PubLedge

Deployers would have been required to complete an impact assessment for each covered high-risk artificial intelligence system, repeat it at least annually and after intentional and substantial modifications, and retain the assessment records. The obligation is retained from the predecessor Colorado SB 24-205 framework. Predecessor operative history remains unresolved; SB 26-189 section 5 qualifies replacement timing, and signature alone does not establish when predecessor duties ceased or whether they operated.

What Counts

• Initial assessment of purpose, use context, benefits, inputs, outputs, performance, limitations, and discrimination risks
• Annual reassessment while the high-risk system remains deployed
• Reassessment within ninety days after an intentional and substantial modification
• Documentation of transparency measures, safeguards, monitoring, and risk mitigation
• Retention of current and prior assessments for the statutory period

What Does Not Count

• Treating the enacted assessment mandate as currently operative after SB 24-205 was superseded
• A one-time assessment with no annual or modification-triggered review
• An assessment that omits reasonably foreseeable algorithmic-discrimination risks
• Generic system documentation that does not evaluate the deployer's actual deployment context

Implementing Legal Instruments