Colorado's New AI Law Takes A Different Approach: Targeting AI Developers

Colorado Governor Polis (D) recently signed the most ambitious piece of legislation addressing artificial intelligence (AI) that we’ve seen from a state (CO SB 205). AI regulation has arguably been the hottest topic in state legislatures (over 600 bills introduced with 40 enacted into law so far) this year. The Colorado bill was modeled after a bill in Connecticut, but a day after a veto threat essentially killed the Connecticut proposal, lawmakers quickly approved the Colorado bill on the last day of session. 

There remained much intrigue on whether Governor Polis, a former tech entrepreneur himself, would sign the bill into law. He did so on Friday, but with a statement that expressed his “reservations” about the scope of the legislation. “I am concerned about the impact this law may have on an industry that is fueling critical technological advancements across our state for consumers and enterprises alike.” 

Much of the substantive AI legislation enacted so far by states has targeted the outputs of AI tools, such as AI-generated images and video that mimic real people (dubbed “deepfakes”). Other legislation focuses on specific industries or use cases, for instance restricting the use of AI when making a hiring decision or protecting jobs in certain entertainment industries. Lawmakers in Utah enacted the broadest of these output restrictions earlier this year, requiring disclosures for generative AI use in an array of professions licensed or regulated by the state.

However, the Colorado bill goes a step beyond the outputs by regulating the developers of AI technology themselves. Developers of “high-risk” AI models must use “reasonable care” to protect consumers from any known or “reasonably foreseeable” risks of algorithmic discrimination. Developers are required to make certain disclosures and documentation available to deployers, the attorney general, and the public. 

Colorado lawmakers also address those utilizing AI tools, which the law refers to as “deployers” of AI. Deployers of “high-risk” AI tools must implement a risk management policy and program and complete an impact assessment of the system. Deployers must notify consumers when “high-risk” AI systems are a substantial factor in consequential decisions, make certain disclosures, provide an opportunity to opt out of having personal data processed for profiling, provide an opportunity to correct data, and provide an opportunity to appeal an adverse decision and allow for human review. Smaller companies with under 50 employees are exempt from these requirements. AI systems that interact with consumers must disclose that the interaction is with an AI system. The law would only be enforceable by the attorney general (i.e., no private right of action), and companies can be provided a right to cure any violations.

Industry groups have criticized the Colorado bill for burdening companies with potential liability and, they argued, it would stifle a technology that is still getting off the ground. Consumer groups also criticized the proposal for not going far enough, arguing that it contains a loophole that exempts trade secrets from disclosure requirements. Governor Polis, in his signing statement, holds out hope that state action will spur appropriate federal regulation on AI systems, thus avoiding a “patchwork” of state AI laws that could “temper innovation and deter competition in an open market.”

Which is why the most important provision in the Colorado law might be its effective date. Key aspects of the law do not go into effect until February 2026. This gives stakeholders and lawmakers two legislative sessions to make significant changes to the law as it is currently written. And changes are almost inevitable considering the pace of progress in the AI industry. Nonetheless, Colorado’s law will lead a vital discussion on how AI models and the tools they power will be regulated in the United States.

Sign Up for Morning MultiState

This article appeared in our Morning MultiState newsletter on May 21, 2024. For more timely insights like this, be sure to sign up for our Morning MultiState weekly morning tipsheet. We created Morning MultiState with state government affairs professionals in mind — sign up to receive the latest from our experts in your inbox every Tuesday morning. Click here to sign up.