A deployer under Colorado's AI act, meaning a business using a high-risk AI agent in consequential decisions, owes duties at three moments. Before use: a risk management programme, an impact assessment and a public statement. At the decision: notice to the consumer. After an adverse decision: principal reasons, a chance to correct data and an appeal to a person.
What does the act require of deployers, in plain words?
Colorado has passed an AI act aimed at high-risk systems that make consequential decisions. Deployers must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. The act then sets specific duties, which, in substance, are:
- implement a risk management policy and programme for high-risk systems, reasonable in light of recognised frameworks such as the NIST AI Risk Management Framework or ISO/IEC 42001, the deployer's size and the sensitivity of the data;
- complete an impact assessment for each high-risk system, repeat it regularly, and update it after intentional and substantial modification;
- review each deployment regularly to check it is not causing algorithmic discrimination;
- notify consumers, before a consequential decision, that a high-risk system is being used, with a description of it and how to contact the deployer;
- after an adverse decision, give the principal reasons, including how far the system contributed and what data it used, offer a chance to correct incorrect personal data, and offer an appeal with human review where technically feasible;
- publish a statement summarising the high-risk systems deployed and how risks are managed;
- notify the state's attorney general if the deployer discovers the system has caused algorithmic discrimination.
Some of these are relaxed for small deployers that meet the act's conditions. Whether an agent is high-risk at all is covered in does the Colorado AI act apply to AI agents.
Who counts as a deployer?
A person or business doing business in Colorado that uses a high-risk AI system. Buying an agent from a vendor makes you a deployer; building one makes you a developer as well. A lender, insurer, landlord, employer, school or healthcare provider using an agent that shapes consequential decisions about Colorado residents is the typical deployer.
The EU AI Act uses similar language for the user of a system, and a comparison with what the EU AI Act requires deployers to do is useful for groups facing both.
What makes these duties harder when the system is an agent?
Three of the duties change shape with agents.
Principal reasons. A model's reasons can come from feature importance. An agent's reasons come from what it read, what it concluded and what it recommended. To explain "how far the system contributed", you need a record of each step and of what the human decision-maker changed. Without that, the honest answer is "we do not know".
Correction of data. An agent may have relied on facts from several sources, some declared by the consumer, some from third parties, some inferred. Correction must reach the fact the agent actually used, which means knowing where each fact came from.
Appeal with human review. The appeal reviewer must be a person who can change the outcome. They should not be the person who approved the original decision, and the agent must not review appeals against its own recommendations. A separation of duties matrix for AI agents is the clearest way to set this out.
How do you meet each deployer duty?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Risk management programme | Programme covering agent approval, testing by group, monitoring, change and retirement, mapped to a recognised framework | Approved programme and framework mapping |
| Impact assessment | Per-agent assessment before use, repeated regularly and on substantial change | Signed assessments and version history |
| Regular deployment review | Outcome review by group from the action record | Review reports and findings |
| Pre-decision notice | Notice that an AI system is used, what it does and how to contact you | Notice text and delivery records |
| Principal reasons | Reasons drawn from the agent's recorded steps and the decision-maker's changes | Reason statements tied to action records |
| Data correction | Each fact the agent used traceable to its source and correctable | Correction requests and updated decisions |
| Human appeal | Appeals reviewed by an independent person with authority to change the outcome | Appeal records naming reviewer and outcome |
| Public statement | Published summary of high-risk agents and risk management | Published statement and update dates |
| Report discovered discrimination | Escalation path to the attorney general within the act's deadline | Escalation records |
Monitoring is a recurring theme across regimes. The EU's equivalent is covered in Article 26 monitoring duties for deployers.
What will the attorney general's office ask?
- What is your risk management programme, and which framework does it follow?
- Show us the notice a consumer receives before the agent is used.
- For this adverse decision, what were the principal reasons, and what did the agent contribute?
- How did the consumer correct their data, and did it change the outcome?
- Who reviewed the appeal, and were they independent of the original decision?
- Have you ever found algorithmic discrimination, and what did you do?
What do the deployer duties not cover?
They do not apply to agents that are not high-risk. They do not displace sector rules, such as ECOA and Regulation B adverse action reasons in lending. They do not require a particular technical method for testing bias. And they are Colorado's; deployers in other markets meet different duties, such as data fiduciary obligations under India's law described in DPDP Act data fiduciary duties for AI agent deployers. For the full map, see AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme files every step an agent takes with the provenance of each fact it used and the bound that decided the verdict. That record supports principal reasons, lets a consumer's correction reach the fact the agent relied on, and shows what the human decision-maker changed.
Questions people ask
Must every adverse decision be appealable to a person?
The act calls for human review of appeals where technically feasible. For agent-supported decisions it almost always is, so plan for it.
Can the vendor's impact assessment be used?
The developer's documentation feeds your assessment, but the assessment must reflect your deployment, your data and your consumers.
Do the duties apply to internal hiring agents?
Yes. Employment is a consequential decision area, so an agent that screens or ranks job applicants and is a substantial factor in hiring is high-risk.