Colorado AI Legislation

Any AI system that, when deployed, makes or is a substantial factor in making a “consequential decision.” To qualify as a substantial factor, the AI-generated component must be capable of altering the outcome of the decision.

A decision with a material legal or similarly significant effect on a consumer’s access to education, employment, financial or lending services, essential government services, healthcare, housing, insurance, or legal services.

The use of an AI system that results in unlawful differential treatment or disparate impact that disfavors an individual or group based on actual or perceived protected characteristics, including age, race, sex, disability, religion, ethnicity, genetic information, veteran status, and other protected classes.

Developers must provide deployers with comprehensive documentation (foreseeable uses, training data types, known limitations, mitigation methods), make public disclosures on their website, and notify the Attorney General within 90 days of discovering algorithmic discrimination.

Deployers must implement a risk management program, conduct recurring impact assessments, notify consumers of adverse AI-driven decisions (with reasons and appeal options), and report incidents to the Attorney General within 90 days. A small deployer exemption exists for organizations with fewer than 50 employees under certain conditions.

Enforced exclusively by the Colorado Attorney General. Violations are treated as unfair trade practices under the Colorado Consumer Protection Act, with fines up to $20,000 per violation. Compliance with NIST AI RMF or ISO/IEC 42001 creates a rebuttable presumption of reasonable care. There is no private right of action.

Both developers and deployers of any consumer-facing AI system (not limited to high-risk systems) must disclose to users that they are interacting with an AI system, unless the interaction would be obvious to a reasonable person.

Licensed psychologists, counselors, and social workers are prohibited from using AI to directly interact with clients for therapeutic communication or to detect emotions without a human professional maintaining active oversight. AI cannot “speak” as a therapist or generate treatment plans autonomously.

Regulated professionals may use AI for administrative support or supplementary tasks, provided they maintain full responsibility for all interactions, outputs, and data use associated with the AI system. The bill recognizes that AI can be a useful tool when the human professional retains control.

If a client’s therapeutic session is recorded or transcribed through an AI system, the regulated professional must obtain written, informed consent from the client (or the client’s representative) before the recording begins.

The bill makes it unlawful for any individual, corporation, or entity to provide, advertise, or offer psychotherapy services to the public in Colorado unless those services are delivered by a licensed, regulated professional. This effectively prevents standalone AI therapy apps from operating in the state without a human therapist.

Generative AI systems that create or substantially alter video, images, or audio must include provenance data (embedded metadata or digital watermarks) that identifies the content as AI-generated or AI-modified. This enables downstream verification of content authenticity.

The bill covers three media types: video, images, and audio. It applies to content that is either fully generated by AI or substantially altered by AI tools, addressing the proliferation of realistic deepfakes used for misinformation, fraud, and non-consensual imagery.