As Artificial Intelligence becomes more of a household name, lawmakers and regulators throughout the nation are examining ways to protect consumers. Colorado recently passed first-of-its-kind legislation, a comprehensive law targeting developers and deployers of high-risk AI systems. Because the federal government is likely to be slow to act, national AI regulation is unlikely to be on the horizon anytime soon.
We are even starting to see AI laws pop up at the municipal level. While nowhere near as comprehensive as Colorado’s legislation, New York City implemented Local Law 144 in 2023, prohibiting employers from using automated employment decision tools unless audited to ensure no discrimination in the hiring process.
One of Colorado’s goals is to ensure AI systems are used ethically and protect state residents from “algorithmic discrimination,” or potential bias embedded in AI systems that could discriminate against someone based on gender, race, ethnicity, age, national origin, religion and other factors. Under the law, high-risk AI systems are defined as those playing a substantial role in making consequential decisions.
Colorado’s AI Act
AI has brought both excitement and worry. The benefits are boundless, but the potential for misuse lurks. Colorado’s law, known as the Consumer Protections for Interactions with Artificial Intelligence, takes effect Feb. 1, 2026, and applies to specific industries: employment, financial and lending services, insurance, education enrollment, health care, housing, insurance, legal services and essential government services.
Among its many requirements, employers with more than 50 employees must:
- inform people when an AI system is used in a decision-making process.
- provide certain information to those affected by the AI system’s decision.
- grant the opportunity to correct incorrect personal data that may have led to that decision and/or appeal the decision.
- conduct annual bias audits of their systems.
- develop risk-management policies and programs that include processes involved in mitigating algorithmic discrimination.
- report any potential instances of algorithmic discrimination to the Colorado Attorney General’s office within 90 days.
In addition, AI system developers must disclose to those who use their systems the data utilized to train the system and any potential biases, as well as ways the system can be inappropriately used. They also must provide the system deployers with all documentation necessary to conduct an impact assessment of the system.
While the law does not allow for a private right of action, it permits those who believe they are treated unfairly to seek assistance from the state’s Attorney General office. An offense would be considered an unfair trade practice, with the Attorney General having enforcement power.
Notably, Colorado’s law does not apply to AI systems that perform specific procedural tasks or are not used to augment, replace, or influence human assessments. For example, it would not apply to AI used in video games, cybersecurity, fraud detection, spam filtering, or other similar applications.
But it is not yet in its final form. The state created a 26-member task force to come up with recommendations to amend and implement the law before it takes effect. The legislation also grants the Attorney General’s office the power to institute further regulations.
The AI Regulatory Quilt Grows
While the White House issued its Blueprint for an AI Bill of Rights in Oct. 2022, it is not law and there has been no binding national law comprehensively addressing AI. Meanwhile, the European Union recently published a comprehensive AI law that will take effect in phases between February 2025 and August 2026 and creates a centralized AI office to support compliance. The EU framework has many of the same requirements as Colorado’s law. It would not be surprising if the EU’s AI law operated in a similar manner globally with regard to AI as the GDPR does with regard to data privacy. Also, California is not far behind as SB 1047 works its way through the legislative process and faces massive opposition from big tech.
Any companies deploying or planning to deploy generative AI products to residents of Colorado should monitor this law closely and be prepared well in advance of the effective date in 2026.
Harris Beach’s Intellectual Property attorneys will continue monitoring the Colorado legislation and any emerging federal or state legislation. If you have questions or concerns about this or related Intellectual Property matters, please reach out to attorney Brendan M. Palfreyman at (315) 214-2161 and bpalfreyman@HarrisBeach.com, or the Harris Beach attorney with whom you most frequently work.
This alert is not a substitute for advice of counsel on specific legal issues.
Harris Beach has offices throughout New York state, including Albany, Buffalo, Ithaca, Long Island, New York City, Rochester, Saratoga Springs, Syracuse and White Plains, as well as Washington D.C., New Haven, Connecticut and Newark, New Jersey.
