On May 8, 2024, Colorado’s state legislature passed a bill imposing rules on the use of AI in businesses. Set to take effect in 2026, the law specifically targets the discrimination that arises from AI being used to make important business decisions, such as hiring and firing employees.
The SB 205 Bill
If the SB 205 bill gets signed by Colorado’s governor, companies that will be affected are those that develop or use high-risk artificial intelligence systems for decisions concerning:
- education enrollment and/or opportunity
- employment and/or opportunity
- a financial or lending service
- an essential government service
- healthcare
- housing
- insurance
- a legal service
The bill’s purpose is to prevent discrimination caused by AI algorithms. Discrimination occurs when the AI system favors people based on age, disability, race, sex, or religion.
AI Developers and Deployers
The bill mentions “developers” and “deployers” of high-risk AI systems.
A developer is any person doing business in Colorado who develops or intentionally and substantially modifies an AI system, while a deployer is any person doing business in Colorado who uses a high-risk AI system.
Rules That Will Apply to Developers
When the bill is signed, developers will be required to make extensive information available regarding the known harmful or inappropriate uses of their AI system and the data used within it. Additionally, the company must post a public statement about the types of high-risk AI systems and the potential risks of algorithm discrimination. Developers will also need to disclose all of these risks to the attorney general.
Rules That Will Apply to Deployers
If a company continues to use a high-risk AI system, it must implement a risk management program that regularly and systematically reviews its policies. Deployers will also be required to complete an impact assessment annually and within 90 days if there are any major system modifications.
Furthermore, a company must also disclose to consumers, in a statement posted on its website, that it uses a high-risk AI.
Will Some Deployers be Exempt?
As with any law, there are some exemptions.
If a deployer has less than 50 full-time employees, they are exempt. They will also be exempt if they don’t use their own data to train the AI system. Also, exemption is given if the AI system is used for its intended purpose without the deployer’s own data.
What Can Businesses Expect Next?
Many businesses in Colorado could be affected by this new rule. It will be important for Colorado AI developers and deployers to pay attention and quickly adopt the necessary AI risk management policies.
For businesses outside of Colorado, it’s not the time to feel relief that this law doesn’t affect you. States like California and New York might soon face a similar reality. There will undoubtedly be similar activity happening across the rest of the country now that Colorado has taken the initiative to be the first state to create such a law.