Colorado Artificial Intelligence Act: Compliance Checklist

Compliance checklist

Run through these items to scope your obligations under Colorado Artificial Intelligence Act. Not legal advice; verify with counsel before acting.

1. Confirm scope: does the law apply to your operations? See Who Must Comply or use the Compliance Checker.
2. Inventory in-scope AI systems and classify them by role (developer/deployer) and decision type.
3. Address each obligation:
   • risk assessment — Complete an annual impact assessment of each high-risk AI system, addressing purpose, intended outputs, performance metrics, transparency measures, post-deployment monitoring, and risks of algorithmic discrimination.C.R.S. § 6-1-1703(3)
   • documentation — Provide deployers with documentation including intended uses, harmful or inappropriate uses, data summaries, performance evaluations, mitigation measures, and information necessary for deployers to complete their impact assessments.C.R.S. § 6-1-1702
   • disclosure — Disclose to consumers when a high-risk AI system is being used to make a consequential decision affecting them, including the system's purpose, the nature of the consequential decision, contact information, and the right to opt out where required.C.R.S. § 6-1-1703(4)
   • consumer right — Provide consumers with a right to correct incorrect personal data and a right to appeal adverse consequential decisions to a human reviewer where technically feasible.C.R.S. § 6-1-1703(4)
4. Adopt a federal control framework: NIST AI RMF or ISO/IEC 42001 to demonstrate due care.
5. Document evidence of compliance for each obligation, refreshed at the cadence the law requires.
6. Build the AG-notification path if the law requires it (Colorado, California SB 53).
7. Set the refresh cadence — annual for most impact-assessment regimes; continuous for monitoring.