iCreates Significant Obligations for Businesses Using Artificial Intelligence
On May 17, 2024, Colorado Gov. Jared Polis signed Senate Bill 24-205, “Concerning Consumer Protections in Interactions with Artificial Intelligence Systems,” into law. The law, which becomes effective in February 2026, regulates creators of AI systems that do business in Colorado (Developers) and users of most AI technologies that impact Colorado consumers (Deployers). The law broadly defines the “high risk” AI systems that are subject to its regulation: apart from several narrow exceptions (such as systems that perform a narrow procedural task or certain enumerated technologies like cybersecurity applications or AI-enabled video games), the law will regulate “any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision.”
“Consequential decisions” are those that have “a material legal or similarly significant effect on the provision or denial to any consumer of, or the cost or terms of “health care services, financial or lending services, educational opportunities, employment matters, essential government services, housing, insurance or legal services.
If your business operates within one of these contexts in which “consequential decisions” are made regarding consumers—e.g., health care, financial services, education, or insurance, among others—and you plan on using AI potentially impacting Colorado residents, Colorado’s Senate Bill 24-205 deserves your close attention. Even if you are sure that your use of AI in one or more of the contexts above is not going to make decisions affecting Colorado residents, Colorado’s law still deserves your attention because it will drive the conversation and perhaps serve as the blueprint for similar laws on the horizon.
In fact, on the same day he signed the bill, Gov. Polis noted to Colorado’s General Assembly that he did so “with reservations” and that by signing the bill he “hope[s] that it furthers the conversation, especially at the national level.”
Under the newly signed bill, Deployers—those who use AI in a way that affects Colorado consumers in the manner and context discussed above—will have significant obligations that are good to keep in mind even this far in advance of the law’s effective date. The governing principle underpinning the law is preventing algorithmic discrimination. To this end, Deployers will be required to “exercise reasonable care to protect individuals from known or foreseeable risks” of such discrimination. This requires affirmative measures such as reviewing AI usage and conducting annual impact assessments; creating and abiding by an AI risk management policy; identifying and documenting risks of such discrimination; notifying consumers that an AI system has been deployed with detail regarding the system’s purposes, risks, and types of information processed; permitting consumers to opt out of the AI system; and notifying the Attorney General of any such discrimination within 90 days of discovering it.
Developers have similarly broad obligations with regard to exercising reasonable care to protect individuals from known or foreseeable risks of algorithmic discrimination in the course of a product’s intended use. These obligations include disclosures regarding the types of AI systems that they have developed and any known or reasonably foreseeable risks of discrimination associated with such products. The law will also require Developers to extensively document assessments of the system’s data, purpose, intended benefits, governance and mitigation, limitations, and other such information that will facilitate Deployers’ assessments of their use of the system.
Although it is unknown whether Senate Bill 24-205 will take effect in its current form, the law will certainly drive the national conversation regarding future AI governance. Businesses implementing, or planning on implementing, AI to drive “consequential decisions” such as those impacting consumers in the health care, financial, educational, or employment context, would do well to take a closer look at Senate Bill 24-205 with the goal of establishing a foundation to operationalize its requirements in the near future.
