Colorado AI Act: Developer Duties
Developer Duties [C.R.S. § 6-1-1702]
Citation: § 6-1-1702 (developer duties), Section 6-1-1702
Q: What must AI developers do under the Colorado AI Act? A: Developers must use reasonable care to avoid algorithmic discrimination, provide documentation to deployers, publish public statements, and notify the AG within 90 days of discovering discrimination [§ 6-1-1702].
Key rule (§ 6-1-1702): Developers of high-risk AI systems must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination.
Rule: Developers have documentation, disclosure, and notification obligations when they develop or substantially modify high-risk AI systems.
Core Duty: Reasonable Care [§ 6-1-1702(1)]
A developer of a high-risk artificial intelligence system shall use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination.
Rebuttable presumption: A developer is presumed to have used reasonable care if they comply with § 6-1-1702 requirements.
Documentation for Deployers [§ 6-1-1702(2)]
Developers must provide deployers with:
General Statement
| Required Content | Description |
|---|---|
| Reasonably foreseeable uses | What the AI is intended to do |
| Known harmful uses | Uses that could cause harm |
| Known inappropriate uses | Uses the AI shouldn’t be put to |
Technical Documentation
| Required Content | Description |
|---|---|
| Training data summary | High-level description of data types |
| Known limitations | Technical and performance limits |
| Algorithmic discrimination risks | Known or foreseeable discrimination risks |
| Purpose of the system | What problem it solves |
| Intended benefits | Expected positive outcomes |
Evaluation Documentation
| Required Content | Description |
|---|---|
| Performance evaluation | How the system was tested |
| Discrimination mitigation | How risks were reduced before deployment |
| Data governance measures | How training data was managed |
| Intended outputs | What the system produces |
| Monitoring guidance | How to monitor in production |
Impact Assessment Support [§ 6-1-1702(3)]
Developers must provide documentation necessary for deployers to complete impact assessments, such as:
- Model cards — standardized documentation of model capabilities and limitations
- Dataset cards — documentation of training data characteristics
- Impact assessments — pre-built assessments deployers can use
Public Disclosures [§ 6-1-1702(4)]
Developers must publish on their website or in a public use case inventory:
- Types of high-risk AI systems they currently make available
- How they manage known or foreseeable algorithmic discrimination risks
AG Notification Requirement [§ 6-1-1702(5)]
Developers must notify the Colorado Attorney General and all known deployers of any algorithmic discrimination within 90 days.
Triggers for notification:
- Testing reveals the system caused or is likely to cause discrimination
- Credible report received from a deployer
| Notification Timeline | Requirement |
|---|---|
| Discovery of discrimination | Start 90-day clock |
| Within 90 days | Notify AG + all known deployers |
| Unreasonable delay | Violation |
AG Documentation Requests [§ 6-1-1702(7)]
- AG may request documentation; developers must provide within 90 days
- Documentation is not subject to Colorado Open Records Act
- Developers may designate information as proprietary or trade secret
- Attorney-client privilege is preserved
Developer Checklist
Before deploying or substantially modifying a high-risk AI system:
- Document training data at high level
- Document known limitations and risks
- Document discrimination mitigation measures
- Create documentation for deployers (model cards, etc.)
- Publish public statement on website
- Establish process for 90-day AG notification