Colorado AI Act: Audit Tool for Nonprofits

Compliance Checklist

1. Vendor Inventory — Contact the software provider and request their "SB24-205 Compliance Statement." Developers are required to furnish deployers with documentation on foreseeable risks, training data summaries, and intended uses.
2. Risk Management Program — Implement a risk management policy and program aligned with recognized frameworks (NIST AI RMF or ISO/IEC 42001) to identify, document, and mitigate risks of algorithmic discrimination.
3. Annual Impact Assessment — Conduct a formal impact assessment before deployment and repeat it annually, as well as within 90 days of any substantial modification to the system. The assessment must document the system's purpose, intended use, benefits, known limitations, and discrimination risks.
4. Pre-Decision Consumer Notice — Before any consequential decision is made, provide the affected individual with notice that a high-risk AI system is being used, a plain-language description of the system, the nature of the decision, and contact information.
5. Adverse Decision Protections — If a consequential decision is adverse, provide the individual with the reasons for the decision, an opportunity to correct inaccurate personal data, and an opportunity to appeal with human review (if technically feasible).
6. Annual Review — Review each deployed high-risk system annually to confirm it is not causing algorithmic discrimination. Maintain documentation for three years after discontinuing use.