Colorado HB25B-1009 (Artificial Intelligence Systems 2025)

• Authority: Colorado
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Defunct
• Most recent activity date: 2025-08-21

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 2 main subdomains, with strong focus on unfair discrimination (1.1) through its comprehensive regulation of algorithmic discrimination, and moderate coverage of lack of transparency (7.4) through extensive disclosure and documentation requirements. Coverage is concentrated in discrimination prevention and transparency domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Trade, Transportation & Utilities
• Information
• Finance & Insurance
• Real Estate, Rental & Leasing
• Professional & Technical Services
• Scientific Research & Development Services
• Management, Administrative & Support Services
• Educational Services
• Health Care & Social Assistance
• Arts, Entertainment & Recreation
• Accommodation, Food & Other Services

All other sectors had no coverage in this document.

Sectors Summary

This is a horizontal regulation that applies across all sectors where high-risk AI systems are used to make consequential decisions about employment or public safety. It is not sector-specific but rather use-case specific, with broad applicability except for small businesses and small local governments. The most directly implicated sector is Public Administration (for public safety decisions), but employment-related AI use spans virtually all economic sectors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding state statute (House Bill) enacted by the Colorado General Assembly with mandatory obligations starting August 1, 2027, enforceable by the attorney general with specific legal requirements for developers and deployers of high-risk AI systems.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: General Assembly of the State of Colorado; Colorado State Legislature
• Summary: The document is formally enacted by the Colorado General Assembly as evidenced by the opening declaration and bill number designation (House Bill 25B-1009, First Extraordinary Session, Seventy-fifth General Assembly).

Target

• Entity Types: AI_Developer, AI_Deployer
• Summary: The legislation explicitly targets two categories of entities: developers and deployers of high-risk artificial intelligence systems. Developers are those who create or offer AI systems, while deployers are those who use such systems to make consequential decisions. The law applies with exemptions for small businesses (fewer than 250 employees or less than $5 million revenue) and small local governments (under 100,000 residents).

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Attorney General of Colorado
• Summary: The attorney general is explicitly designated as the enforcement authority with powers to bring enforcement actions, require disclosures, evaluate compliance documentation, and prescribe forms and procedures for compliance.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Attorney General of Colorado
• Summary: The attorney general serves as the primary monitoring authority, with explicit powers to request and evaluate documentation, risk management policies, and impact assessments from developers and deployers to ensure ongoing compliance.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Deploy and Operate and Monitor lifecycle stages, with significant emphasis on deployment obligations and ongoing monitoring requirements. It also covers Verify and Validate through mandated impact assessments. The Plan and Design stage receives minimal implicit coverage through developer obligations to consider discrimination risks.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems

Technical Scope Summary

The document explicitly defines and regulates 'high-risk artificial intelligence systems' and 'artificial intelligence systems' but does not mention frontier AI, general-purpose AI, foundation models, generative AI, predictive AI, or compute thresholds. The scope is focused on AI systems making consequential decisions related to employment and public safety.