SB24-205 Consumer Protections for Artificial Intelligence

The Colorado legislature enacted Senate Bill 24-205 to establish consumer protections for interactions with artificial intelligence systems. The measure requires developers and deployers of high-risk artificial intelligence systems to use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination on and after February 1, 2026. There is a rebuttable presumption that reasonable care was used if the parties comply with the act's specified provisions. Developers must provide deployers with statements disclosing information about high-risk systems and documentation needed for impact assessments. They must also publish public statements summarizing the types of high-risk systems they develop and how they manage algorithmic discrimination risks. Developers are required to disclose known or reasonably foreseeable risks to the attorney general and known deployers or developers within 90 days after discovery or receipt of a credible report. Deployers must implement risk management policies and programs for high-risk systems and complete impact assessments. They must notify consumers when such systems make or substantially factor into consequential decisions and provide opportunities to correct incorrect personal data and appeal adverse decisions through human review if technically feasible. Deployers must annually review each deployed high-risk system to ensure it does not cause algorithmic discrimination and must publish statements on their deployed systems and the information they collect. Any person doing business in the state who deploys or makes available an artificial intelligence system intended to interact with consumers must disclose to each interacting consumer that the interaction involves an artificial intelligence system. The act does not restrict specified activities such as complying with other laws, cooperating with investigations, protecting consumer safety, conducting research, or effectuating product recalls. It provides an affirmative defense if a party complies with a designated nationally or internationally recognized risk management framework and takes measures to discover and correct violations. Insurers subject to specified insurance laws and banks examined by state or federal prudential regulators under applicable guidance are in full compliance with the act. The attorney general holds exclusive authority to enforce the requirements and may adopt rules to implement them. A violation constitutes a deceptive trade practice under the Colorado Consumer Protection Act. The bill was approved by the governor on May 17, 2024, and took effect the same day.