Colorado

AI Policy Overview

Colorado legislators have prioritized policies regarding artificial intelligence. In 2024, lawmakers enacted a comprehensive AI law addressing both developers and deployers of AI technology. In 2020, the state enacted a law that established provisions for various government uses of facial recognition technology.

In 2024, lawmakers enacted a law (CO HB 1468) establishing an Artificial Intelligence Task Force to consider protections for consumers and workers. The membership of the task force includes 26 members who will be appointed by the governor, the president of the senate, the minority leader of the senate, the speaker of the house of representatives, and the minority leader of the house of representatives. Members include individuals that represent various organizations, communities, governmental entities, academia, and businesses related to the artificial intelligence and biometric technology industry. There are 4 legislative members of the task force. On or before February 1, 2025, the task force must submit a report to the joint technology committee and the governor's office that summarizes the findings and policy recommendations related to the task force's issues of study. The task force must meet at least 5 times between September 1, 2024, and February 1, 2025, and may meet as necessary after the task force submits the report.

Bias Prevention & Transparency

In 2024, Colorado Governor Polis (D) signed the most ambitious piece of legislation (CO SB 205) addressing artificial intelligence (AI) yet enacted into law. However, the governor’s statement expressed his “reservations” about the scope of the legislation. “I am concerned about the impact this law may have on an industry that is fueling critical technological advancements across our state for consumers and enterprises alike.” The new law regulates “high-risk artificial intelligence systems” that make “consequential decisions” of “significant effect” on a list of consumer-facing industries.

Importantly, obligations on developers and deployers would not begin until February 1, 2026, and would require the use of “reasonable care” to protect consumers from any known or “reasonably foreseeable” risks of algorithmic discrimination. Developers would be required to make certain disclosures and documentation available to deployers, the attorney general, and the public. Deployers would be required to implement a risk management policy and program and complete an impact assessment of the system. By placing an effective date over a year and a half away, lawmakers will have time to amend the statute to adjust for technological changes between now and when the AI mandates go into effect. 

Under the bill, deployers must notify consumers when “high-risk” AI systems are a substantial factor in consequential decisions, make certain disclosures, provide an opportunity to opt out of having personal data processed for profiling, provide an opportunity to correct data, and provide an opportunity to appeal an adverse decision and allow for human review. Deployers with under 50 employees are exempt from these requirements. AI systems that interact with consumers must disclose that the interaction is with an AI system. The law would only be enforceable by the attorney general (i.e., no private right of action), and companies can be provided a right to cure any violations.

Deepfakes

In 2024, Colorado enacted a law addressing political deepfakes (CO HB 1147). This law prohibits and provides a civil action for distributing or publishing a political communication with a deepfake with reckless disregard that the candidate did not do or say what is being depicted within 60 days before a primary or 90 days before a general election without a disclaimer. That year, lawmakers also enacted a law (CO SB 11) clarifying that the state’s existing revenge porn statutes apply to both real and “simulated” images. 

In 2024, lawmakers also enacted a law (CO SB 84) requiring the attorney general to study how the internet and other media channels, including social media platforms, are used to share and spread misinformation and disinformation.

Facial Recognition

In 2020, the Colorado legislature enacted a law (CO SB 113) establishing provisions for government use of facial recognition technology. The law requires state and local agencies intending to use facial recognition technology to file a report stating their intent to develop or procure facial recognition technology and specify how they will use facial recognition. The law also requires agencies to develop a data management policy, establish testing procedures, and provide information on false identifications.

Legislative & Regulatory History

  • 2024 - Colorado enacted CO HB 1468, which establishes an Artificial Intelligence Task Force to consider protections for consumers and workers. 

  • 2024 - Colorado enacted CO SB 11, which is a sexual deepfake law clarifying that the state’s existing revenge porn statutes apply to both real and “simulated” images. 

  • 2024 - Colorado enacted CO HB 1147, which restricts the use of political deepfake media without a disclaimer during a time period before an election.

  • 2024 - Colorado enacted CO SB 205, which regulates “high-risk artificial intelligence systems” that make “consequential decisions” of “significant effect” on a list of consumer-facing industries.

  • 2020 - Colorado enacted CO BS 113, which establishes provisions for government uses of facial recognition technology.