Colorado's AI act puts duties on organisations that deploy high-risk AI systems making, or substantially shaping, consequential decisions about consumers. It names no training course, but its duties of reasonable care, explanation and human review on appeal all depend on trained staff. Anyone who approves, explains or reconsiders an agent's decision needs proven skill.
What does the act require, in plain words?
The act is aimed at high-risk AI systems: those that make, or are a substantial factor in making, a consequential decision. Consequential decisions are ones with a material effect on a consumer's access to, or the cost or terms of, things like employment, education, lending and financial services, housing, insurance, healthcare, legal services and essential government services.
For deployers, the organisations using such systems, the duties are in substance:
- use reasonable care to protect consumers from algorithmic discrimination;
- run a risk management policy and programme for the system;
- complete impact assessments and repeat them when things change;
- tell consumers when a high-risk system is used in a consequential decision about them;
- after an adverse decision, explain the principal reasons, let the consumer correct inaccurate personal data, and offer an appeal that allows human review where feasible;
- publish information about the high-risk systems in use;
- report discovered algorithmic discrimination to the state.
Some duties are lighter for small deployers. Enforcement rests with the state rather than private lawsuits. Check with counsel when the duties take effect for you, because the timing has been subject to change.
Who does it apply to?
Developers and deployers doing business in Colorado whose systems reach Colorado consumers. A lender, insurer, employer, landlord or healthcare provider using an agent that shapes a consequential decision about a Colorado resident is likely in scope. For a detailed scoping view, see does the Colorado AI act apply to AI agents, and for the meaning of the central term, what a consequential decision is.
Inside a deployer, the act touches:
- reviewers who approve or decline agent decisions before they reach consumers;
- appeal handlers who carry out the human review the act expects;
- staff who write adverse decision notices and must state principal reasons accurately;
- the risk owner who runs the risk management programme and impact assessments.
What does it mean when an agent shapes the decision?
An agent is a substantial factor whenever its output meaningfully drives the outcome, even if a person clicks approve. That catches the common pattern where an agent drafts a decline at depth 2 and a reviewer sends it. The test is not who pressed the button but whether the agent's assessment shaped the result.
Three skills follow for staff.
Spotting discrimination risk. Reviewers need to recognise when an agent's reasoning leans on factors that stand in for protected characteristics, such as postcode patterns or gaps in employment history. They will not catch this by instinct; it must be taught with examples from their own decisions.
Writing principal reasons. The act expects an adverse decision to come with its principal reasons. A reviewer must be able to read the agent's record, identify which facts decided the outcome and state them plainly. "The model scored you low" is not a reason. This overlaps with the explanation duty for credit in other regimes, covered in UK GDPR and training staff who review AI agent decisions.
Conducting a real appeal. Human review on appeal means a person who can see the facts, check the consumer's correction, and decide differently. On a governed platform the record shows every verdict and the bound that decided it, so the appeal handler can see exactly what the agent did. They need training to read it and the authority to overturn it.
How do you meet it with training and controls?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Reasonable care against algorithmic discrimination | Reviewers trained on proxy factors with examples from their domain | Training records; periodic outcome reviews by group |
| Risk management policy and programme | Programme structured on a recognised framework, such as the NIST AI Risk Management Framework or ISO/IEC 42001, with named owners | Policy, owner assignments, review minutes |
| Impact assessment | Assessment names the agent's depth, its human review step and reviewer competence | Assessment versions updated when depth or sources change |
| Principal reasons for adverse decisions | Staff trained to derive reasons from the agent's record | Notices with reasons traceable to recorded facts |
| Correction and appeal with human review | Appeal handlers with authority and training to overturn | Appeal files showing what was reviewed and the outcome |
Keep the depth question in view. An agent allowed to execute consequential decisions at depth 3 without review puts all the weight on the appeal. Holding adverse decisions for a named person, even where the agent could execute them, moves the human judgement earlier, where it is cheaper and fairer. The wider analysis is in Colorado's AI act and AI agents making consequential decisions.
What will the state or an auditor ask?
Expect questions such as: which of your systems are high-risk, and how did you decide? Show the impact assessment for this agent. Who reviews adverse decisions before they are sent, and what training have they had? Show three adverse notices and trace each reason to the record. How many appeals were upheld, and what changed as a result? An auditor will add: does your risk programme name the people, and are their skills current?
What does the act not cover?
It does not govern systems that do not make or substantially shape consequential decisions, such as an agent that drafts internal summaries. It does not set a training syllabus, hours or certification. It does not replace federal rules: lenders still face ECOA and Regulation B on adverse action reasons, and health data stays under HIPAA. It does not tell you which depth an agent may hold. And it does not reach consumers outside Colorado, though many organisations apply one standard everywhere.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy trains the people around consequential decisions on the real product: how a governed agent decides, human review, and when something goes wrong. Module tests are set in the learner's own industry and role, so an appeal handler at a lender practises on lending appeals. Our guide to AI literacy and certification for people who work with agents explains how the levels fit together.
Questions people ask
Does a person approving every decision take the agent out of scope?
Not if the agent's output is a substantial factor in the result. Formal approval by a person who relies on the agent's assessment does not change what shaped the decision.
Do appeal handlers need different training from reviewers?
They need the same foundations plus two more skills: checking a consumer's corrected data against the record, and reaching an independent conclusion. Training should include cases where the right answer is to overturn the agent.
Can an agent handle appeals overnight?
An agent can acknowledge, organise the file and draft a summary at any hour, but the human review the act expects must be done by a person. See whether AI agents can work around the clock for how to split the work.