Developer disclosures and documentation to deployers
Severity HighC.R.S. 6-1-1702(2)-(3)
A developer of a high-risk AI system must make available to deployers and other developers a general statement of reasonably foreseeable uses and known harmful or inappropriate uses; documentation disclosing high-level summaries of the training data types, known or reasonably foreseeable limitations including algorithmic discrimination risks, the purpose, intended benefits and uses, and all other information the deployer needs to comply with section 6-1-1703; and documentation describing how the system was evaluated for performance and discrimination mitigation before release, the data governance measures applied to training datasets and the review of data source suitability and bias, intended outputs, mitigation measures taken, and how the system should and should not be used and monitored by a human when making a consequential decision.
- Applies when
- Chinese AI companies supplying systems used for consequential decisions in Colorado such as employment screening, credit scoring, education admissions, healthcare, housing, insurance or legal services, including where supply is indirect through a U.S. reseller or SaaS channel.
- Applies from: 2026-06-30
- Evidence to retain
- · High-risk system statement covering intended uses, limitations and prohibited uses
- · Model card and dataset card including high-level training-data summaries and data governance measures
- · Pre-release performance and algorithmic discrimination evaluation report
- · Delivery log and version register for documentation provided to deployers
Estimated first-time effort: 10–25 person-days (estimate, not a commitment)
Developer public statement and 90-day algorithmic discrimination notice to the Attorney General
Severity HighC.R.S. 6-1-1702(4)-(5)
A developer must publish a statement summarizing the types of high-risk systems it has developed or intentionally and substantially modified and currently makes available, and how it manages known or reasonably foreseeable risks of algorithmic discrimination. It must also disclose to the Colorado Attorney General and to known deployers and other developers, within 90 days after discovery or receipt of a credible report from a deployer, that the high-risk system has caused or is reasonably likely to have caused algorithmic discrimination.
- Applies when
- Any entity meeting the developer definition, including Chinese companies that substantially modify a third-party foundation model before making it available.
- Deadline: Within 90 days after discovery or receipt of a credible report
- Applies from: 2026-06-30
- Evidence to retain
- · Archived copy of the public statement with update timestamps
- · Algorithmic discrimination incident register recording discovery date, source and assessment
- · Copies of the 90-day notices sent to the Attorney General and to deployers
- · Investigation and remediation records for each incident
Estimated first-time effort: 3–10 person-days (estimate, not a commitment)
Deployer risk management policy and program
Severity HighC.R.S. 6-1-1703(2), (6)
A deployer must implement a risk management policy and program specifying the principles, processes and personnel used to identify, document and mitigate known or reasonably foreseeable risks of algorithmic discrimination, iterated and systematically reviewed and updated over the system life cycle. Reasonableness is assessed against the latest NIST AI Risk Management Framework, ISO/IEC 42001 or another nationally or internationally recognized framework that is substantially equivalent to or more stringent than part 17 (or a framework designated by the Attorney General), together with the size and complexity of the deployer, the nature and scope and intended uses of the systems deployed, and the sensitivity and volume of the data processed.
- Applies when
- Entities using high-risk AI systems to make consequential decisions in Colorado, including the hiring, credit or customer-screening teams of Chinese companies in the United States. An exemption applies only where all conditions are met, including employing fewer than 50 full-time equivalent employees and not using the deployer own data to train the system.
- Applies from: 2026-06-30
- Evidence to retain
- · Risk management policy and program text identifying the reference framework and version
- · Roster of personnel responsible for identifying, documenting and mitigating risks
- · Periodic review and update records showing dates and changes
- · Exemption assessment covering full-time equivalent headcount and use of deployer data for training
Estimated first-time effort: 15–40 person-days (estimate, not a commitment)
Deployer impact assessments, annually and after substantial modification
Severity HighC.R.S. 6-1-1703(3)
A deployer, or a third party it contracts with, must complete an impact assessment for each high-risk system it deploys, at least annually and within 90 days after an intentional and substantial modification is made available. The assessment must at minimum state the purpose, intended use cases, deployment context and benefits, and analyse whether deployment poses known or reasonably foreseeable risks of algorithmic discrimination, the nature of any such discrimination and the mitigation steps taken, along with the other statutory elements. Records must be retained for at least three years following the final deployment.
- Applies when
- As above; required whenever the small-deployer exemption conditions are not fully satisfied.
- Deadline: Before deployment, at least annually, and within 90 days of a substantial modification; retain for at least three years
- Applies from: 2026-06-30
- Evidence to retain
- · Impact assessment reports covering the initial, annual and post-modification versions
- · Developer documentation and internal test data relied on in the assessment
- · Archive index evidencing three-year retention of impact assessment records
- · Records of reassessment within 90 days of a substantial modification
Estimated first-time effort: 8–20 person-days (estimate, not a commitment)
Consumer notice, reasons, correction and human-review appeal
Severity HighC.R.S. 6-1-1703(4)
Where a high-risk system makes, or is a substantial factor in making, a consequential decision, the deployer must notify the consumer directly and in plain language. If the decision is adverse, the deployer must also provide a statement of the principal reasons, including the degree and manner in which the system contributed, the type of data processed and its sources; an opportunity to correct incorrect personal data that was processed; and an opportunity to appeal, allowing human review where technically feasible unless appeal is not in the best interest of the consumer, such as where delay would risk life or safety.
- Applies when
- Deployers using AI to support consequential decisions in Colorado in areas such as employment, credit, insurance, housing, education and healthcare.
- Applies from: 2026-06-30
- Evidence to retain
- · Consumer notice template and dispatch records
- · Adverse-decision reasons template including data type and source fields
- · Log of data correction requests and their handling
- · Records of appeals received, human review performed and outcomes
Estimated first-time effort: 10–25 person-days (estimate, not a commitment)
Deployer 90-day algorithmic discrimination notice to the Attorney General
Severity HighC.R.S. 6-1-1703(7), (9)
A deployer that discovers, after deployment, that a high-risk system has caused algorithmic discrimination must send a disclosure notice to the Attorney General without unreasonable delay and no later than 90 days after discovery, in the form and manner the Attorney General prescribes. The Attorney General may also require the deployer, or a third party it contracts with, to produce the risk management policy, impact assessment or records within 90 days of a request.
- Applies when
- All entities deploying high-risk AI systems in Colorado.
- Deadline: Within 90 days of discovery; production at the Attorney General request within 90 days
- Applies from: 2026-06-30
- Evidence to retain
- · Discovery and internal escalation records, including the basis for the discovery date
- · Disclosure notice filed with the Attorney General and the filing receipt
- · Index and submission record of materials produced at the Attorney General request
- · Remediation plan and verification results
Estimated first-time effort: 2–8 person-days (estimate, not a commitment)
Disclose to consumers that they are interacting with an AI system
Severity MediumC.R.S. 6-1-1704
A person doing business in Colorado that deploys or makes available an AI system intended to interact with consumers must ensure that each consumer interacting with the system is disclosed that they are interacting with an AI system. This duty is not limited to high-risk systems and applies to consumer-facing conversational products.
- Applies when
- Chinese companies offering AI customer service, AI assistants or companion conversational products to consumers in Colorado.
- Applies from: 2026-06-30
- Evidence to retain
- · Interface disclosure copy and screenshots for every entry point
- · Product requirement documents and release records for the disclosure logic
- · Consistency checks across localized versions
- · Memo on any reliance on the obviousness exception
Estimated first-time effort: 2–6 person-days (estimate, not a commitment)