Colorado SB 24-205 (Concerning consumer protections in interactions with artificial intelligence systems)

• Authority: Colorado
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Enacted
• Most recent activity date: 2024-05-17

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Unequal performance across groups
• Governance failure
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Overreliance and unsafe use
• Loss of human agency and autonomy

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 5-6 subdomains, with strong focus on unfair discrimination (1.1), unequal performance across groups (1.3), governance failure (6.5), and lack of robustness (7.3). Coverage is concentrated in discrimination/toxicity and system safety domains, with minimal coverage of privacy, misinformation, or malicious actor risks.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Finance & Insurance
• Real Estate, Rental & Leasing
• Professional & Technical Services
• Educational Services
• Health Care & Social Assistance
• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Scientific Research & Development Services
• National Security

All other sectors had no coverage in this document.

Sectors Summary

The document governs AI use across multiple sectors through its definition of 'consequential decisions' which explicitly covers education, employment, financial services, government services, healthcare, housing, insurance, and legal services. The law applies to developers and deployers operating in these sectors when their AI systems make or substantially influence decisions in these areas.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding state statute enacted by the Colorado General Assembly with mandatory obligations, enforcement mechanisms through the Attorney General, and penalties for non-compliance as unfair trade practices.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Colorado General Assembly
• Summary: The document is a state bill enacted by the Colorado General Assembly, which is the legislative body that proposed and passed this law.

Target

• Entity Types: AI_Developer, AI_Deployer
• Summary: The law explicitly targets developers and deployers of high-risk AI systems doing business in Colorado. Developers are defined as persons developing or substantially modifying AI systems, while deployers are persons using high-risk AI systems.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Colorado Attorney General
• Summary: The Attorney General has exclusive enforcement authority over this law, with power to bring enforcement actions, require disclosures, and promulgate implementing rules.

Monitor

• Entity Types: AI_Governance_Actor, AI_Developer, AI_Deployer
• Entities: Colorado Attorney General
• Summary: The Attorney General monitors compliance through required disclosures and documentation reviews. Developers and deployers also have self-monitoring obligations including ongoing testing, annual reviews, and impact assessments.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document covers multiple AI lifecycle stages with primary focus on deployment and operational monitoring. It addresses design considerations through risk management requirements, validation through impact assessments, deployment through notification requirements, and ongoing monitoring through annual reviews and incident reporting.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems

Technical Scope Summary

The document explicitly defines and covers AI systems broadly, with specific focus on high-risk AI systems that make consequential decisions. It does not explicitly mention frontier AI, general purpose AI, foundation models, generative AI, predictive AI, open-weight models, or compute thresholds.