Colorado Pioneers Law Aimed at Addressing Discrimination in Artificial Intelligence Systems

Ashley Graves, Associate

On May 17, 2024, Governor Jared Polis signed the Colorado Artificial Intelligence Act (SB24-205, or the “CAIA”) into law, which is intended to prevent or minimize discrimination stemming from the use of artificial intelligence systems (“AI”).[1]  The CAIA will take effect on February 1, 2026 and applies, but is not limited, to Colorado businesses using AI to make employment decisions.  While President Joe Biden released his Executive Order addressing the development and use of AI on October 30, 2023, Colorado is the first state to enact its own legislation regulating employers’, and others’, use of AI.[2]

 Employer Obligations

According to the CAIA, “algorithmic discrimination” occurs when the use of an AI system causes “an unlawful differential treatment or impact” disfavoring an individual or group of individuals “on the basis of their actual or perceived age, color, disability, ethnicity, genetic information, limited proficiency in the English language, national origin, race, religion, reproductive health, sex, veteran status,” or other classification protected under federal or state laws.  To address the potential for AI systems to discriminate against individuals in protected classes, the CAIA imposes on employers the duty of reasonable care to protect individuals when AI plays a substantive factor in making a “consequential decision.”[3]

  Under the CAIA, there is a rebuttable presumption than an employer using AI systems exercised reasonable care if the following steps are taken:

 ·        Implementing a risk management policy and program governing the use of AI discussing the principles, processes, and personnel used to identify, document, and mitigate known or reasonably foreseeable risks of discrimination that is regularly reviewed and updated, and is drafted in light of the considerations defined in the statute;

 ·        Completing annual impact assessments--or within ninety (90) days following any intentional and substantial modification of the AI system--that disclose the intended use and benefits of using AI; any known or foreseeable risks along with mitigation efforts conducted by the employer; and a description of transparency measures taken, including any measures taken to disclose the use of the system to consumers and a description of the post-deployment monitoring and user safeguards provided concerning the system, among other requirements; and

 ·        Notifying individuals—prior to using the AI system--of the employer’s use of AI in making consequential decisions including a statement describing 1) the purpose of the system; 2) the nature of the decision being made; 3) the employer’s contact information; and 4) if applicable, the consumer’s right to opt out of having their personal data processed.

The CAIA imposes additional burdens on employers who take an adverse action against an individual based on input received from AI.  Employers must 1) disclose the reason for the decision, including the role and extent AI played in making the decision; 2) provide an opportunity for the individual to correct any incorrect personal data; 3) and provide an opportunity for the individual to appeal the decision.

Further, employers using AI in employment decisions must include a statement on their website, if applicable, detailing 1) the type of AI being deployed; 2) how the employer manages known or reasonably foreseeable risks arising from algorithmic discrimination; and 3) the nature, source, and extent of information collected.  This statement must be updated periodically. 

Importantly, employers with fewer than fifty (50) employees that do not use their own data to train the AI system are excluded from the CAIA’s mandates.  Affected employers may also raise an affirmative defense in enforcement actions brought by the attorney general when 1) the employer discovers and cures a violation resulting from an internal review process, feedback, or adversarial testing; and 2) is otherwise compliant with the latest version of  the “Artificial Intelligence Risk Management Framework” published by the National Institutes of Standards and Technology, or is compliant with another nationally or internationally recognized risk management framework. 

 Employer Considerations

Employers should note that AI-based efforts to expand an applicant, customer, or participant pool for the purpose of increasing diversity or to redress historical discrimination are excluded from the CAIA’s definition of algorithmic discrimination.  For a more comprehensive discussion on how employers can successfully utilize AI without violating Title VII of the Civil Rights Act of 1964, please see our June 1, 2023 blog post on the subject.[4]  However, in his signing statement for the CAIA, Governor Jared Polis stressed that he was signing the CAIA “with reservations,” particularly as to the law’s impact on the development and expansion of new technologies in Colorado, and encouraged the CAIA’s sponsors to improve the bill via future legislation before it takes effect.[5]  Accordingly, it is fair to assume that the CAIA may see additional changes and refinements before it goes into effect in 2026, and employers should pay close attention to the same in the coming months and years.  Campbell Litigation will continue to monitor both the CAIA and any efforts by the General Assembly to further refine the CAIA’s provisions via future legislation.

[1]https://leg.colorado.gov/sites/default/files/documents/2024A/bills/2024a_205_enr.pdf.

[2]https://www.whitehouse.gov/briefing-room/presidential-actions/2023/10/30/executive-order-on-the-safe-secure-and-trustworthy-development-and-use-of-artificial-intelligence/.

[3]A consequential decision “has a material legal or similarly significant effect on the provision or denial to any consumer” of, for example, employment or an employment opportunity.  “Consumer” means anyone who is a Colorado resident.

[4]https://www.rockymountainemployersblog.com/blog/2023/6/1/eeoc-releases-guidance-on-employer-use-of-artificial-intelligence-to-avoid-liability-under-title-vii.

[5]https://drive.google.com/file/d/1i2cA3IG93VViNbzXu9LPgbTrZGqhyRgM/view?pli=1.