What happened?

On May 17, 2024, Colorado Governor Jared Polis signed “Consumer Protections for Artificial Intelligence” (SB 24-205) into law, which introduces comprehensive consumer protections in interactions with artificial intelligence (AI) systems.

What are the details?

The law imposes rigorous requirements on developers and deployers of high-risk AI systems to safeguard consumers from any known or reasonably foreseeable risks of algorithmic discrimination.

General Bites

• Colorado’s attorney general has exclusive authority to enforce the measure and to promulgate implementing regulations (i.e.: notices, rules, among others).
• The measure aims to prevent algorithmic discrimination affecting “consequential decisions,” including employment-related decisions.
• On or after February 1, 2026, deployers of a high-risk AI system must implement a risk management policy and program to govern the deployment of any high-risk AI system (Link).
• Colorado Governor Jared Polis sent a letter to the Legislative stating that he signed the bill with reservations.
• The applicability is limited to machine-based algorithms that use inferential techniques to produce predictions, recommendations, decisions, or content more generally.
• The act does not restrict a developer’s, deployer’s, or other person’s ability to engage in specified activities (Link).
• The act provides an affirmative defense (Link).

Key Bites for Employers

• Employers that use an AI tool that makes “Consequential Decisions”.
• Employers must implement a risk management policy and program for the high-risk system. This includes measures to identify, assess, and mitigate any known or reasonably foreseeable risks of algorithmic discrimination (See exceptions on Section (6), 6-1-1703. Deployer duty to avoid algorithmic discrimination risk management policy and program, Part 17, Article 1, Title 6).
• Employers need to complete an impact assessment of the high-risk system. This involves evaluating the system’s design and operation and the system’s impact on consumers, including any potential for algorithmic discrimination.
• Employers must annually review the deployment of each high-risk system to ensure that the system is not causing algorithmic discrimination.
• If the high-risk system makes, or will be a substantial factor in making, a consequential decision concerning a consumer (which could be a job applicant or employee), the employer must notify the consumer of specified items (Notice Items).
• Employers must provide consumers with an opportunity to correct any incorrect personal data that a high-risk system processed in making a consequential decision. They also need to provide a consumer with an opportunity to appeal, via human review if technically feasible, an adverse consequential decision (Notice of Use and Appeal).
• Exceptions: some general and very narrow exceptions are contemplated (Link).
• All statements and notices must be provided in “all languages”.

There are also some strong critics of the now-to-be law: Link and Link.

Business Considerations

• Employers who are using or planning to use AI in their hiring procedures should assess their existing AI risk management strategies considering Colorado SB 205’s requirements. They should also consider whether improvements are needed to bring their current practices in line with these new standards.
• Employers may find that the multiple notice requirements are burdensome due to the need for detailed descriptions of AI tools, their risk management, and their impact on decisions. The costs in terms of money and time for establishing new procedures, conducting impact assessments, and setting up risk-management programs further increase this burden.
• Employers should be mindful that under Colorado law, the broad right to opt out of “profiling” may limit the advantages they gain from AI tools’ efficiencies, as they would need to create alternative non-AI systems for those opting out.
• Employers should consider that the requirement for individual appeals under SB205 could significantly strain a company’s recruitment process, as every unsuccessful applicant, potentially in the thousands for each job opening, could demand a human review when AI tools are used.
• Employers can reasonably expect active enforcement because the Colorado attorney general has taken aggressive steps to enforce similar consumer protection laws.
• Employers should review very carefully the exceptions to see if they fit in with one of them.
• Due to the language used, employers should review if their tools could potentially be non-compliant, ranging from onboarding, promotion, and termination, to performance, disciplinary action, or workplace surveillance.

Source References

• CO SB 24 – 205
• Gov. Polis Letter to the Colorado Legislature
• Colorado’s Historic SB 24-205 Concerning Consumer Protections in Interactions with AI Signed Into Law, After Passing State Senate and House (Epstein Becker & Green, P.C.)

Resources

• Colorado SB24-205 (Holistic AI Limited)
• Article I, Title 6 of the Colorado Consumer Protection Act
• Colorado Governor Signs Broad AI Bill Regulating Employment Decisions (Seyfarth Shaw LLP.)

This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.