Colorado Repeals and Replaces AI Act

We’ve been following the twists and turns of Colorado’s pending AI legislation for some time now. The 2024 law was ambitious to say the least. That ambition was quickly tempered after its passage, as the legislature and governor got cold feet. Initially, the law was delayed pending a rework, then it was enjoined by the courts. Last week, the legislature fully repealed the law, replacing it with a softer regulatory framework. A recent Nixon Peabody memo discusses the requirements of the new law:

“For developers: Provide deployers with documentation covering intended uses, training data categories, known limitations, and instructions for human review; notify deployers of material updates within a reasonable time; and retain compliance records for three years.

For deployers: Two disclosure obligations. First, provide clear and conspicuous pre-use notice that ADMT is being used, which is satisfiable through a prominent public posting at points of consumer interaction. Second, if a consequential decision produces an adverse outcome, provide the consumer within 30 days a plain-language explanation of the decision and the ADMT’s role, along with instructions for exercising consumer rights.

Consumer rights following an adverse outcome: Consumers may request their personal data, correction of factually inaccurate data (excluding opinions, predictions, and scores), and meaningful human review “to the extent commercially reasonable.” The human reviewer must have authority to approve, modify, or override the decision and must not simply default to the system’s output.”

The new law will enter force on January 1, 2027. While it is less burdensome on developers and deployers than the previous version, in-scope companies should begin preparing for compliance now, given the urgency of the six and a half month timeframe.