Yes, when the agent is a high-risk system under the act: one that makes, or is a substantial factor in making, a consequential decision about a Colorado consumer, such as a loan, an insurance policy, a job or housing. An agent that only drafts emails or summarises files is outside it. The deciding factor is the decision, not the technology.
What makes an agent high-risk under the Colorado act?
Colorado has passed an AI act aimed at high-risk systems that make consequential decisions. The act does not mention agents, models or chatbots by name. It asks what the system does to a person.
Three questions decide it:
- Is there a consequential decision? In substance, a decision with a material effect on a consumer's access to, or the cost or terms of, things like credit, insurance, employment, education, housing, healthcare, essential government services or legal services.
- Is the agent a substantial factor in it? An agent that assembles the file, scores the applicant or recommends an outcome that a person usually follows is likely to count. An agent that formats a letter after a person has decided is not.
- Is the consumer in Colorado? The act protects Colorado residents, so a business based elsewhere can still be in scope.
The act places duties both on those who build such systems and on those who use them. A firm that buys an agent from a platform and points it at its lending decisions takes on user duties; the platform carries builder duties. The detail of the user side is set out in Colorado AI act duties for deployers of AI agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Why does it matter that the system is an agent that acts?
A scoring model produces a number and stops. An agent reads documents, calls tools, asks follow-up questions and may take the next step itself. That widens the ways it can become a substantial factor.
Take an agent that only "prepares" underwriting packs. If it chooses which documents to request, which discrepancies to flag and which applications to route to the fast-track queue, it has shaped the outcome before any person looks. Under a substance test, routing is part of the decision. Agents also chain, so influence can be spread across several steps that each look harmless.
What may the agent do, and what stays with a person?
| Task in a consequential decision | Agent | Stays with a person |
|---|---|---|
| Collect and check application documents | Yes, depth 1 to 3 | Exceptions the agent cannot resolve |
| Flag missing or inconsistent data | Yes, depth 1 | Deciding whether it matters |
| Recommend approve or decline with reasons | Yes, depth 2 | The decision itself |
| Send an adverse decision notice | Drafts it, depth 2 | Approving and sending |
| Handle an appeal of the decision | No | A reviewer who can change the outcome |
The agent does the preparatory work; anything adverse to the consumer is held for a named person.
An illustrative example
Take a regional lender with customers in several states. It deploys an agent to triage personal loan applications. The agent reads payslips and bank statements, checks them against the declared income, and sorts applications into "approve", "refer" and "decline-likely". On paper, a person decides every loan. In practice, the agent's sort sets the officer's starting point and the time each file gets. For Colorado applicants, the lender treats the agent as a substantial factor, runs an impact assessment on it, tells applicants an AI system is used, and makes sure a declined applicant can get the principal reasons and an appeal to a person who did not see the agent's sort. How the impact assessment works for agents is covered in Colorado AI act impact assessments for AI agents.
Which controls make it safe?
- A register of decisions, not just systems. List each consequential decision and every agent that touches it, with what it contributes.
- Depth. The agent may read and recommend; adverse outcomes are held for a person.
- A record of every step. What the agent read, which sources it relied on, what it recommended and what the person changed. Without this, you cannot give principal reasons.
- Testing for discriminatory outcomes on your own past cases, before use and after any change.
- A clear appeal route to a person who is independent of the original recommendation.
Groups that also operate in Europe will find the questions overlap with whether the EU AI Act applies to AI agents, though the tests differ. The wider map of rules and controls sits in AI agent regulation, mapped to controls.
Where Pryme fits
In Pryme, an agent is certified to one depth and each action needs a depth of its own, so a lending agent at depth 2 can make recommendations while sending adverse notices stays held for a named officer. Every verdict is filed in an append-only record, which is the evidence trail principal reasons and appeals depend on.
Questions people ask
Does the Colorado act apply if we are not based in Colorado?
It can. The act is aimed at protecting Colorado consumers, so a business elsewhere that makes consequential decisions about Colorado residents should assume it may be in scope and check with counsel.
Is a customer service agent covered?
Usually not, if it answers questions and does not shape decisions about credit, insurance, jobs or similar. It comes into scope if it starts deciding eligibility, pricing or access.
Does keeping a human in the loop take the agent out of scope?
Not by itself. If the person usually follows the agent's recommendation, the agent can still be a substantial factor. What matters is the agent's real influence on the outcome.