After a two-year amendment process that significantly watered down the originally passed law, Colorado Gov. Jared Polis (D) signed the Colorado AI Act, which is effective January 1, 2027.
Why it matters: The original 2024 law was the broadest state AI law in the country and a close match to the EU AI Act in both its risk-based approach and overall scope. The final version, while drastically scaled back, still has significant notice requirements for both user employers and developers.
Who’s covered: The final law applies to developers and users of “automated decision-making technology” (ADMT) that materially influences consequential decisions in employment, education, financial services, insurance, healthcare, housing, or essential government services.
-
"ADMT"; is defined as technology that processes personal data and uses computation to generate output that is used to make, guide, or assist a decision concerning an individual.
-
Not covered: The law’s language appears to exclude AI chat bots that are not intended to be used in consequential decisions or AI tools used solely to summarize or organize information for subsequent human review.
Requirements for user employers:
- Clear and conspicuous notice to employees and consumers at the point of interaction with a covered ADMT.
- Where an employee or consumer was the subject of an adverse outcome decision made or assisted by an ADMT, notice must be provided to the employee or consumer, within 30 days, providing a plain language description of the ADMT’s role in the decision.
-
Employees and consumers will have the right to request a human review and reconsideration of the decision.
- Upon request by an employee or consumer, employers must provide personal data and correction of factually incorrect personal data used by an ADMT.
Requirements for deployers:
- Provision of technical documentation to end users covering the ADMT’s intended uses, categories of training data, known limitations, and instructions for appropriate use and human review.
- Notification to end users of any material updates or modifications of the ADMT.
What's out: Risk management programs, annual impact assessments, and the duty to use reasonable care to avoid algorithmic discrimination are removed. A DEI-related provision carving out AI systems used to advance DEI initiatives, which the Justice Department had challenged, is also gone.
What's still to come: The Colorado Attorney General will issue regulations before the law goes into effect that will provide further clarity on what is specifically required in the above disclosures, among other provisions.
CHRO Considerations:
- The differences between the original law and its final version highlight the ongoing AI policy tug of war between fostering innovation and providing guardrails for workers and consumers. Even in blue states, fostering innovation continues to (mostly) win out.
- As the first statewide law of its kind, expect the Colorado AI Act to function as a blueprint for other states to pass similar legislation moving forward.
- There will likely be a short runway between the issuance of the law’s final regulations and when it goes into effect; covered employers and developers should begin preparing disclosure and appeals processes and workflows now.
