In mid-2024, Colorado enacted the United States’ first comprehensive artificial intelligence law. This legislation requires specific compliance measures for developers and deployers of AI systems. The compliance measures vary according to the risk of the AI systems.
For “artificial intelligence systems,” defined as machine-based systems that infer from inputs to generate outputs (such as content, decisions, predictions, or recommendations) that can influence physical or virtual environments, developers or deployers must notify consumers that they are interacting with such a system. For “high-risk artificial intelligence systems,” defined as AI systems that, when deployed, make or significantly contribute to making consequential decisions, developers or deployers must adhere to several requirements, including taking reasonable care to protect consumers from algorithmic discrimination and making a number of disclosures.
Beyond a privacy policy notice. Companies using AI systems should consider the broad scope of Colorado’s AI Act before assuming that a brief mention in a privacy policy is sufficient to notify consumers, or before concluding that an AI system is not “high-risk”. For example, if a website uses an AI chatbot that mimics human interaction, consumers must be made aware they are communing with an AI chatbot and not a customer service agent. Similarly, if a “return” form available on a retailer’s website uses AI to determine if an individual can return an item, this use of AI must also be disclosed. Given that this law is intertwined with Colorado’s expansive unfair or deceptive trade practices authority, any misleading consumer disclosures with respect to the use of AI should certainly be avoided.
Colorado’s definition of “consequential decisions” is broader than it might initially appear. The act considers any decision that has a material legal or similar effect on the provision or denial of education, employment, financial, lending, essential government, healthcare, housing, insurance, or legal services as a “consequential” decision. For instance, if an AI system is used to evaluate applicant resumes, Colorado’s act, and all the disclosure and procedural requirements involved with a “high-risk artificial intelligence system” may apply. The range of examples is expected to expand as the law takes effect.
By Gretchen Leist and Marcel Duhamel