Colorado is poised to significantly amend its pioneering Artificial Intelligence (AI) legislation with the introduction of Senate Bill 25-318 (SB 318) with some big news coming this month. This bill seeks to recalibrate the balance between fostering innovation and safeguarding consumer rights especially on the heels of the Consumers Report piece we covered about the absolute defiance of big tech to responsibly respect users opt-out requests. The proposed changes aim to address concerns raised by various stakeholders, including the tech industry and civil rights groups, since the enactment of the original AI Act (SB 24-205) in 2024.
The Original AI Act (SB 24-205)
Enacted in 2024, Colorado’s AI Act which is different than the Colorado Privacy Act. The AI Act in Colorado was the first in the nation to establish comprehensive consumer protections against algorithmic discrimination. It mandated that developers and deployers of high-risk AI systems exercise reasonable care to prevent discriminatory outcomes in consequential decisions, such as those related to employment, housing, and financial services. The law also required transparency through disclosures and impact assessments, with enforcement set to begin on February 1, 2026.
Colorado Wants To Strike the Balance Between Innovation and Consumer Protection
However, the law faced criticism for its broad scope and potential to stifle innovation. Governor Jared Polis, while signing the bill, expressed concerns about its impact on technological advancement and urged lawmakers to refine the legislation. In response, the Colorado legislature formed an AI Task Force to recommend adjustments, leading to the drafting of SB 318.
Key Provisions of SB 318
1. Redefinition of Algorithmic Discrimination
SB 318 narrows the definition of algorithmic discrimination to align with existing anti-discrimination laws, such as the Colorado Anti-Discrimination Act and the Civil Rights Act of 1964. This change removes the original law’s broader, standalone definition, aiming to provide clearer legal standards.
2. Adjustments to Developer and Deployer Obligations
- Duty of Care Removed: The requirement for developers and deployers to exercise reasonable care in preventing algorithmic discrimination is eliminated.
- Incident Reporting: The obligation to report known or foreseeable risks of algorithmic discrimination to the Attorney General is removed.
3. Exemptions for Small Businesses and Open-Source Developers
- Small Business Exemption: Developers with less than $10 million in third-party investment, annual revenues under $5 million, and fewer than five years of operation are exempt from certain disclosure requirements.
- Open-Source Exemption: Developers offering AI systems with open model weights under specified conditions are exempt from some obligations.
4. Impact Assessment Modifications
Deployers are now required to include in their impact assessments considerations of risks related to accessibility for certain individuals, potential unfair trade practices, violations of labor laws, and breaches of the Colorado Privacy Act. The previous requirement for assessments within 90 days of substantial modifications is repealed.
5. Consumer Disclosure and Appeal Rights
- Disclosure Requirements: The bill expands the information that must be disclosed to consumers subject to consequential decisions made by AI systems.
- Appeal Rights: Consumers’ rights to appeal adverse decisions are limited to those where AI was the principal basis, excluding time-limited or competitive decisions.
6. Implementation Timeline
The enforcement date for most provisions is delayed to January 1, 2027, providing additional time for compliance. However, certain consumer disclosure requirements will take effect earlier, on May 1, 2026.
Stakeholder Reactions
The proposed amendments have elicited mixed reactions:
- Tech Industry: Many in the tech sector welcome the revisions, viewing them as a necessary step to prevent overregulation that could hinder innovation and economic growth.
- Civil Rights Advocates: Some civil rights groups express concern that the bill may weaken protections against algorithmic discrimination, though others acknowledge that the foundational safeguards remain intact.
- Legislators: Senator Robert Rodriguez, a primary sponsor of both the original and revised bills, emphasizes the need for balanced regulation that protects consumers without imposing undue burdens on businesses.
Comparative Perspective: Colorado Privacy Act
The Colorado Privacy Act (CPA), effective July 1, 2023, established comprehensive data privacy rights for consumers. SB 318 aligns certain AI system requirements with the CPA, particularly regarding impact assessments and consumer disclosures. This alignment aims to create a cohesive regulatory framework for data privacy and AI governance in the state.
Summary of SB 318 Provisions
- Redefines algorithmic discrimination to align with existing laws.
- Removes duty of care and incident reporting requirements for developers and deployers.
- Introduces exemptions for small businesses and open-source developers.
- Modifies impact assessment requirements to include additional risk considerations.
- Expands consumer disclosure obligations and refines appeal rights.
- Delays enforcement to January 1, 2027, with some provisions effective May 1, 2026.
As the legislative session concludes on May 7, 2025, the fate of SB 318 remains uncertain. If enacted, the bill will reshape Colorado’s approach to AI regulation, potentially serving as a model for other states grappling with similar challenges. The future for AI regulation in the United States is only going to ramp up and we should see more states following in line with their own AI Acts to align with their comprehensive state privacy laws.
