Skip to main content
Comply with Colorado’s law governing high-risk artificial intelligence systems.
The Colorado Artificial Intelligence Act is among the first comprehensive US state laws regulating high-risk AI systems. It requires developers and deployers of high-risk AI to use reasonable care to protect consumers from algorithmic discrimination, with transparency, impact assessment, and disclosure obligations.
The Act applies to developers and deployers of high-risk AI systems that make consequential decisions affecting Colorado consumers.

​
Who needs Colorado AI Act?

AI developers

Organizations that build or substantially modify high-risk AI systems.

AI deployers

Organizations that use high-risk AI to make consequential decisions.

​
Key components

Duty of care

Use reasonable care to protect consumers from algorithmic discrimination.

Impact assessments

Assess high-risk AI systems for discrimination risks.

Consumer disclosure

Notify consumers when AI is used in consequential decisions.

Risk management

Implement a risk management policy and program for high-risk AI.

​
How DSALTA helps with Colorado AI Act

1

Activate Colorado AI Act

Select the Colorado AI Act from the Frameworks page. DSALTA maps requirements to controls.
2

Review AI controls

Review duty-of-care, assessment, and disclosure controls and assign owners.
3

Collect evidence automatically

Connect integrations to gather supporting evidence.
4

Approve AI policies

Review and approve AI governance and risk management policies.
5

Maintain accountability

Track impact assessments and consumer disclosures.

​
Frequently asked questions

An AI system that makes, or is a substantial factor in making, a consequential decision affecting areas like employment, lending, housing, or healthcare.
Both regulate high-risk AI, but the Colorado Act is narrower and focused on algorithmic discrimination, while the EU AI Act is broader in scope.

​
How DSALTA automates this

DSALTA does not yet map any of its automated checks to the Colorado AI Act. Evidence for this framework is collected through documents, policies, and manual controls; the Compliance Tests catalog covers the frameworks that do have automated coverage.