USA – COLORADO Trends and Developments Contributed by: Daniel Pietragallo and Douglas DePeppe, Buchalter LLP
Examples of companies that are AI developers include providers like Open AI (ChatGPT), Anthropic (Claude), Microsoft (Copilot), or Google (Gemini). However, smaller companies that would otherwise be consid - ered deployers can become developers if they inten - tionally modify an AI system. In such instance, the company would assume all the same obligations as larger developers. Under the law, both developers and deployers of high- risk AI systems have a duty to avoid algorithmic dis - crimination. Developers are required to provide docu - mentation about the risks, benefits, and intended use of each AI system, as well as high-level summaries of training data, documentation regarding governance, safety testing, and impact assessments. Deployers of high-risk AI systems are obligated to conduct impact assessments and implement a risk- management programme that incorporates policies and practices to mitigate the risk of algorithmic dis - crimination. Deployers have a duty to disclose the high-risk AI system to consumers before processing and notify consumers of the right to opt-out. Deploy - ers must also provide an explanation about the nature of automated decision-making and the basis on which the decision was made, including the extent to which the AI contributed to the decision. Requirements for adverse consequential decisions Under the Colorado AI Act, adverse consequential decisions trigger additional consumer rights and corporate obligations, which include the following requirements: • a statement disclosing the principal reason for the consequential decision, including: (a) the degree and manner in which the AI system contributed to the consequential decision; and (b) the type of data processed to make the high- risk decision; • the source of the data processed to make the high- risk decision; • the opportunity to correct any inaccurate personal data; and • the opportunity to appeal an adverse consequen - tial decision with “human review”.
To use one prominent example of a high-risk AI sys - tem, most online job portals implement artificial intel - ligence to scan and sort resumes through an applicant tracking system (ATS). Under the current iteration of the Colorado AI Act, using an ATS to sort resumes would constitute high-risk processing if it is used as a substantial factor in making a consequential decision about an employment opportunity. Because most ATS systems determine which candidates move forward in the selection process and which candidates do not, resume filtering and stack-ranking systems would be considered high-risk. Under this example, each com - pany that uses an AI system to sort resumes would be subject to the high-risk processing requirements of the Colorado AI Act if that system affects Colorado consumers. Because the law applies broadly to companies using AI affecting Colorado consumers, the online nature of business will require compliance from compa - nies located outside of the Rocky Mountain Region. Companies using AI systems to make consequential decisions should carefully consider the benefits and obligations associated with continued high-risk pro - cessing. Risk management frameworks, impact assessments, and enforcement The Colorado AI Act requires each deployer of a high- risk AI system to implement a risk management policy and programme to ensure an iterative process of cor - porate governance. The risk management framework must be appropriate for the size and complexity of the deployer and the nature and scope of the high- risk processing. The law specifically references the National Institute of Standards and Technology (NIST) AI governance framework and International Stand - ards Organization (ISO) 42001 as acceptable AI risk management frameworks and offers an affirmative defence if a company discovers and cures a viola - tion but is otherwise in compliance with one of those frameworks. Businesses looking to mitigate regulatory risk associated with the use of AI systems would be well-served by selecting and implementing one of the approved governance frameworks. The Colorado Attorney General’s rule-making author - ity includes establishing requirements for docu -
573 CHAMBERS.COM
Powered by FlippingBook