Colorado SB 25-318 (Artificial Intelligence Consumer Protections)

• Authority: Colorado
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Proposed
• Most recent activity date: 2025-04-28

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Unequal performance across groups
• Compromise of privacy
• Loss of human agency and autonomy
• Increased inequality and decline in employment
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has strong coverage of approximately 5-6 subdomains, with primary focus on unfair discrimination (1.1), lack of transparency (7.4), and lack of robustness (7.3). Secondary coverage addresses privacy concerns (2.1), loss of human agency (5.2), and inequality (6.2). The regulation is predominantly focused on discrimination and fairness risks in consequential decision-making, with comprehensive transparency and accountability requirements.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Finance & Insurance
• Management, Administrative & Support Services
• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Trade, Transportation & Utilities
• Information
• Real Estate, Rental & Leasing
• Professional & Technical Services
• Scientific Research & Development Services
• Educational Services
• Health Care & Social Assistance
• National Security

All other sectors had no coverage in this document.

Sectors Summary

This regulation is cross-sectoral, applying to high-risk AI systems used in consequential decisions across at least 8 major economic sectors. The most explicitly governed sectors are Finance and Insurance, Health Care, Educational Services, Professional and Technical Services (legal), Public Administration, and aspects of Information, Trade/Transportation/Utilities (housing), and Management/Administrative Services (employment).

Legislative Status

Hard Law

Legislative Status Summary

This is a binding state statute enacted by the Colorado General Assembly with mandatory language throughout, explicit enforcement authority granted to the attorney general, and violations constituting unfair trade practices subject to legal penalties.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Colorado General Assembly
• Summary: The document is a state bill enacted by the Colorado General Assembly, as indicated by the opening legislative language.

Target

• Entity Types: AI_Developer, AI_Deployer
• Entities: Developers of high-risk AI systems; Deployers of high-risk AI systems; Vendors of AI systems
• Summary: The statute explicitly targets two distinct categories of entities: 'developers' who create or modify high-risk AI systems, and 'deployers' who use these systems to make consequential decisions. A third category of 'vendors' who distribute AI systems is also referenced.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Colorado Attorney General
• Summary: The statute grants exclusive enforcement authority to the Colorado Attorney General, with power to investigate violations, require document disclosure, and take enforcement actions.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Colorado Attorney General
• Summary: The Attorney General has monitoring authority through document review powers and can evaluate risk management policies, impact assessments, and compliance records to ensure ongoing compliance.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers all stages of the AI lifecycle with particular emphasis on deployment and operational monitoring. It addresses planning through intended use documentation, data through data source and processing requirements, model building through developer obligations, validation through impact assessments, deployment through deployer obligations, and ongoing monitoring through risk management programs and annual reviews.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Open Weight / Open Source

Technical Scope Summary

The document extensively addresses AI systems and high-risk AI systems as its core focus, with detailed definitions and regulatory requirements. It explicitly covers AI models, model weights, and open model weights. The document does not mention frontier AI, general purpose AI, foundation models, generative AI, predictive AI, or compute thresholds. It does address open-weight/open-source models through exemption provisions for developers who release systems with open model weights.