Colorado Legislation Tackles Algorithmic Discrimination in AI
Colorado is the first state to enact a comprehensive artificial intelligence (AI) law to protect consumers against discrimination after a nearly identical bill failed to pass in Connecticut. The purpose of the Colorado law, Consumer Protections for Artificial Intelligence, is to address "algorithmic discrimination" by AI systems. This approach contrasts with recent AI laws in Florida and Utah that focus on transparency and political advertising, respectively.
LEGISLATIVE FRAMEWORK
Although AI experts frequently point to bias as an inherent risk in using AI systems, businesses struggle to determine how to specifically address that risk. The new Colorado law provides at least some framework for addressing it. Colorado's law takes a risk-based approach and targets "high-risk" AI systems. "High-risk" AI systems are those that make or are a substantial factor in making a consequential decision, where a "consequential decision" is one that significantly impacts the provision, denial, cost, or terms of employment and employment opportunities, financial or lending services, health care services, legal services, housing, insurance, essential government services, and education opportunities.
The law, with very narrow exceptions, will impose an affirmative duty of care and detailed risk management and disclosure obligations on businesses that develop or use high-risk AI systems in order to protect consumers from discrimination based on age, color, disability, ethnicity, genetic information, proficiency in the English language, national origin, race, religion, reproductive health, sex, veteran status, or other protected class under Colorado or federal law. Unlike many privacy laws, including the Colorado Privacy Act, it lacks a threshold on the number of consumers to trigger applicability and does not have business-to-business or employee exceptions.
Among other requirements, businesses that develop or use high-risk AI systems will be required to use reasonable care to avoid algorithmic discrimination in the system. Businesses that use high-risk AI systems will have to complete an impact assessment of the system with necessary information provided by the developer of the system. Businesses that develop or use high-risk AI systems will also have to make a publicly available statement that summarizes the types of high-risk AI systems developed or used and how any known or reasonably foreseeable risks of algorithmic discrimination are managed.
The law will be enforced by the Colorado attorney general and does not provide for a private cause of action. A violation constitutes an unfair trade practice, punishable by a fine of up to $20,000 per violation. Developers and deployers will have an affirmative defense if they discover and cure a violation based on feedback, adversarial testing, or red-teaming as defined by the National Institute of Standards and Technology (NIST) and comply with NIST's AI risk management framework.
Notably, the law will not take effect until February 1, 2026. Colorado Governor, Jared Polis, passed the law "with reservations," recognizing that it is not clear how such a law will impact the AI industry and that patchwork laws at the state level may in fact have an adverse impact on innovation and competition. Gov. Polis indicated that stakeholders should use the time before the law takes effect to fine tune the provisions. Essentially, with this law, Colorado is at once setting forth a model and also calling to action others, including those in the AI industry, to help reshape the model for AI legislation.
WHAT THIS LAW MEANS FOR YOUR BUSINESS
While businesses should continue to develop and implement AI policies to address company confidential information, reliability of results, security, intellectual property protection, and infringement, these policies should also cover bias and discrimination affecting consequential decisions. Businesses entering into contracts with developers and providers of AI tools will need to ensure appropriate risk allocation and compliance with Colorado's new law and other such laws that will undoubtedly be enacted in other jurisdictions.
We expect an incoming wave of AI legislation across the country at the state and federal level.
