Describe your business, leave with a checklist you can assign

A developer of a high-risk AI system must make available to deployers and other developers a general statement of reasonably foreseeable uses and known harmful or inappropriate uses; documentation disclosing high-level summaries of the training data types, known or reasonably foreseeable limitations including algorithmic discrimination risks, the purpose, intended benefits and uses, and all other information the deployer needs to comply with section 6-1-1703; and documentation describing how the system was evaluated for performance and discrimination mitigation before release, the data governance measures applied to training datasets and the review of data source suitability and bias, intended outputs, mitigation measures taken, and how the system should and should not be used and monitored by a human when making a consequential decision.

Evidence: High-risk system statement covering intended uses, limitations and prohibited uses; Model card and dataset card including high-level training-data summaries and data governance measures; Pre-release performance and algorithmic discrimination evaluation report; Delivery log and version register for documentation provided to deployers

Model CardData Card — datasheet for a training, validation or test dataset

A developer must publish a statement summarizing the types of high-risk systems it has developed or intentionally and substantially modified and currently makes available, and how it manages known or reasonably foreseeable risks of algorithmic discrimination. It must also disclose to the Colorado Attorney General and to known deployers and other developers, within 90 days after discovery or receipt of a credible report from a deployer, that the high-risk system has caused or is reasonably likely to have caused algorithmic discrimination.

Evidence: Archived copy of the public statement with update timestamps; Algorithmic discrimination incident register recording discovery date, source and assessment; Copies of the 90-day notices sent to the Attorney General and to deployers; Investigation and remediation records for each incident

A deployer must implement a risk management policy and program specifying the principles, processes and personnel used to identify, document and mitigate known or reasonably foreseeable risks of algorithmic discrimination, iterated and systematically reviewed and updated over the system life cycle. Reasonableness is assessed against the latest NIST AI Risk Management Framework, ISO/IEC 42001 or another nationally or internationally recognized framework that is substantially equivalent to or more stringent than part 17 (or a framework designated by the Attorney General), together with the size and complexity of the deployer, the nature and scope and intended uses of the systems deployed, and the sensitivity and volume of the data processed.

Evidence: Risk management policy and program text identifying the reference framework and version; Roster of personnel responsible for identifying, documenting and mitigating risks; Periodic review and update records showing dates and changes; Exemption assessment covering full-time equivalent headcount and use of deployer data for training

ISO/IEC 42001 AI management system implementation and certification readiness checklist

A deployer, or a third party it contracts with, must complete an impact assessment for each high-risk system it deploys, at least annually and within 90 days after an intentional and substantial modification is made available. The assessment must at minimum state the purpose, intended use cases, deployment context and benefits, and analyse whether deployment poses known or reasonably foreseeable risks of algorithmic discrimination, the nature of any such discrimination and the mitigation steps taken, along with the other statutory elements. Records must be retained for at least three years following the final deployment.

Evidence: Impact assessment reports covering the initial, annual and post-modification versions; Developer documentation and internal test data relied on in the assessment; Archive index evidencing three-year retention of impact assessment records; Records of reassessment within 90 days of a substantial modification

ISO/IEC 42001 AI management system implementation and certification readiness checklist

Where a high-risk system makes, or is a substantial factor in making, a consequential decision, the deployer must notify the consumer directly and in plain language. If the decision is adverse, the deployer must also provide a statement of the principal reasons, including the degree and manner in which the system contributed, the type of data processed and its sources; an opportunity to correct incorrect personal data that was processed; and an opportunity to appeal, allowing human review where technically feasible unless appeal is not in the best interest of the consumer, such as where delay would risk life or safety.

Evidence: Consumer notice template and dispatch records; Adverse-decision reasons template including data type and source fields; Log of data correction requests and their handling; Records of appeals received, human review performed and outcomes

A deployer that discovers, after deployment, that a high-risk system has caused algorithmic discrimination must send a disclosure notice to the Attorney General without unreasonable delay and no later than 90 days after discovery, in the form and manner the Attorney General prescribes. The Attorney General may also require the deployer, or a third party it contracts with, to produce the risk management policy, impact assessment or records within 90 days of a request.

Evidence: Discovery and internal escalation records, including the basis for the discovery date; Disclosure notice filed with the Attorney General and the filing receipt; Index and submission record of materials produced at the Attorney General request; Remediation plan and verification results

A person doing business in Colorado that deploys or makes available an AI system intended to interact with consumers must ensure that each consumer interacting with the system is disclosed that they are interacting with an AI system. This duty is not limited to high-risk systems and applies to consumer-facing conversational products.

Evidence: Interface disclosure copy and screenshots for every entry point; Product requirement documents and release records for the disclosure logic; Consistency checks across localized versions; Memo on any reliance on the obviousness exception