Colorado's AI act applies to an AI agent when it makes, or is a substantial factor in making, a consequential decision about a consumer: in education, employment, lending, essential government services, healthcare, housing, insurance or legal services. Developers and deployers of such agents must use reasonable care against algorithmic discrimination, with duties on documentation, risk programmes, assessments, notices and appeals.
What does the Colorado act require, in plain words?
Colorado has passed an AI act aimed at high-risk AI systems that make consequential decisions. A high-risk system, in substance, is one that makes or is a substantial factor in making a decision with a material legal or similarly significant effect on whether, or on what terms, a consumer gets something important. The law lists the areas: education, employment, financial or lending services, essential government services, healthcare, housing, insurance and legal services.
The central duty is reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination, meaning unlawful differential treatment or impact based on protected characteristics. Around that duty the act builds specific obligations for developers and deployers, and a general duty to tell consumers when they are interacting with an AI system unless it is obvious.
The act's effective date has been the subject of legislative change, so confirm the current date before planning. The term at its centre is explained in what a consequential decision is.
Who does it apply to?
Two roles. A developer builds or intentionally and substantially modifies a high-risk system. A deployer uses one. Both must be doing business in Colorado, and the protections attach to Colorado residents.
Developers must give deployers documentation on the system's intended uses, known limitations, training data summary, risks of discrimination and how to monitor it, and publish a statement on the high-risk systems they offer. Deployers must run a risk management policy and programme, complete impact assessments, notify consumers, explain adverse decisions, offer correction and appeal, and publish a statement about their use. Some deployer duties are relaxed for small deployers meeting the act's conditions. The full deployer list is in Colorado AI act duties for deployers.
When is an agent a substantial factor?
This is the question agents make difficult. A model that outputs a score clearly feeds a decision. An agent might gather documents, check facts, draft a recommendation and route the file. Each step can shape the outcome.
A useful test: would the decision likely have come out differently if the agent's contribution were removed or changed? An agent that summarises a tenant application and recommends approval or decline is very likely a substantial factor, even if a leasing manager signs. An agent that only books viewings or checks that documents are legible is not.
Agents can also become substantial factors by drift. A claims-intake agent built to collect information may start ranking claims for review, at which point it is shaping outcomes in insurance. Your inventory should be checked for this, capability by capability. The short answer on scope is in does the Colorado AI act apply to AI agents.
How do you meet the act when an agent is high-risk?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Reasonable care against algorithmic discrimination | Outcome testing by group before release and on a cycle afterwards | Test results and remediation records |
| Developer documentation | Vendor supplies intended uses, limits, data summary and monitoring guidance | Documentation file per agent |
| Deployer risk programme | Written programme covering agent approval, testing, monitoring and change | Approved programme and review history |
| Impact assessment | Assessment per high-risk agent, refreshed on schedule and after substantial change | Signed assessments |
| Consumer notice | Consumers told an AI system is involved in the decision | Notice text and delivery records |
| Adverse decision explanation | Principal reasons, including the agent's role and data used | Reason statements per decision |
| Correction and appeal | Route to correct data and to appeal to a person | Appeal records and outcomes |
| Report discovered discrimination | Escalation to the state's attorney general when required | Escalation records |
The act gives deployers and developers a defence where they follow a recognised risk management framework, such as the NIST AI Risk Management Framework or ISO/IEC 42001, and cure violations they discover. That makes a documented framework more than good practice. Assessments are covered in Colorado AI act impact assessments for AI agents.
What will an enforcement authority ask?
The act is enforced by the state's attorney general, without a private right of action. Expect questions like these:
- Which of your agents are substantial factors in consequential decisions?
- Show us the impact assessment and the testing behind it.
- What does a declined consumer receive, and does it explain the agent's role?
- How do consumers appeal, and who reviews the appeal?
- Which risk management framework do you follow, and how do you show it?
What does the act not cover?
It does not ban any use of AI in consequential decisions. It does not replace federal anti-discrimination law, ECOA and Regulation B in lending, or state insurance rules. It does not apply to systems that perform narrow procedural tasks or only detect patterns without replacing human assessment, subject to the act's conditions. And it is not the EU's approach: compare it with automated decision-making under GDPR, which focuses on solely automated decisions rather than substantial factors. For the full map, see AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does a human final decision take the agent out of scope?
Not necessarily. The test is whether the agent is a substantial factor, so an agent that drafts a recommendation the decision-maker usually follows can still be in scope.
Is a business outside Colorado affected?
If it does business in Colorado and its agents make or shape consequential decisions about Colorado residents, the act can apply.
Can we rely on the vendor's compliance?
Developer duties sit with the vendor, but deployer duties stay with you. Use the vendor's documentation as input to your own risk programme and impact assessment.