Background
On May 17, 2024, the Governor of Colorado, Jared Polis, signed Senate Bill 24-205, “Concerning Consumer Productions in Interactions with Artificial Intelligence Systems” (“AI Law”). The AI Law takes effect on and from February 1, 2026. It will create a mandatory regulatory framework for developers and deployers of “high-risk AI systems” that is designed to mitigate consumer harm and “algorithmic discrimination.”
The AI Law defines a “high-risk AI system” to be any AI system that, when deployed, makes, or is a substantial factor in making, a decision that has a material legal or similarly significant effect on the provision or denial to any consumer of, or the cost or terms of education, employment, financial or lending services, essential government services, healthcare services, housing, insurance, or legal services.[1] “Algorithmic discrimination” is defined as any condition in which AI increases the risk of unlawful differential treatment that then disfavors an individual or group of people on the basis of age, color, disability, ethnicity, genetic information, race, religion, veteran status, English proficiency and other classes protected by state laws.[2]
Key requirements: the key requirements of the AI law have been summarized and set forth below.
For both developers and deployers: developers and deployers of:
- A high-risk AI system must use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination; and
- Any AI system must disclose the existence of the AI system to consumers if they interact with such system.
For Developers: developers of a high-risk AI system must take a number of steps, including:
- Make certain information available to the deployers or other developers of such system, including information about its reasonably foreseeable uses and known harmful uses, summaries of the training data, and the measures used to mitigate discrimination;
- Make publicly available a statement summarizing the types of systems that the developer has developed and currently makes available to deployers or other developers and how the developer manages risks of algorithmic discrimination; and
- Disclose to the attorney general, and to all known deployers or other developers of such system and any risks of algorithmic discrimination applicable to such system.
For deployers: deployers of a high-risk artificial intelligence system must take a number of steps, including:
- Implement a risk management policy and program;
- Complete an impact assessment for such system;
- If deploying the system to make a consequential decision about a consumer, provide certain information to the consumer, including notice that a high-risk artificial intelligence system will be used to make a consequential decision about them, the nature of the consequential decision, and contact information for the deployer;
- If the system makes an adverse consequential decision about a consumer, provide certain information to the consumer, including the principal reasons for the decision, an opportunity to correct any incorrect personal data or to appeal the decision, and the information set forth in the above bullet point;
- Make publicly available a statement summarizing the types of systems currently deployed, how the deployer manages risks of algorithmic discrimination, and the nature, source, and extent of information collected and used by the deployer; and
- If a deployer discovers that the system has caused discrimination, the deployer must send to the attorney general a notice disclosing such discrimination.
Controversy
Notably, the AI Law was not signed without reservation.
Prior to signing, the AI Law was publicly denounced by a coalition of national organizations and local businesses on the basis that it poses a risk of hindering innovation and suppressing competitive dynamics, all the while falling short of its intended objective to safeguard consumer interests.
On May 10, 2024, the Chamber of Progress issued a letter to Governor Jared Polis urging that the AI Law be vetoed.[3] Key concerns, from lawmakers, industry participants, and other stakeholders are that the AI Law creates:
- A complex compliance, reporting, and disclosure regime that applies to all developers and deployers of high-risk AI systems doing business in Colorado, and only provides a narrow exception for small deployers (i.e., less than 50 full-time employees), provided that they comply with certain other conditions;[4]
- Burdensome reporting requirements that are triggered when developers/deployers of high-risk AI systems uncover actual or reasonably likely algorithmic discrimination, or upon request by the Attorney General; and
- Arequirement that consumers have the opportunity to correct any incorrect personal data that the high-risk AI system processed in making a consequential decision about them,[5] and appeal (to a human, unless human review is not technically feasible or in the consumer’s best interests) any adverse consequential decision made by the high-risk AI system about them.[6]
Despite this, Governor Jared Polis signed the AI Law but remarked that he did so “with reservations,” and he stated that he was “concerned about the impact this law may have on an industry that is fueling critical technological advancements across our state for consumers and enterprises alike.”
Governor Jared Polis noted that he hopes that the legislature will reexamine the core of the AI Law, which, unlike traditional discrimination laws, is focused on the results of the AI system as opposed to the intent of the developer or deployer of such system. In light of the two-year period before the AI Law takes effect, Governor Jared Polis also noted that stakeholders and industry leaders must “take the intervening two years before this measure takes effect to fine-tune the provisions [of the AI Law] and ensure the final product does not hamper development and expansion of new technologies in Colorado.”[7]
Foonotes
[1] Senate Bill 24-205; Section 6-1-1701(2), (3).
[2] Senate Bill 24-205; Section 6-1-1701(1).
[3] Chamber of Progress; May 10, 2024 – Veto Letter (https://progresschamber.org/wp-content/uploads/2024/05/CO-SB-205-Veto-Letter.pdf).
[4] Senate Bill 24-205; Section 6-1-1703(6).
[5] Senate Bill 24-205; Section 6-1-1703(4)(b)(II).
[6] Senate Bill 24-205; Section 6-1-1703(4)(b)(III).
[7] Governor of Colorado, Jared Polis; May 17, 2024 - Signing Speech for SB24-205 (https://progresschamber.org/wp-content/uploads/2024/05/SB24-205-Signing-Statement.pdf).
