On May 17, 2024, Colorado enacted the Colorado Artificial Intelligence Act (CAIA), the first comprehensive law in the United States regulating the general use of artificial intelligence (AI). The below FAQs provide a quick overview of the CAIA and how it may impact you. 

1) What types of AI does the CAIA regulate? 

The CAIA regulates AI that it classifies as “high-risk.” To be “high-risk”, the AI must be used for making, or assisting in making, “consequential decisions” impacting a Colorado consumer’s access to employment, education, housing, insurance, healthcare, or financial, legal or essential government services. For example, AI used to scan a job applicant’s resume or social media activity to determine if the applicant is a good candidate for the job would likely be considered high-risk and subject to the CAIA. 

The CAIA is intended to reduce the risk of “algorithmic discrimination” where AI unfairly disfavors individuals who are members of a protected class under Colorado or Federal laws (e.g., based on their age, color, disability, ethnicity, genetic information, English proficiency, national origin, race, religion, reproductive health, sex or veteran status).

2) Who does the CAIA apply to? 

The CAIA applies to “developers” and “deployers” of high-risk AI systems, defined as follows:

• A developer is any person or company doing business in Colorado that develops or materially modifies a high-risk AI system. 
• A deployer is any person doing business in Colorado that uses a high-risk AI system. 

3) If I am a developer of a high-risk AI system what should I do to comply with the CAIA?

Developers of high-risk AI systems must use “reasonable care” to protect consumers in Colorado from algorithmic discrimination arising from the developers’ AI systems.

To demonstrate that it is using reasonable care, a developer must make disclosures on its website and provide documentation regarding the purpose, intended use and data used to train the high-risk AI system, as well as its risks of algorithmic discrimination and how to mitigate those risks. 

In addition, developers must report incidents of algorithmic discrimination arising from their high-risk AI system to the Colorado Attorney General.

4) If I am a deployer of a high-risk AI system what should I do to comply with the CAIA?

Deployers of high-risk AI systems must also use “reasonable care” to protect consumers in Colorado from algorithmic discrimination arising from the deployers' use of the high-risk AI systems.

To demonstrate that a deployer is using reasonable care, it must have a risk management policy to mitigate algorithmic bias in its use of high-risk AI systems, conduct annual impact assessments on the impact of algorithmic bias, and make disclosures on its website regarding the high-risk AI systems it uses and how it mitigates the risk of algorithmic bias in its use of those AI systems.

In addition, deployers must notify consumers when it uses a high-risk AI system to make decisions about them and also of their rights.

Lastly, as with developers, deployers must report incidents of algorithmic discrimination arising from their use of the high-risk AI system to the Colorado Attorney General.

5) If I am an individual in Colorado, what are my rights under the CAIA?

Colorado consumers must be notified that a high-risk AI system will be used to make a decision about the consumer and have the option to opt-out. 

If a consumer thinks that a high-risk AI system made an adverse decision about them, the consumer must be provided with an explanation of the reason for the decision and be given the option to appeal the decision for human review (where feasible). 

In addition, if a consumer determines that any data about them that is used in a high-risk AI system is inaccurate, they have the right to request that the data be corrected.  

7) How is the CAIA enforced?

The Colorado Attorney General has exclusive authority to enforce the CAIA. There is no private right of action. In addition, the Colorado Attorney General may issue regulations on the implementation and enforcement of the CIAA. 

8) When will the CAIA go into effect? 

February 1, 2026.