Colorado requires developers of high-risk artificial intelligence to document their systems for deployers from 2026

2024-05-17US Policy

Concerning Consumer Protections in Interactions with Artificial Intelligence Systems, Colorado S.B. 24-205, adding Part 17 to Article 1 of Title 6 of the Colorado Revised Statutes (Section 6-1-1701 and following), sponsored by Senator Rodriguez and Representatives Titone and Rutinel, signed May 17, 2024, duties operative February 1, 2026

Senate Bill 24-205 adds a part to the Colorado Consumer Protection Act requiring, on and after February 1, 2026, developers and deployers of high-risk artificial intelligence systems to use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. A high-risk system is one that, when deployed, makes or is a substantial factor in making a consequential decision. A developer must give each deployer a statement of the system's reasonably foreseeable uses and known harmful or inappropriate uses, high-level summaries of the type of data used to train it, its intended benefits and uses, how it was evaluated and the mitigation measures taken, with documentation such as model cards and dataset cards, to the extent feasible, for the deployer's impact assessment. Developers must post a website statement summarizing the high-risk systems they offer and how they manage discrimination risk, and must report discovered risks to the Attorney General and known deployers within ninety days. Deployers must run a risk management program, complete impact assessments and notify consumers. Developers need not disclose a trade secret, information protected by law, or information that would create a security risk. The Attorney General has exclusive enforcement authority, there is no private right of action, and compliance with the NIST Artificial Intelligence Risk Management Framework or ISO/IEC 42001 supports an affirmative defense.

What it changesThe statute turns model documentation into a legal deliverable, and each item on the developer's list sits on one side of the line between patent and trade secret. The website statement is a publication, so anything it says about how a system manages discrimination risk is prior art from the day it is posted, and the filing on any new mitigation technique has to come first. Documentation handed to deployers should go under confidentiality terms, because a model card shared without them may be a public disclosure. The trade secret exception protects only information that already qualifies as a trade secret, so the developer must have treated it as secret before it is asked for: a written inventory of what will be withheld, access controls on training data and evaluation methods, and deployer contracts that limit use. Programs should make those decisions for each documentation item while February 1, 2026 is still well ahead, not in the month the first deployer asks.