Regulon — CO-HB-1009 · CO HB 1009 (AI Systems

WHAT THIS BILL REGULATES · 7 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Attorney general enforcement only. The attorney general may bring enforcement actions under C.R.S. § 6-1-1706. No private right of action is created by this part. Developers and deployers enjoy a rebuttable presumption of reasonable care if they comply with the statute and any rules adopted by the attorney general.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

This amendatory bill does not alter the enforcement or damages provisions of the underlying SB 24-205. Enforcement is through attorney general action under § 6-1-1706. The bill itself does not specify monetary penalties, damages, or fee-shifting.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

C.R.S. § 6-1-1701

Definitions — narrowed consequential decision, new local government definition

(3) "Consequential decision" means a decision that has a material legal or similarly significant effect on EMPLOYMENT DECISIONS OR PUBLIC SAFETY.

(8) [Repealed] "Health-care services" has the same meaning as provided in 42 U.S.C. sec. 234 (d)(2).

(10.5) "LOCAL GOVERNMENT" MEANS A HOME RULE OR STATUTORY MUNICIPALITY, COUNTY, OR SPECIAL DISTRICT.

This section narrows the foundational definition of consequential decision from eight enumerated domains — education, employment, financial/lending, essential government, healthcare, housing, insurance, and legal services — to only employment decisions or public safety. Because the definition of consequential decision is the trigger for what qualifies as a high-risk AI system, this change dramatically reduces the population of AI systems subject to Part 17's obligations.

The section also adds a new definition of local government (home rule or statutory municipality, county, or special district) to support the exemption for small local governments added in § 6-1-1705(10). The existing definition of health-care services is repealed as no longer necessary given the narrowed scope.

C.R.S. § 6-1-1702

Developer duty to avoid algorithmic discrimination — date changes

Developer

(1) 1 On and after AUGUST 1, 2027, a developer of a high-risk artificial intelligence system shall use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination arising from the intended and contracted uses of the high-risk artificial intelligence system. In any enforcement action brought on or after AUGUST 1, 2027, by the attorney general pursuant to section 6-1-1706, there is a rebuttable presumption that a developer used reasonable care as required under this section if the developer complied with this section and any additional requirements or obligations as set forth in rules ADOPTED by the attorney general pursuant to section 6-1-1707.

(2) 2 On and after AUGUST 1, 2027, and except as provided in subsection (6) of this section, a developer of a high-risk artificial intelligence system shall make available to the deployer or other developer of the high-risk artificial intelligence system:

(3)(a) 3 Except as provided in subsection (6) of this section, a developer that offers, sells, leases, licenses, gives, or otherwise makes available to a deployer or other developer a high-risk artificial intelligence system on or after AUGUST 1, 2027, shall make available to the deployer or other developer, to the extent feasible, the documentation and information, through artifacts such as model cards, dataset cards, or other impact assessments, necessary for a deployer, or for a third party contracted by a deployer, to complete an impact assessment pursuant to section 6-1-1703 (3).

(4)(a) 4 On and after AUGUST 1, 2027, a developer shall make available, in a manner that is clear and readily available on the developer's website or in a public use case inventory, a statement summarizing:

(5) 5 On and after AUGUST 1, 2027, a developer of a high-risk artificial intelligence system shall disclose to the attorney general, in a form and manner prescribed by the attorney general, and to all known deployers or other developers of the high-risk artificial intelligence system, any known or reasonably foreseeable risks of algorithmic discrimination arising from the intended uses of the high-risk artificial intelligence system without unreasonable delay but no later than ninety days after the date on which:

(7) 6 On and after AUGUST 1, 2027, the attorney general may require that a developer disclose to the attorney general, no later than ninety days after the request and in a form and manner prescribed by the attorney general, the statement or documentation described in subsection (2) of this section. The attorney general may evaluate such statement or documentation to ensure compliance with this part 17, and the statement or documentation is not subject to disclosure under the "Colorado Open Records Act", part 2 of article 72 of title 24. In a disclosure pursuant to this subsection (7), a developer may designate the statement or documentation as including proprietary information or a trade secret. To the extent that any information contained in the statement or documentation includes information subject to attorney-client privilege or work-product protection, the disclosure does not constitute a waiver of the privilege or protection.

This section amends all operative date references in the developer-duty provisions from February 1, 2026 to August 1, 2027. The substantive obligations themselves — reasonable care, deployer documentation, impact-assessment support, public use-case summaries, discrimination-risk disclosure, and attorney-general production — are unchanged in substance. The bill also replaces 'promulgated' with 'adopted' when referring to attorney general rules.

The effect is an 18-month delay to all developer compliance obligations under Part 17, on top of the scope narrowing achieved by the amended consequential-decision definition in § 6-1-1701.

Compliance actions 6 items

Developers of high-risk AI systems must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination arising from the intended and contracted uses of those systems.

H-02.1

Developers must make documentation available to deployers or other developers describing the high-risk AI system's capabilities, limitations, and intended uses.

G-02.1

Developers must provide deployers with impact-assessment-enabling documentation — including model cards, dataset cards, or other impact assessments — to the extent feasible.

G-02.1

Developers must publish on their website or in a public use-case inventory a statement summarizing the types of high-risk AI systems they make available and their intended uses.

G-02.4

Developers must disclose to the attorney general and all known deployers any known or reasonably foreseeable risks of algorithmic discrimination within 90 days of discovery.

R-01.3

Developers must produce documentation to the attorney general within 90 days of request, with trade-secret and privilege protections preserved.

R-02.2

C.R.S. § 6-1-1703

Deployer duty to avoid algorithmic discrimination — risk management, impact assessments, consumer notice

Deployer

(1) 7 On and after AUGUST 1, 2027, a deployer of a high-risk artificial intelligence system shall use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination. In any enforcement action brought on or after AUGUST 1, 2027, by the attorney general pursuant to section 6-1-1706, there is a rebuttable presumption that a deployer of a high-risk artificial intelligence system used reasonable care as required under this section if the deployer complied with this section and any additional requirements or obligations as set forth in rules ADOPTED by the attorney general pursuant to section 6-1-1707.

(2)(a) 8 On and after AUGUST 1, 2027, and except as provided in subsection (6) of this section, a deployer of a high-risk artificial intelligence system shall implement a risk management policy and program to govern the deployer's deployment of the high-risk artificial intelligence system. The risk management policy and program must specify and incorporate the principles, processes, and personnel that the deployer uses to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination. The risk management policy and program must be an iterative process planned, implemented, and regularly and systematically reviewed and updated over the life cycle of a high-risk artificial intelligence system, requiring regular, systematic review and updates. A risk management policy and program implemented and maintained pursuant to this subsection (2) must be reasonable considering:

(3)(a)(I)–(II) 9 A deployer, or a third party contracted by the deployer, that deploys a high-risk artificial intelligence system on or after AUGUST 1, 2027, shall complete an impact assessment for the high-risk artificial intelligence system; and (II) On and after AUGUST 1, 2027, a deployer, or a third party contracted by the deployer, shall complete an impact assessment for a deployed high-risk artificial intelligence system at least annually and within ninety days after any intentional and substantial modification to the high-risk artificial intelligence system is made available.

(3)(c) 9 In addition to the information required under subsection (3)(b) of this section, an impact assessment completed pursuant to this subsection (3) following an intentional and substantial modification to a high-risk artificial intelligence system on or after AUGUST 1, 2027, must include a statement disclosing the extent to which the high-risk artificial intelligence system was used in a manner that was consistent with, or varied from, the developer's intended uses of the high-risk artificial intelligence system.

(3)(g) 10 On or before AUGUST 1, 2027, and at least annually thereafter, a deployer, or a third party contracted by the deployer, must review the deployment of each high-risk artificial intelligence system deployed by the deployer to ensure that the high-risk artificial intelligence system is not causing algorithmic discrimination.

(4)(a) 11 On and after AUGUST 1, 2027, and no later than the time that a deployer deploys a high-risk artificial intelligence system to make, or be a substantial factor in making, a consequential decision concerning a consumer, the deployer shall:

(4)(b) 12 On and after AUGUST 1, 2027, a deployer that has deployed a high-risk artificial intelligence system to make, or be a substantial factor in making, a consequential decision concerning a consumer shall, if the consequential decision is adverse to the consumer, provide to the consumer:

(5)(a) 13 On and after AUGUST 1, 2027, and except as provided in subsection (6) of this section, a deployer shall make available, in a manner that is clear and readily available on the deployer's website, a statement summarizing:

(7) 14 If a deployer deploys a high-risk artificial intelligence system on or after AUGUST 1, 2027, and subsequently discovers that the high-risk artificial intelligence system has caused algorithmic discrimination, the deployer, without unreasonable delay, but no later than ninety days after the date of the discovery, shall send to the attorney general, in a form and manner prescribed by the attorney general, a notice disclosing the discovery.

(9) 15 On and after AUGUST 1, 2027, the attorney general may require that a deployer, or a third party contracted by the deployer, disclose to the attorney general, no later than ninety days after the request and in a form and manner prescribed by the attorney general, the risk management policy implemented pursuant to subsection (2) of this section, the impact assessment completed pursuant to subsection (3) of this section, or the records maintained pursuant to subsection (3)(f) of this section. The attorney general may evaluate the risk management policy, impact assessment, or records to ensure compliance with this part 17, and the risk management policy, impact assessment, and records are not subject to disclosure under the "Colorado Open Records Act", part 2 of article 72 of title 24. In a disclosure pursuant to this subsection (9), a deployer may designate the statement or documentation as including proprietary information or a trade secret. To the extent that any information contained in the risk management policy, impact assessment, or records includes information subject to attorney-client privilege or work-product protection, the disclosure does not constitute a waiver of the privilege or protection.

This section amends all operative date references in the deployer-duty provisions from February 1, 2026 to August 1, 2027. The substantive obligations — reasonable care against algorithmic discrimination, risk management policy and program, impact assessments (initial and annual), consumer notice, public transparency, discrimination-incident reporting to the attorney general, and attorney-general production — remain unchanged in substance.

Because this bill narrows consequential decision to employment and public safety, the entire deployer-duty framework now applies only to AI systems used in those two domains, rather than the original eight. The 18-month delay gives deployers additional runway to implement compliance programs.

Compliance actions 9 items

Deployers of high-risk AI systems must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination.

H-02.1

Deployers must implement and maintain a risk management policy and program specifying the principles, processes, and personnel used to identify, document, and mitigate algorithmic discrimination risks, with regular and systematic review and updates over the system's life cycle.

G-01.1

Deployers must complete an impact assessment for each high-risk AI system before deployment, at least annually thereafter, and within 90 days of any intentional and substantial modification, including a statement on whether actual use deviated from the developer's intended uses.

H-02.3

Deployers must conduct at least annual reviews of each deployed high-risk AI system to verify it is not causing algorithmic discrimination.

H-02.8

Deployers must notify consumers before deploying a high-risk AI system to make or substantially factor in a consequential decision about them.

H-01.3

Deployers must provide consumers with an explanation and appeal opportunity when a high-risk AI system makes or substantially factors in an adverse consequential decision about them.

H-01.1

Deployers must publish on their website a clear summary of the high-risk AI systems they deploy, including intended uses and risk information.

G-02.4

Deployers must notify the attorney general within 90 days of discovering that a deployed high-risk AI system has caused algorithmic discrimination.

R-01.3

Deployers must produce risk management policies, impact assessments, and related records to the attorney general within 90 days of request, with trade-secret and privilege protections preserved.

R-02.2

C.R.S. § 6-1-1704

Disclosure of AI system to consumer

DeployerDeveloper

(1) 16 On and after AUGUST 1, 2027, and except as provided in subsection (2) of this section, a deployer or other developer that deploys, offers, sells, leases, licenses, gives, or otherwise makes available an artificial intelligence system that is intended to interact with consumers shall ensure the disclosure to each consumer who interacts with the artificial intelligence system that the consumer is interacting with an artificial intelligence system.

This section amends the operative date of the AI-interaction disclosure obligation from February 1, 2026 to August 1, 2027. The substantive requirement — that any deployer or developer making available an AI system intended to interact with consumers must disclose to each interacting consumer that they are interacting with an AI system — remains unchanged.

Compliance actions 1 item

Deployers and developers must disclose to each consumer interacting with an AI system that the consumer is interacting with an artificial intelligence system.

T-01.1

C.R.S. § 6-1-1705(10)

Exemptions — small businesses and small local governments

(10) NOTWITHSTANDING ANY PROVISION OF THIS PART 17 TO THE CONTRARY, THIS PART 17 DOES NOT APPLY TO A PERSON THAT IS: (a) A LOCAL GOVERNMENT WITH A TOTAL POPULATION OF FEWER THAN ONE HUNDRED THOUSAND RESIDENTS; OR (b) A BUSINESS WITH: (I) FEWER THAN TWO HUNDRED FIFTY EMPLOYEES; OR (II) LESS THAN FIVE MILLION DOLLARS IN ANNUAL REVENUE IN THE PREVIOUS CALENDAR YEAR.

This new subsection creates three categorical exemptions from the entirety of Part 17. Local governments with fewer than 100,000 residents are exempt. Businesses with fewer than 250 employees are exempt. Businesses with less than $5 million in annual revenue in the previous calendar year are also exempt. These are disjunctive — a business need only satisfy one of the two business-size thresholds. The exemptions override all other provisions of Part 17.

Section 6 (Effective Date)

Act effective date and referendum clause

This act takes effect at 12:01 a.m. on the day following the expiration of the ninety-day period after final adjournment of the general assembly; except that, if a referendum petition is filed pursuant to section 1 (3) of article V of the state constitution against this act or an item, section, or part of this act within such period, then the act, item, section, or part will not take effect unless approved by the people at the general election to be held in November 2026 and, in such case, will take effect on the date of the official declaration of the vote thereon by the governor.

The act takes effect 90 days after the final adjournment of the extraordinary session, subject to a referendum petition clause. If a referendum petition is filed, the act would not take effect unless approved at the November 2026 general election.

Transparency AI identity disclosure · periodic reminders

1 item

T-01.1

Deployers and developers must disclose to each consumer interacting with an AI system that the consumer is interacting with an artificial intelligence system.

Human Oversight Decision review · appeal pathways

6 items

H-02.1

Deployers of high-risk AI systems must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination.

H-02.3

H-02.8

Deployers must conduct at least annual reviews of each deployed high-risk AI system to verify it is not causing algorithmic discrimination.

H-01.3

Deployers must notify consumers before deploying a high-risk AI system to make or substantially factor in a consequential decision about them.

H-01.1

Deployers must provide consumers with an explanation and appeal opportunity when a high-risk AI system makes or substantially factors in an adverse consequential decision about them.

Governance Risk management · accountability programs

5 items

G-02.1

Developers must make documentation available to deployers or other developers describing the high-risk AI system's capabilities, limitations, and intended uses.

G-02.1

Developers must provide deployers with impact-assessment-enabling documentation — including model cards, dataset cards, or other impact assessments — to the extent feasible.

G-02.4

Developers must publish on their website or in a public use-case inventory a statement summarizing the types of high-risk AI systems they make available and their intended uses.

G-01.1

G-02.4

Deployers must publish on their website a clear summary of the high-risk AI systems they deploy, including intended uses and risk information.

Regulatory Reporting · disclosure · audit

4 items

R-01.3

Developers must disclose to the attorney general and all known deployers any known or reasonably foreseeable risks of algorithmic discrimination within 90 days of discovery.

R-02.2

Developers must produce documentation to the attorney general within 90 days of request, with trade-secret and privilege protections preserved.

R-01.3

Deployers must notify the attorney general within 90 days of discovering that a deployed high-risk AI system has caused algorithmic discrimination.

R-02.2

Deployers must produce risk management policies, impact assessments, and related records to the attorney general within 90 days of request, with trade-secret and privilege protections preserved.

Passage Likelihood

Failed

Status Failed

Final action Governor Signed

Legislative History

2025-01-08 Introduced In House - Assigned to Agriculture, Water & Natural Resources

2025-02-03 House Committee on Agriculture, Water & Natural Resources Refer Amended to House Committee of the Whole

2025-02-06 House Second Reading Special Order - Passed with Amendments - Committee, Floor

2025-02-07 House Third Reading Passed - No Amendments

2025-02-11 Introduced In Senate - Assigned to Agriculture & Natural Resources

2025-03-05 Senate Committee on Agriculture & Natural Resources Refer Amended to Senate Committee of the Whole

2025-03-10 Senate Second Reading Passed with Amendments - Committee

2025-03-11 Senate Third Reading Passed - No Amendments

2025-03-12 House Considered Senate Amendments - Result was to Laid Over Daily

2025-03-17 House Considered Senate Amendments - Result was to Concur - Repass

2025-03-24 Signed by the Speaker of the House

2025-03-25 Signed by the President of the Senate

2025-03-26 Sent to the Governor

2025-03-31 Governor Signed

Sources

Full Text ↗

Entry Last Reviewed

2026-05-20

AI generated