-SENATE BILL 24-205

(V) HOW THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM SHOULD

BE USED, NOT BE USED, AND BE MONITORED BY AN INDIVIDUAL WHEN THE

HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS USED TO MAKE, OR IS A

SUBSTANTIAL FACTOR IN MAKING, A CONSEQUENTIAL DECISION; AND

(d) ANY ADDITIONAL DOCUMENTATION THAT IS REASONABLY

NECESSARY TO ASSIST THE DEPLOYER IN UNDERSTANDING THE OUTPUTS AND

MONITOR THE PERFORMANCE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE

SYSTEM FOR RISKS OF ALGORITHMIC DISCRIMINATION.

(3) (a) EXCEPT AS PROVIDED IN SUBSECTION (6) OF THIS SECTION, A

DEVELOPER THAT OFFERS, SELLS, LEASES, LICENSES, GIVES, OR OTHERWISE

MAKES AVAILABLE TO A DEPLOYER OR OTHER DEVELOPER A HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM ON OR AFTER FEBRUARY 1, 2026, SHALL

MAKE AVAILABLE TO THE DEPLOYER OR OTHER DEVELOPER, TO THE EXTENT

FEASIBLE, THE DOCUMENTATION AND INFORMATION, THROUGH ARTIFACTS

SUCH AS MODEL CARDS, DATASET CARDS, OR OTHER IMPACT ASSESSMENTS,

NECESSARY FOR A DEPLOYER, OR FOR A THIRD PARTY CONTRACTED BY A

DEPLOYER, TO COMPLETE AN IMPACT ASSESSMENT PURSUANT TO SECTION

6-1-1703 (3).

(b) A DEVELOPER THAT ALSO SERVES AS A DEPLOYER FOR A

HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS NOT REQUIRED TO GENERATE

THE DOCUMENTATION REQUIRED BY THIS SECTION UNLESS THE HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM IS PROVIDED TO AN UNAFFILIATED ENTITY

ACTING AS A DEPLOYER.

(4) (a) ON AND AFTER FEBRUARY 1, 2026, A DEVELOPER SHALL

MAKE AVAILABLE, IN A MANNER THAT IS CLEAR AND READILY AVAILABLE ON

THE DEVELOPER'S WEBSITE OR IN A PUBLIC USE CASE INVENTORY, A

STATEMENT SUMMARIZING:

(I) THE TYPES OF HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS

THAT THE DEVELOPER HAS DEVELOPED OR INTENTIONALLY AND

SUBSTANTIALLY MODIFIED AND CURRENTLY MAKES AVAILABLE TO A

DEPLOYER OR OTHER DEVELOPER; AND

(II) How THE DEVELOPER MANAGES KNOWN OR REASONABLY

FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION THAT MAY ARISE

FROM THE DEVELOPMENT OR INTENTIONAL AND SUBSTANTIAL MODIFICATION

PAGE 8-SENATE BILL 24-205

OF THE TYPES OF HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS DESCRIBED

IN ACCORDANCE WITH SUBSECTION (4)(a)(I) OF THIS SECTION.

(b) A DEVELOPER SHALL UPDATE THE STATEMENT DESCRIBED IN SUBSECTION (4)(a) OF THIS SECTION:

(I) AS NECESSARY TO ENSURE THAT THE STATEMENT REMAINS

ACCURATE; AND

(II) No LATER THAN NINETY DAYS AFTER THE DEVELOPER

INTENTIONALLY AND SUBSTANTIALLY MODIFIES ANY HIGH-RISK ARTIFICIAL

INTELLIGENCE SYSTEM DESCRIBED IN SUBSECTION (4)(a)(I) OF THIS SECTION.

(5) ON AND AFTER FEBRUARY 1,2026, A DEVELOPER OF A HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM SHALL DISCLOSE TO THE ATTORNEY

GENERAL, IN A FORM AND MANNER PRESCRIBED BY THE ATTORNEY GENERAL,

AND TO ALL KNOWN DEPLOYERS OR OTHER DEVELOPERS OF THE HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM, ANY KNOWN OR REASONABLY

FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION ARISING FROM THE

INTENDED USES OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM

WITHOUT UNREASONABLE DELAY BUT NO LATER THAN NINETY DAYS AFTER

THE DATE ON WHICH:

(a) THE DEVELOPER DISCOVERS THROUGH THE DEVELOPER'S

ONGOING TESTING AND ANALYSIS THAT THE DEVELOPER'S HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM HAS BEEN DEPLOYED AND HAS CAUSED OR

IS REASONABLY LIKELY TO HAVE CAUSED ALGORITHMIC DISCRIMINATION; OR

(b) THE DEVELOPER RECEIVES FROM A DEPLOYER A CREDIBLE

REPORT THAT THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM HAS BEEN

DEPLOYED AND HAS CAUSED ALGORITHMIC DISCRIMINATION.

(6) NOTHING IN SUBSECTIONS (2) TO (5) OF THIS SECTION REQUIRES

A DEVELOPER TO DISCLOSE A TRADE SECRET, INFORMATION PROTECTED

FROM DISCLOSURE BY STATE OR FEDERAL LAW, OR INFORMATION THAT

WOULD CREATE A SECURITY RISK TO THE DEVELOPER.

(7) ON AND AFTER FEBRUARY 1,2026, THE ATTORNEY GENERAL MAY

REQUIRE THAT A DEVELOPER DISCLOSE TO THE ATTORNEY GENERAL, NO

LATER THAN NINETY DAYS AFTER THE REQUEST AND IN A FORM AND MANNER

PAGE 9-SENATE BILL 24-205

PRESCRIBED BY THE ATTORNEY GENERAL, THE STATEMENT OR

DOCUMENTATION DESCRIBED IN SUBSECTION (2) OF THIS SECTION. THE

ATTORNEY GENERAL MAY EVALUATE SUCH STATEMENT OR DOCUMENTATION

TO ENSURE COMPLIANCE WITH THIS PART 17, AND THE STATEMENT OR

DOCUMENTATION IS NOT SUBJECT TO DISCLOSURE UNDER THE "COLORADO

OPEN RECORDS ACT", PART 2 OF ARTICLE 72 OF TITLE 24. IN A DISCLOSURE

PURSUANT TO THIS SUBSECTION (7), A DEVELOPER MAY DESIGNATE THE

STATEMENT OR DOCUMENTATION AS INCLUDING PROPRIETARY INFORMATION

OR A TRADE SECRET. TO THE EXTENT THAT ANY INFORMATION CONTAINED

IN THE STATEMENT OR DOCUMENTATION INCLUDES INFORMATION SUBJECT

TO ATTORNEY-CLIENT PRIVILEGE OR WORK-PRODUCT PROTECTION, THE

DISCLOSURE DOES NOT CONSTITUTE A WAIVER OF THE PRIVILEGE OR

PROTECTION.

6-1-1703. Deployer duty to avoid algorithmic discrimination -risk management policy and program. (1) ON AND AFTER FEBRUARY 1, 2026, A DEPLOYER OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM SHALL

USE REASONABLE CARE TO PROTECT CONSUMERS FROM ANY KNOWN OR

REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION. IN ANY

ENFORCEMENT ACTION BROUGHT ON OR AFTER FEBRUARY 1, 2026, BY THE

ATTORNEY GENERAL PURSUANT TO SECTION 6-1-1706, THERE IS A

REBUTTABLE PRESUMPTION THAT A DEPLOYER OF A HIGH-RISK ARTIFICIAL

INTELLIGENCE SYSTEM USED REASONABLE CARE AS REQUIRED UNDER THIS

SECTION IF THE DEPLOYER COMPLIED WITH THIS SECTION AND ANY

ADDITIONAL REQUIREMENTS OR OBLIGATIONS AS SET FORTH IN RULES

PROMULGATED BY THE ATTORNEY GENERAL PURSUANT TO SECTION

6-1-1707.

(2) (a) ON AND AFTER FEBRUARY 1, 2026, AND EXCEPT AS PROVIDED

IN SUBSECTION (6) OF THIS SECTION, A DEPLOYER OF A HIGH-RISK ARTIFICIAL

INTELLIGENCE SYSTEM SHALL IMPLEMENT A RISK MANAGEMENT POLICY AND

PROGRAM TO GOVERN THE DEPLOYER'S DEPLOYMENT OF THE HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM. THE RISK MANAGEMENT POLICY AND

PROGRAM MUST SPECIFY AND INCORPORATE THE PRINCIPLES, PROCESSES,

AND PERSONNEL THAT THE DEPLOYER USES TO IDENTIFY, DOCUMENT, AND

MITIGATE KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC

DISCRIMINATION. THE RISK MANAGEMENT POLICY AND PROGRAM MUST BE

AN ITERATIVE PROCESS PLANNED, IMPLEMENTED, AND REGULARLY AND

SYSTEMATICALLY REVIEWED AND UPDATED OVER THE LIFE CYCLE OF A

HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, REQUIRING REGULAR,

PAGE 10-SENATE BILL 24-205

SYSTEMATIC REVIEW AND UPDATES. A RISK MANAGEMENT POLICY AND

PROGRAM IMPLEMENTED AND MAINTAINED PURSUANT TO THIS SUBSECTION

(2) MUST BE REASONABLE CONSIDERING:

(I) (A) THE GUIDANCE AND STANDARDS SET FORTH IN THE LATEST

VERSION OF THE "ARTIFICIAL INTELLIGENCE RISK MANAGEMENT

FRAMEWORK" PUBLISHED BY THE NATIONAL INSTITUTE OF STANDARDS AND

TECHNOLOGY IN THE UNITED STATES DEPARTMENT OF COMMERCE,

STANDARD ISO/IEC 42001 OF THE INTERNATIONAL ORGANIZATION FOR

STANDARDIZATION, OR ANOTHER NATIONALLY OR INTERNATIONALLY

RECOGNIZED RISK MANAGEMENT FRAMEWORK FOR ARTIFICIAL INTELLIGENCE

SYSTEMS, IF THE STANDARDS ARE SUBSTANTIALLY EQUIVALENT TO OR MORE

STRINGENT THAN THE REQUIREMENTS OF THIS PART 17; OR

(B) ANY RISK MANAGEMENT FRAMEWORK FOR ARTIFICIAL

INTELLIGENCE SYSTEMS THAT THE ATTORNEY GENERAL, IN THE ATTORNEY

GENERAL'S DISCRETION, MAY DESIGNATE;

(II) THE SIZE AND COMPLEXITY OF THE DEPLOYER;

(III) THE NATURE AND SCOPE OF THE HIGH-RISK ARTIFICIAL

INTELLIGENCE SYSTEMS DEPLOYED BY THE DEPLOYER, INCLUDING THE

INTENDED USES OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS; AND

(IV) THE SENSITIVITY AND VOLUME OF DATA PROCESSED IN

CONNECTION WITH THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS

DEPLOYED BY THE DEPLOYER.

(b) A RISK MANAGEMENT POLICY AND PROGRAM IMPLEMENTED PURSUANT TO SUBSECTION (2)(a) OF THIS SECTION MAY COVER MULTIPLE

HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS DEPLOYED BY THE DEPLOYER.

(3) (a) EXCEPT AS PROVIDED IN SUBSECTIONS (3)(d), (3)(e), AND (6)

OF THIS SECTION:

(I) A DEPLOYER, OR A THIRD PARTY CONTRACTED BY THE DEPLOYER,

THAT DEPLOYS A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM ON OR AFTER

FEBRUARY 1, 2026, SHALL COMPLETE AN IMPACT ASSESSMENT FOR THE

HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; AND

PAGE 11-SENATE BILL 24-205

(II) ON AND AFTER FEBRUARY 1, 2026, A DEPLOYER, OR A THIRD

PARTY CONTRACTED BY THE DEPLOYER, SHALL COMPLETE AN IMPACT

ASSESSMENT FOR A DEPLOYED HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM

AT LEAST ANNUALLY AND WITHIN NINETY DAYS AFTER ANY INTENTIONAL

AND SUBSTANTIAL MODIFICATION TO THE HIGH-RISK ARTIFICIAL

INTELLIGENCE SYSTEM IS MADE AVAILABLE.

(b) AN IMPACT ASSESSMENT COMPLETED PURSUANT TO THIS

SUBSECTION (3) MUST INCLUDE, AT A MINIMUM, AND TO THE EXTENT

REASONABLY KNOWN BY OR AVAILABLE TO THE DEPLOYER:

(I) A STATEMENT BY THE DEPLOYER DISCLOSING THE PURPOSE,

INTENDED USE CASES, AND DEPLOYMENT CONTEXT OF, AND BENEFITS

AFFORDED BY, THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM;

(II) AN ANALYSIS OF WHETHER THE DEPLOYMENT OF THE HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM POSES ANY KNOWN OR REASONABLY

FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION AND, IF SO, THE

NATURE OF THE ALGORITHMIC DISCRIMINATION AND THE STEPS THAT HAVE

BEEN TAKEN TO MITIGATE THE RISKS;

(III) A DESCRIPTION OF THE CATEGORIES OF DATA THE HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM PROCESSES AS INPUTS AND THE OUTPUTS

THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM PRODUCES;

(IV) IF THE DEPLOYER USED DATA TO CUSTOMIZE THE HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM, AN OVERVIEW OF THE CATEGORIES OF

DATA THE DEPLOY ER USED TO CUSTOMIZE THE HIGH-RISK ARTIFICIAL

INTELLIGENCE SYSTEM;

(V) ANY METRICS USED TO EVALUATE THE PERFORMANCE AND

KNOWN LIMITATIONS OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM;

(VI) A DESCRIPTION OF ANY TRANSPARENCY MEASURES TAKEN

CONCERNING THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, INCLUDING

ANY MEASURES TAKEN TO DISCLOSE TO A CONSUMER THAT THE HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM IS IN USE WHEN THE HIGH-RISK ARTIFICIAL

INTELLIGENCE SYSTEM IS IN USE; AND

(VII) A DESCRIPTION OF THE POST-DEPLOYMENT MONITORING AND

PAGE 12-SENATE BILL 24-205

USER SAFEGUARDS PROVIDED CONCERNING THE HIGH-RISK ARTIFICIAL

INTELLIGENCE SYSTEM, INCLUDING THE OVERSIGHT, USE, AND LEARNING

PROCESS ESTABLISHED BY THE DEPLOYER TO ADDRESS ISSUES ARISING FROM

THE DEPLOYMENT OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM.

(C) IN ADDITION TO THE INFORMATION REQUIRED UNDER SUBSECTION

(3)(b) OF THIS SECTION, AN IMPACT ASSESSMENT COMPLETED PURSUANT TO

THIS SUBSECTION (3) FOLLOWING AN INTENTIONAL AND SUBSTANTIAL

MODIFICATION TO A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM ON OR

AFTER FEBRUARY 1, 2026, MUST INCLUDE A STATEMENT DISCLOSING THE

EXTENT TO WHICH THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM WAS

USED IN A MANNER THAT WAS CONSISTENT WITH, OR VARIED FROM, THE

DEVELOPER'S INTENDED USES OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE

SYSTEM.

(d) A SINGLE IMPACT ASSESSMENT MAY ADDRESS A COMPARABLE

SET OF HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS DEPLOYED BY A

DEPLOYER.

(e) IF A DEPLOYER, OR A THIRD PARTY CONTRACTED BY THE

DEPLOYER, COMPLETES AN IMPACT ASSESSMENT FOR THE PURPOSE OF

COMPLYING WITH ANOTHER APPLICABLE LAW OR REGULATION, THE IMPACT

ASSESSMENT SATISFIES THE REQUIREMENTS ESTABLISHED IN THIS

SUBSECTION (3) IF THE IMPACT ASSESSMENT IS REASONABLY SIMILAR IN

SCOPE AND EFFECT TO THE IMPACT ASSESSMENT THAT WOULD OTHERWISE

BE COMPLETED PURSUANT TO THIS SUBSECTION (3).

(f) A DEPLOYER SHALL MAINTAIN THE MOST RECENTLY COMPLETED

IMPACT ASSESSMENT FOR A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM AS

REQUIRED UNDER THIS SUBSECTION (3), ALL RECORDS CONCERNING EACH

IMPACT ASSESSMENT, AND ALL PRIOR IMPACT ASSESSMENTS, IF ANY, FOR AT

LEAST THREE YEARS FOLLOWING THE FINAL DEPLOYMENT OF THE HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM.

(g) ON OR BEFORE FEBRUARY 1, 2026, AND AT LEAST ANNUALLY

THEREAFTER, A DEPLOYER, OR A THIRD PARTY CONTRACTED BY THE

DEPLOYER, MUST REVIEW THE DEPLOYMENT OF EACH HIGH-RISK ARTIFICIAL

INTELLIGENCE SYSTEM DEPLOYED BY THE DEPLOYER TO ENSURE THAT THE

HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS NOT CAUSING ALGORITHMIC

DISCRIMINATION.

PAGE 13-SENATE BILL 24-205

(4) (a) ON AND AFTER FEBRUARY 1, 2026, AND NO LATER THAN THE

TIME THAT A DEPLOYER DEPLOYS A HIGH-RISK ARTIFICIAL INTELLIGENCE

SYSTEM TO MAKE, OR BE A SUBSTANTIAL FACTOR IN MAKING, A

CONSEQUENTIAL DECISION CONCERNING A CONSUMER, THE DEPLOYER

SHALL:

(I) NOTIFY THE CONSUMER THAT THE DEPLOYER HAS DEPLOYED A

HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM TO MAKE, OR BE A

SUBSTANTIAL FACTOR IN MAKING, A CONSEQUENTIAL DECISION BEFORE THE

DECISION IS MADE;

(II) PROVIDE TO THE CONSUMER A STATEMENT DISCLOSING THE

PURPOSE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM AND THE

NATURE OF THE CONSEQUENTIAL DECISION; THE CONTACT INFORMATION FOR

THE DEPLOYER; A DESCRIPTION, IN PLAIN LANGUAGE, OF THE HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM; AND INSTRUCTIONS ON HOW TO ACCESS

THE STATEMENT REQUIRED BY SUBSECTION (5)(a) OF THIS SECTION; AND

(III) PROVIDE TO THE CONSUMER INFORMATION, IF APPLICABLE,

REGARDING THE CONSUMER'S RIGHT TO OPT OUT OF THE PROCESSING OF

PERSONAL DATA CONCERNING THE CONSUMER FOR PURPOSES OF PROFILING

IN FURTHERANCE OF DECISIONS THAT PRODUCE LEGAL OR SIMILARLY

SIGNIFICANT EFFECTS CONCERNING THE CONSUMER UNDER SECTION

6-1-1306 (1)(a)(I)(C).

(b) ON AND AFTER FEBRUARY 1, 2026, A DEPLOYER THAT HAS

DEPLOYED A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM TO MAKE, OR BE

A SUBSTANTIAL FACTOR IN MAKING, A CONSEQUENTIAL DECISION

CONCERNING A CONSUMER SHALL, IF THE CONSEQUENTIAL DECISION IS

ADVERSE TO THE CONSUMER, PROVIDE TO THE CONSUMER:

(I) A STATEMENT DISCLOSING THE PRINCIPAL REASON OR REASONS

FOR THE CONSEQUENTIAL DECISION, INCLUDING:

(A) THE DEGREE TO WHICH, AND MANNER IN WHICH, THE HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM CONTRIBUTED TO THE CONSEQUENTIAL

DECISION;

(B) THE TYPE OF DATA THAT WAS PROCESSED BY THE HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM IN MAKING THE CONSEQUENTIAL

PAGE 14-SENATE BILL 24-205

DECISION; AND

(C) THE SOURCE OR SOURCES OF THE DATA DESCRIBED IN

SUBSECTION (4)(b)(I)(B) OF THIS SECTION;

(II) AN OPPORTUNITY TO CORRECT ANY INCORRECT PERSONAL DATA

THAT THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM PROCESSED IN

MAKING, OR AS A SUBSTANTIAL FACTOR IN MAKING, THE CONSEQUENTIAL

DECISION; AND

(III) AN OPPORTUNITY TO APPEAL AN ADVERSE CONSEQUENTIAL

DECISION CONCERNING THE CONSUMER ARISING FROM THE DEPLOYMENT OF

A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, WHICH APPEAL MUST, IF

TECHNICALLY FEASIBLE, ALLOW FOR HUMAN REVIEW UNLESS PROVIDING THE

OPPORTUNITY FOR APPEAL IS NOT IN THE BEST INTEREST OF THE CONSUMER,

INCLUDING IN INSTANCES IN WHICH ANY DELAY MIGHT POSE A RISK TO THE

LIFE OR SAFETY OF SUCH CONSUMER.

(c) (I) EXCEPT AS PROVIDED IN SUBSECTION (4)(c)(II) OF THIS

SECTION, A DEPLOYER SHALL PROVIDE THE NOTICE, STATEMENT, CONTACT

INFORMATION, AND DESCRIPTION REQUIRED BY SUBSECTIONS (4)(a) AND (4)(b) OF THIS SECTION:

(A) DIRECTLY TO THE CONSUMER;

(B) IN PLAIN LANGUAGE;

(C) IN ALL LANGUAGES IN WHICH THE DEPLOYER, IN THE ORDINARY

COURSE OF THE DEPLOYER'S BUSINESS, PROVIDES CONTRACTS, DISCLAIMERS,

SALE ANNOUNCEMENTS, AND OTHER INFORMATION TO CONSUMERS; AND

(D) IN A FORMAT THAT IS ACCESSIBLE TO CONSUMERS WITH

DISABILITIES.

(II) IF THE DEPLOYER IS UNABLE TO PROVIDE THE NOTICE,

STATEMENT, CONTACT INFORMATION, AND DESCRIPTION REQUIRED BY

SUBSECTIONS (4)(a) AND (4)(b) OF THIS SECTION DIRECTLY TO THE

CONSUMER, THE DEPLOYER SHALL MAKE THE NOTICE, STATEMENT, CONTACT

INFORMATION, AND DESCRIPTION AVAILABLE IN A MANNER THAT IS

REASONABLY CALCULATED TO ENSURE THAT THE CONSUMER RECEIVES THE

PAGE 15-SENATE BILL 24-205

NOTICE, STATEMENT, CONTACT INFORMATION, AND DESCRIPTION.

(5) (a) ON AND AFTER FEBRUARY 1, 2026, AND EXCEPT AS PROVIDED

IN SUBSECTION (6) OF THIS SECTION, A DEPLOYER SHALL MAKE AVAILABLE,

IN A MANNER THAT IS CLEAR AND READILY AVAILABLE ON THE DEPLOYER'S

WEBSITE, A STATEMENT SUMMARIZING:

(I) THE TYPES OF HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS

THAT ARE CURRENTLY DEPLOYED BY THE DEPLOYER;

(II) How THE DEPLOYER MANAGES KNOWN OR REASONABLY

FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION THAT MAY ARISE

FROM THE DEPLOYMENT OF EACH HIGH-RISK ARTIFICIAL INTELLIGENCE

SYSTEM DESCRIBED PURSUANT TO SUBSECTION (5)(a)(I) OF THIS SECTION;

AND

(III) IN DETAIL, THE NATURE, SOURCE, AND EXTENT OF THE

INFORMATION COLLECTED AND USED BY THE DEPLOYER.

(b) A DEPLOYER SHALL PERIODICALLY UPDATE THE STATEMENT DESCRIBED IN SUBSECTION (5)(a) OF THIS SECTION.

(6) SUBSECTIONS (2), (3), AND (5) OF THIS SECTION DO NOT APPLY TO

A DEPLOYER IF, AT THE TIME THE DEPLOYER DEPLOYS A HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM AND AT ALL TIMES WHILE THE HIGH-RISK

ARTIFICIAL INTELLIGENCE SYSTEM IS DEPLOYED:

(a) THE DEPLOYER:

(I) EMPLOYS FEWER THAN FIFTY FULL-TIME EQUIVALENT

EMPLOYEES; AND

(II) DOES NOT USE THE DEPLOYER'S OWN DATA TO TRAIN THE

HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM;

(b) THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM:

(I) IS USED FOR THE INTENDED USES THAT ARE DISCLOSED TO THE

DEPLOYER AS REQUIRED BY SECTION 6-1-1702 (2)(a); AND

PAGE 16-SENATE BILL 24-205

(II) CONTINUES LEARNING BASED ON DATA DERIVED FROM SOURCES

OTHER THAN THE DEPLOYER'S OWN DATA; AND

(c) THE DEPLOYER MAKES AVAILABLE TO CONSUMERS ANY IMPACT

ASSESSMENT THAT:

(I) THE DEVELOPER OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE

SYSTEM HAS COMPLETED AND PROVIDED TO THE DEPLOYER; AND

(II) INCLUDES INFORMATION THAT IS SUBSTANTIALLY SIMILAR TO

THE INFORMATION IN THE IMPACT ASSESSMENT REQUIRED UNDER

SUBSECTION (3)(b) OF THIS SECTION.

(7) IF A DEPLOYER DEPLOYS A HIGH-RISK ARTIFICIAL INTELLIGENCE

SYSTEM ON OR AFTER FEBRUARY 1, 2026, AND SUBSEQUENTLY DISCOVERS

THAT THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM HAS CAUSED

ALGORITHMIC DISCRIMINATION, THE DEPLOYER, WITHOUT UNREASONABLE

DELAY, BUT NO LATER THAN NINETY DAYS AFTER THE DATE OF THE

DISCOVERY, SHALL SEND TO THE ATTORNEY GENERAL, IN A FORM AND

MANNER PRESCRIBED BY THE ATTORNEY GENERAL, A NOTICE DISCLOSING

THE DISCOVERY.

(8) NOTHING IN SUBSECTIONS (2) TO (5) AND (7) OF THIS SECTION

REQUIRES A DEPLOYER TO DISCLOSE A TRADE SECRET OR INFORMATION

PROTECTED FROM DISCLOSURE BY STATE OR FEDERAL LAW. TO THE EXTENT

THAT A DEPLOYER WITHHOLDS INFORMATION PURSUANT TO THIS

SUBSECTION (8) OR SECTION 6-1-1705 (5), THE DEPLOYER SHALL NOTIFY THE

CONSUMER AND PROVIDE A BASIS FOR THE WITHHOLDING.

(9) ON AND AFTER FEBRUARY 1, 2026, THE ATTORNEY GENERAL MAY

REQUIRE THAT A DEPLOYER, OR A THIRD PARTY CONTRACTED BY THE

DEPLOYER, DISCLOSE TO THE ATTORNEY GENERAL, NO LATER THAN NINETY

DAYS AFTER THE REQUEST AND IN A FORM AND MANNER PRESCRIBED BY THE

ATTORNEY GENERAL, THE RISK MANAGEMENT POLICY IMPLEMENTED

PURSUANT TO SUBSECTION (2) OF THIS SECTION, THE IMPACT ASSESSMENT

COMPLETED PURSUANT TO SUBSECTION (3) OF THIS SECTION, OR THE

RECORDS MAINTAINED PURSUANT TO SUBSECTION (3)(f) OF THIS SECTION.

THE ATTORNEY GENERAL MAY EVALUATE THE RISK MANAGEMENT POLICY,

IMPACT ASSESSMENT, OR RECORDS TO ENSURE COMPLIANCE WITH THIS PART

17, AND THE RISK MANAGEMENT POLICY, IMPACT ASSESSMENT, AND

PAGE 17-SENATE BILL 24-205

RECORDS ARE NOT SUBJECT TO DISCLOSURE UNDER THE "COLORADO OPEN

RECORDS ACT", PART 2 OF ARTICLE 72 OF TITLE 24. IN A DISCLOSURE

PURSUANT TO THIS SUBSECTION (9), A DEPLOYER MAY DESIGNATE THE

STATEMENT OR DOCUMENTATION AS INCLUDING PROPRIETARY INFORMATION

OR A TRADE SECRET. To THE EXTENT THAT ANY INFORMATION CONTAINED

IN THE RISK MANAGEMENT POLICY, IMPACT ASSESSMENT, OR RECORDS

INCLUDE INFORMATION SUBJECT TO ATTORNEY-CLIENT PRIVILEGE OR

WORK-PRODUCT PROTECTION, THE DISCLOSURE DOES NOT CONSTITUTE A

WAIVER OF THE PRIVILEGE OR PROTECTION.

6-1-1704. Disclosure of an artificial intelligence system to consumer. (1) ON AND AFTER FEBRUARY 1, 2026, AND EXCEPT AS

PROVIDED IN SUBSECTION (2) OF THIS SECTION, A DEPLOYER OR OTHER

DEVELOPER THAT DEPLOYS, OFFERS, SELLS, LEASES, LICENSES, GIVES, OR

OTHERWISE MAKES AVAILABLE AN ARTIFICIAL INTELLIGENCE SYSTEM THAT

IS INTENDED TO INTERACT WITH CONSUMERS SHALL ENSURE THE DISCLOSURE

TO EACH CONSUMER WHO INTERACTS WITH THE ARTIFICIAL INTELLIGENCE

SYSTEM THAT THE CONSUMER IS INTERACTING WITH AN ARTIFICIAL

INTELLIGENCE SYSTEM.

(2) DISCLOSURE IS NOT REQUIRED UNDER SUBSECTION (1) OF THIS

SECTION UNDER CIRCUMSTANCES IN WHICH IT WOULD BE OBVIOUS TO A

REASONABLE PERSON THAT THE PERSON IS INTERACTING WITH AN ARTIFICIAL

INTELLIGENCE SYSTEM.

6-1-1705. Compliance with other legal obligations - definitions.

(1) NOTHING IN THIS PART 17 RESTRICTS A DEVELOPER'S, A DEPLOYER'S, OR

OTHER PERSON'S ABILITY TO:

(a) COMPLY WITH FEDERAL, STATE, OR MUNICIPAL LAWS, ORDINANCES, OR REGULATIONS;

(b) COMPLY WITH A CIVIL, CRIMINAL, OR REGULATORY INQUIRY, INVESTIGATION, SUBPOENA, OR SUMMONS BY A FEDERAL, A STATE, A

MUNICIPAL, OR OTHER GOVERNMENTAL AUTHORITY;

(C) COOPERATE WITH A LAW ENFORCEMENT AGENCY CONCERNING

CONDUCT OR ACTIVITY THAT THE DEVELOPER, DEPLOYER, OR OTHER PERSON

REASONABLY AND IN GOOD FAITH BELIEVES MAY VIOLATE FEDERAL, STATE,

OR MUNICIPAL LAWS, ORDINANCES, OR REGULATIONS;

PAGE 18-SENATE BILL 24-205

(d) INVESTIGATE, ESTABLISH, EXERCISE, PREPARE FOR, OR DEFEND

LEGAL CLAIMS;

(e) TAKE IMMEDIATE STEPS TO PROTECT AN INTEREST THAT IS

ESSENTIAL FOR THE LIFE OR PHYSICAL SAFETY OF A CONSUMER OR ANOTHER

INDIVIDUAL;

(f) BY ANY MEANS OTHER THAN THE USE OF FACIAL RECOGNITION

TECHNOLOGY, PREVENT, DETECT, PROTECT AGAINST, OR RESPOND TO

SECURITY INCIDENTS, IDENTITY THEFT, FRAUD, HARASSMENT, MALICIOUS OR

DECEPTIVE ACTIVITIES, OR ILLEGAL ACTIVITY; INVESTIGATE, REPORT, OR

PROSECUTE THE PERSONS RESPONSIBLE FOR ANY SUCH ACTION; OR PRESERVE

THE INTEGRITY OR SECURITY OF SYSTEMS;

(g) ENGAGE IN PUBLIC OR PEER-REVIEWED SCIENTIFIC OR

STATISTICAL RESEARCH IN THE PUBLIC INTEREST THAT ADHERES TO ALL

OTHER APPLICABLE ETHICS AND PRIVACY LAWS AND IS CONDUCTED IN

ACCORDANCE WITH 45 CFR46, AS AMENDED, OR RELEVANT REQUIREMENTS

ESTABLISHED BY THE FEDERAL FOOD AND DRUG ADMINISTRATION;

(h) CONDUCT RESEARCH, TESTING, AND DEVELOPMENT ACTIVITIES

REGARDING AN ARTIFICIAL INTELLIGENCE SYSTEM OR MODEL, OTHER THAN

TESTING CONDUCTED UNDER REAL-WORLD CONDITIONS, BEFORE THE

ARTIFICIAL INTELLIGENCE SYSTEM OR MODEL IS PLACED ON THE MARKET,

DEPLOYED, OR PUT INTO SERVICE, AS APPLICABLE; OR

(i) ASSIST ANOTHER DEVELOPER, DEPLOYER, OR OTHER PERSON WITH

ANY OF THE OBLIGATIONS IMPOSED UNDER THIS PART 17.

(2) THE OBLIGATIONS IMPOSED ON DEVELOPERS, DEPLOYERS, OR

OTHER PERSONS UNDER THIS PART 17 DO NOT RESTRICT A DEVELOPER'S, A

DEPLOYER'S, OR OTHER PERSON'S ABILITY TO:

(a) EFFECTUATE A PRODUCT RECALL; OR

(b) IDENTIFY AND REPAIR TECHNICAL ERRORS THAT IMPAIR EXISTING

OR INTENDED FUNCTIONALITY.

(3) THE OBLIGATIONS IMPOSED ON DEVELOPERS, DEPLOYERS, OR

OTHER PERSONS UNDER THIS PART 17 DO NOT APPLY WHERE COMPLIANCE

PAGE 19-SENATE BILL 24-205

WITH THIS PART 17 BY THE DEVELOPER, DEPLOYER, OR OTHER PERSON

WOULD VIOLATE AN EVIDENTIARY PRIVILEGE UNDER THE LAWS OF THIS

STATE.

(4) NOTHING IN THIS PART 17 IMPOSES ANY OBLIGATION ON A

DEVELOPER, A DEPLOYER, OR OTHER PERSON THAT ADVERSELY AFFECTS THE

RIGHTS OR FREEDOMS OF A PERSON, INCLUDING THE RIGHTS OF A PERSON TO

FREEDOM OF SPEECH OR FREEDOM OF THE PRESS THAT ARE GUARANTEED IN:

(a) THE FIRST AMENDMENT TO THE UNITED STATES CONSTITUTION;

OR

(b) SECTION 10 OF ARTICLE II OF THE STATE CONSTITUTION.

(5) NOTHING IN THIS PART 17 APPLIES TO A DEVELOPER, A DEPLOYER,

OR OTHER PERSON:

(a) INSOFAR AS THE DEVELOPER, DEPLOYER, OR OTHER PERSON

DEVELOPS, DEPLOYS, PUTS INTO SERVICE, OR INTENTIONALLY AND

SUBSTANTIALLY MODIFIES, AS APPLICABLE, A HIGH-RISK ARTIFICIAL

INTELLIGENCE SYSTEM:

(I) THAT HAS BEEN APPROVED, AUTHORIZED, CERTIFIED, CLEARED,

DEVELOPED, OR GRANTED BY A FEDERAL AGENCY, SUCH AS THE FEDERAL

FOOD AND DRUG ADMINISTRATION OR THE FEDERAL AVIATION

ADMINISTRATION, ACTING WITHIN THE SCOPE OF THE FEDERAL AGENCY'S

AUTHORITY, OR BY A REGULATED ENTITY SUBJECT TO THE SUPERVISION AND

REGULATION OF THE FEDERAL HOUSING FINANCE AGENCY; OR

(II) IN COMPLIANCE WITH STANDARDS ESTABLISHED BY A FEDERAL

AGENCY, INCLUDING STANDARDS ESTABLISHED BY THE FEDERAL OFFICE OF

THE NATIONAL COORDINATOR FOR HEALTH INFORMATION TECHNOLOGY, OR

BY A REGULATED ENTITY SUBJECT TO THE SUPERVISION AND REGULATION OF

THE FEDERAL HOUSING FINANCE AGENCY, IF THE STANDARDS ARE

SUBSTANTIALLY EQUIVALENT OR MORE STRINGENT THAN THE

REQUIREMENTS OF THIS PART 17;

(b) CONDUCTING RESEARCH TO SUPPORT AN APPLICATION FOR

APPROVAL OR CERTIFICATION FROM A FEDERAL AGENCY, INCLUDING THE

FEDERAL AVIATION ADMINISTRATION, THE FEDERAL COMMUNICATIONS

PAGE 20-SENATE BILL 24-205

COMMISSION, OR THE FEDERAL FOOD AND DRUG ADMINISTRATION OR

RESEARCH TO SUPPORT AN APPLICATION OTHERWISE SUBJECT TO REVIEW BY

THE FEDERAL AGENCY;

(c) PERFORMING WORK UNDER, OR IN CONNECTION WITH, A

CONTRACT WITH THE UNITED STATES DEPARTMENT OF COMMERCE, THE

UNITED STATES DEPARTMENT OF DEFENSE, OR THE NATIONAL AERONAUTICS

AND SPACE ADMINISTRATION, UNLESS THE DEVELOPER, DEPLOYER, OR OTHER

PERSON IS PERFORMING THE WORK ON A HIGH-RISK ARTIFICIAL INTELLIGENCE

SYSTEM THAT IS USED TO MAKE, OR IS A SUBSTANTIAL FACTOR IN MAKING,

A DECISION CONCERNING EMPLOYMENT OR HOUSING; OR

(d) THAT IS A COVERED ENTITY WITHIN THE MEANING OF THE

FEDERAL "HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF

1996", 42 U.S.C. SECS. 1320d TO 1320d-9, AND THE REGULATIONS

PROMULGATED UNDER THE FEDERAL ACT, AS BOTH MAY BE AMENDED FROM

TIME TO TIME, AND IS PROVIDING HEALTH-CARE RECOMMENDATIONS THAT:

(I) ARE GENERATED BY AN ARTIFICIAL INTELLIGENCE SYSTEM;

(II) REQUIRE A HEALTH-CARE PROVIDER TO TAKE ACTION TO

IMPLEMENT THE RECOMMENDATIONS; AND

(III) ARE NOT CONSIDERED TO BE HIGH RISK.

(6) NOTHING IN THIS PART 17 APPLIES TO ANY ARTIFICIAL

INTELLIGENCE SYSTEM THAT IS ACQUIRED BY OR FOR THE FEDERAL

GOVERNMENT OR ANY FEDERAL AGENCY OR DEPARTMENT, INCLUDING THE

UNITED STATES DEPARTMENT OF COMMERCE, THE UNITED STATES

DEPARTMENT OF DEFENSE, OR THE NATIONAL AERONAUTICS AND SPACE

ADMINISTRATION, UNLESS THE ARTIFICIAL INTELLIGENCE SYSTEM IS A

HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM THAT IS USED TO MAKE, OR IS

A SUBSTANTIAL FACTOR IN MAKING, A DECISION CONCERNING EMPLOYMENT

OR HOUSING.

(7) AN INSURER, AS DEFINED IN SECTION 10-1-102 (13), A

FRATERNAL BENEFIT SOCIETY, AS DESCRIBED IN SECTION 10-14-102, OR A

DEVELOPER OF AN ARTIFICIAL INTELLIGENCE SYSTEM USED BY AN INSURER

IS IN FULL COMPLIANCE WITH THIS PART 17 IF THE INSURER, THE FRATERNAL

BENEFIT SOCIETY, OR THE DEVELOPER IS SUBJECT TO THE REQUIREMENTS OF

PAGE 21-SENATE BILL 24-205

SECTION 10-3-1104.9 AND ANY RULES ADOPTED BY THE COMMISSIONER OF

INSURANCE PURSUANT TO SECTION 10-3-1104.9.

(8) (a) A BANK, OUT-OF-STATE BANK, CREDIT UNION CHARTERED BY

THE STATE OF COLORADO, FEDERAL CREDIT UNION, OUT-OF-STATE CREDIT

UNION, OR ANY AFFILIATE OR SUBSIDIARY THEREOF, IS IN FULL COMPLIANCE

WITH THIS PART 17 IF THE BANK, OUT-OF-STATE BANK, CREDIT UNION

CHARTERED BY THE STATE OF COLORADO, FEDERAL CREDIT UNION,

OUT-OF-STATE CREDIT UNION, OR AFFILIATE OR SUBSIDIARY IS SUBJECT TO

EXAMINATION BY A STATE OR FEDERAL PRUDENTIAL REGULATOR UNDER ANY

PUBLISHED GUIDANCE OR REGULATIONS THAT APPLY TO THE USE OF

HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS AND THE GUIDANCE OR

REGULATIONS:

(I) IMPOSE REQUIREMENTS THAT ARE SUBSTANTIALLY EQUIVALENT

TO OR MORE STRINGENT THAN THE REQUIREMENTS IMPOSED IN THIS PART 17;

AND

(II) AT A MINIMUM, REQUIRE THE BANK, OUT-OF-STATE BANK,

CREDIT UNION CHARTERED BY THE STATE OF COLORADO, FEDERAL CREDIT

UNION, OUT-OF-STATE CREDIT UNION, OR AFFILIATE OR SUBSIDIARY TO:

(A) REGULARLY AUDIT THE BANK'S, OUT-OF-STATE BANK'S, CREDIT

UNION CHARTERED BY THE STATE OF COLORADO'S, FEDERAL CREDIT UNION'S,

OUT-OF-STATE CREDIT UNION'S, OR AFFILIATE'S OR SUBSIDIARY'S USE OF

HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS FOR COMPLIANCE WITH STATE

AND FEDERAL ANTI-DISCRIMINATION LAWS AND REGULATIONS APPLICABLE

TO THE BANK, OUT-OF-STATE BANK, CREDIT UNION CHARTERED BY THE

STATE OF COLORADO, FEDERAL CREDIT UNION, OUT-OF-STATE CREDIT

UNION, OR AFFILIATE OR SUBSIDIARY; AND

(B) MITIGATE ANY ALGORITHMIC DISCRIMINATION CAUSED BY THE

USE OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM OR ANY RISK OF

ALGORITHMIC DISCRIMINATION THAT IS REASONABLY FORESEEABLE AS A

RESULT OF THE USE OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM.

(b) AS USED IN THIS SUBSECTION (8):

(I) "AFFILIATE" HAS THE MEANING SET FORTH IN SECTION

11-101-401 (3.5).

PAGE 22-SENATE BILL 24-205

(II) "BANK" HAS THE MEANING SET FORTH IN SECTION 11-101-401

(5).

(III) "CREDIT UNION" HAS THE MEANING SET FORTH IN SECTION

11-30-101 (1)(a).

(IV) "OUT-OF-STATE BANK" HAS THE MEANING SET FORTH IN

SECTION 11-101-401 (50).

(9) IF A DEVELOPER, A DEPLOYER, OR OTHER PERSON ENGAGES IN AN

ACTION PURSUANT TO AN EXEMPTION SET FORTH IN THIS SECTION, THE

DEVELOPER, DEPLOYER, OR OTHER PERSON BEARS THE BURDEN OF

DEMONSTRATING THAT THE ACTION QUALIFIES FOR THE EXEMPTION.

6-1-1706. Enforcement by attorney general.

(1) NOTWITHSTANDING SECTION 6-1-103, THE ATTORNEY GENERAL HAS

EXCLUSIVE AUTHORITY TO ENFORCE THIS PART 17.

(2) EXCEPT AS PROVIDED IN SUBSECTION (3) OF THIS SECTION, A

VIOLATION OF THE REQUIREMENTS ESTABLISHED IN THIS PART 17

CONSTITUTES AN UNFAIR TRADE PRACTICE PURSUANT TO SECTION 6-1-105

(1)(hhhh).

(3) IN ANY ACTION COMMENCED BY THE ATTORNEY GENERAL TO

ENFORCE THIS PART 17, IT IS AN AFFIRMATIVE DEFENSE THAT THE

DEVELOPER, DEPLOYER, OR OTHER PERSON:

(a) DISCOVERS AND CURES A VIOLATION OF THIS PART 17 AS A

RESULT OF:

(I) FEEDBACK THAT THE DEVELOPER, DEPLOYER, OR OTHER PERSON

ENCOURAGES DEPLOYERS OR USERS TO PROVIDE TO THE DEVELOPER,

DEPLOYER, OR OTHER PERSON;

(II) ADVERSARIAL TESTING OR RED TEAMING, AS THOSE TERMS ARE

DEFINED OR USED BY THE NATIONAL INSTITUTE OF STANDARDS AND

TECHNOLOGY; OR

(III) AN INTERNAL REVIEW PROCESS; AND

PAGE 23-SENATE BILL 24-205

(b) IS OTHERWISE IN COMPLIANCE WITH:

(I) THE LATEST VERSION OF THE "ARTIFICIAL INTELLIGENCE RISK

MANAGEMENT FRAMEWORK" PUBLISHED BY THE NATIONAL INSTITUTE OF

STANDARDS AND TECHNOLOGY IN THE UNITED STATES DEPARTMENT OF

COMMERCE AND STANDARD ISO/IEC 42001 OF THE INTERNATIONAL

ORGANIZATION FOR STANDARDIZATION;

(II) ANOTHER NATIONALLY OR INTERNATIONALLY RECOGNIZED RISK

MANAGEMENT FRAMEWORK FOR ARTIFICIAL INTELLIGENCE SYSTEMS, IF THE

STANDARDS ARE SUBSTANTIALLY EQUIVALENT TO OR MORE STRINGENT

THAN THE REQUIREMENTS OF THIS PART 17; OR

(III) ANY RISK MANAGEMENT FRAMEWORK FOR ARTIFICIAL

INTELLIGENCE SYSTEMS THAT THE ATTORNEY GENERAL, IN THE ATTORNEY

GENERAL'S DISCRETION, MAY DESIGNATE AND, IF DESIGNATED, SHALL

PUBLICLY DISSEMINATE.

(4) A DEVELOPER, A DEPLOYER, OR OTHER PERSON BEARS THE

BURDEN OF DEMONSTRATING TO THE ATTORNEY GENERAL THAT THE

REQUIREMENTS ESTABLISHED IN SUBSECTION (3) OF THIS SECTION HAVE

BEEN SATISFIED.

(5) NOTHING IN THIS PART 17, INCLUDING THE ENFORCEMENT

AUTHORITY GRANTED TO THE ATTORNEY GENERAL UNDER THIS SECTION,

PREEMPTS OR OTHERWISE AFFECTS ANY RIGHT, CLAIM, REMEDY,

PRESUMPTION, OR DEFENSE AVAILABLE AT LAW OR IN EQUITY. A

REBUTTABLE PRESUMPTION OR AFFIRMATIVE DEFENSE ESTABLISHED UNDER

THIS PART 17 APPLIES ONLY TO AN ENFORCEMENT ACTION BROUGHT BY THE

ATTORNEY GENERAL PURSUANT TO THIS SECTION AND DOES NOT APPLY TO

ANY RIGHT, CLAIM, REMEDY, PRESUMPTION, OR DEFENSE AVAILABLE AT LAW

OR IN EQUITY.

(6) THIS PART 17 DOES NOT PROVIDE THE BASIS FOR, AND IS NOT

SUBJECT TO, A PRIVATE RIGHT OF ACTION FOR VIOLATIONS OF THIS PART 17

OR ANY OTHER LAW.

6-1-1707. Rules. (1) THE ATTORNEY GENERAL MAY PROMULGATE

RULES AS NECESSARY FOR THE PURPOSE OF IMPLEMENTING AND ENFORCING

THIS PART 17, INCLUDING:

PAGE 24-SENATE BILL 24-205

(a) THE DOCUMENTATION AND REQUIREMENTS FOR DEVELOPERS

PURSUANT TO SECTION 6-1-1702 (2);

(b) THE CONTENTS OF AND REQUIREMENTS FOR THE NOTICES AND

DISCLOSURES REQUIRED BY SECTIONS 6-1-1702 (5) AND (7); 6-1-1703 (4),

(5), (7), AND (9); AND 6-1-1704;

(c) THE CONTENT AND REQUIREMENTS OF THE RISK MANAGEMENT

POLICY AND PROGRAM REQUIRED BY SECTION 6-1-1703 (2);

(d) THE CONTENT AND REQUIREMENTS OF THE IMPACT ASSESSMENTS

REQUIRED BY SECTION 6-1-1703 (3);

(e) THE REQUIREMENTS FOR THE REBUTTABLE PRESUMPTIONS SET

FORTH IN SECTIONS 6-1-1702 AND 6-1-1703; AND

(f) THE REQUIREMENTS FOR THE AFFIRMATIVE DEFENSE SET FORTH

IN SECTION 6-1-1706 (3), INCLUDING THE PROCESS BY WHICH THE ATTORNEY

GENERAL WILL RECOGNIZE ANY OTHER NATIONALLY OR INTERNATIONALLY

RECOGNIZED RISK MANAGEMENT FRAMEWORK FOR ARTIFICIAL INTELLIGENCE

SYSTEMS.

SECTION 2. In Colorado Revised Statutes, 6-1-105, add (1)(hhhh) as follows:

6-1-105. Unfair or deceptive trade practices. (1) A person engages in a deceptive trade practice when, in the course of the person's business, vocation, or occupation, the person:

(hhhh) VIOLATES PART 17 OF THIS ARTICLE 1.

SECTION 3. Safety clause. The general assembly finds, determines, and declares that this act is necessary for the immediate preservation of the public peace, health, or safety or for appropriations for

PAGE 25-SENATE BILL 24-205

the support and maintenance of the departments of the state and state institutions.

Steve Fenberg

PRESIDENT OF

THE SENATE

,e-maz -a,nlakiact,ex.

Cindi L. Markwell

SECRETARY OF

THE SENATE

Julie Mc kie

SPEAKER OF THE HOUSE

OF REPRESENTATIVES

R ►bi Jones

CHIEF CLERK OF TH , OUSE

OF REPRESENTATIVES

APPROVED 15-;•;()(A.ve (Y14- II-41 1 '20aq cc* -3 • 30ern (Date and Time)

Jared S is

GO OR OF THE

PAGE 26-SENATE BILL 24-205

T TE OF COLORADO