Working Group Proposes Revamping Colorado AI Act
In 2024, Colorado’s legislature enacted one of the first comprehensive U.S. artificial intelligence (AI) laws, known as the Consumer Protections for Artificial Intelligence (the Colorado AI Act). Recently, a working group convened by Governor Jared Polis proposed a near-total rewrite of this law, marking a significant shift in how AI is regulated and identifying new areas of legal risk.
Key Changes in the Proposal
The proposal does not simply aim for a technical cleanup; it fundamentally alters the regulatory landscape by narrowing the focus to automated tools that “materially influence” significant decisions. This change shifts compliance burdens from pre-use assessments to a framework based on consumer notice, disclosures following adverse decisions, and a requirement for meaningful human review.
Key Provisions
- Narrowed Scope: The proposal focuses on more significant uses of AI.
- Shifted Compliance: Compliance burdens will now revolve around post-adverse decisions rather than pre-use assessments.
- Significant Rulemaking: The proposal encourages substantial rulemaking to develop core concepts.
- Developer Risk: Emphasizes the risk associated with how products are marketed and sold.
- Execution Focus: Prioritizes clear execution rules over extensive assessments and risk frameworks.
Background of the Current Law
The Colorado AI Act, the first of its kind, targets high-risk AI systems that make consequential decisions, requiring companies to:
- Exercise reasonable care to avoid algorithmic discrimination.
- Disclose information about AI systems, including their purpose and known risks.
- Conduct impact assessments for high-risk AI applications.
- Maintain a risk management program.
- Provide detailed consumer notices before and after use.
- Notify the attorney general of known algorithmic discrimination.
Though initially celebrated, the law faced immediate calls for reform. Subsequent attempts to amend it failed, leading to a last-minute decision to delay its effective date to June 2026. This prompted the formation of a working group that has now released its proposal.
What the Proposal Scraps
In contrast to the original act, the new proposal simplifies compliance by eliminating vague standards and governance requirements:
- Duty of Care: Removes the obligation to use “reasonable care” to prevent algorithmic discrimination.
- AI Governance: Elimination of annual impact assessments and risk management programs.
- Algorithmic Discrimination: All references to algorithmic discrimination are removed, leaving enforcement to existing anti-discrimination laws.
New Business-Friendly Provisions
The revised proposal introduces provisions aimed at making it easier for businesses to manage potential liabilities:
- Cure Period: Introduces a 90-day cure period for civil penalties.
- Fault Allocation: Requires allocation of fault among developers and deployers rather than imposing joint liability.
- Developer Liability: Limits liability to claims arising from intended uses of the AI system.
- Record Retention: Mandates a three-year retention of compliance records.
- Indemnification Limits: Invalidates any contract provisions that indemnify parties for violations of the proposal.
Modifications to Existing Provisions
The proposal also modifies certain provisions to allow companies more time to adjust to the new framework:
- Scope: Limits application to cases where AI is a significant factor in consequential decisions.
- Developer Disclosures: Reduces required disclosures to only those cases where AI is marketed to influence significant decisions.
- Appeals: Reframes the right to appeal adverse decisions as a right to human review.
- Effective Date: Delays the effective date to January 1, 2027.
- Consumer Notices: Provides more flexibility in consumer notification requirements.
- HIPAA Exemption: Expands exemptions for healthcare entities’ AI activities.
Next Steps
A Colorado legislator must file the proposal as a bill, which is expected to be a formality. The proposal has backing from various stakeholders, unlike previous iterations that faced significant opposition. However, time is of the essence, as the legislature’s session ends on May 13.
Potential complications could arise from external pressures, such as President Donald Trump’s Executive Order aiming to challenge state AI regulations. If Colorado’s law is targeted, it may lead to uncertainty and impact critical funding, prompting legislators to reconsider the entire legislative framework.
