PubLedge

Developers and deployers of high-risk artificial intelligence systems would have been required to use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. The obligation is retained from the predecessor Colorado SB 24-205 framework. Predecessor operative history remains unresolved; SB 26-189 section 5 qualifies replacement timing, and signature alone does not establish when predecessor duties ceased or whether they operated.

What Counts

• Developer controls addressing discrimination risks arising from intended and contracted uses
• Deployer controls addressing discrimination risks arising from deployment
• Risk management measures proportionate to known and reasonably foreseeable risks
• Compliance evidence sufficient to support the statute's rebuttable presumption of reasonable care

What Does Not Count

• Treating the enacted duty as currently operative after SB 24-205 was superseded
• Limiting review to intentional discrimination while ignoring foreseeable disparate impacts
• Relying on developer documentation without deployer-specific risk controls
• Generic responsible-AI principles without controls tied to the covered high-risk system

Implementing Legal Instruments