Colorado Introduces AI Legislation: May Create Significant Burden for Employers Using AI Tools
Colorado Senate Bill 24-205 ("SB205") introduces statutory tort liability ( laws that govern the rights of victims to pursue legal claims against tortfeasors. When a victim is harmed or suffers damages, the victim can pursue a claim in civil court under tort laws.)
If enacted, the bill would require employers using "high-risk" AI tools to implement risk management policies, conduct impact assessments, and provide detailed notices by February 1, 2026.
The bill defines "high-risk" (if the AI either "makes," or is a "substantial factor" in making, "a decision that has a material legal or similarly significant effect on the provision, denial, cost or terms" of any of the following: education, finance, health-care, housing, insurance, legal services, essential government services, and critically, hiring and employment in general.
Compliance with this bill will place burden on any employer doing business in Colorado to identify "differential treatment or impact" on a broad list of protected categories.
Notice Requirements and Individual Rights
SB205 requires extensive and comprehensive notices to individuals about the use of high-risk AI tools. These notices must come in two forms—one published on the business’s publicly available website and one provided “directly” to Colorado residents. Deployers must provide an additional notice to Colorado residents who are subject to a consequential adverse decision, such as denial of employment, made by or with the assistance of an AI tool.
Developers and Deployers must publish, online, a summary of the “high-risk” AI tools that they have developed or deployed, respectively, and how they “manage "known or reasonably foreseeable” risks of algorithmic discrimination. Deployers must also publish “in detail, the nature, source, and extent of the information collected and used” by them (presumably with respect to AI tool inputs and use).
Of greater business impact is SB205’s requirement that Deployers notify each Coloradan subject to the use of a “high-risk” AI tool that will be a substantial factor in making a consequential decision about the individual. The notice must also include:
- the purpose of the AI tool, and a plain-language description of the tool;
- the nature of the underlying “consequential decision” being made by the AI tool;
- Colorado residents’ right to opt out of any “profiling in furtherance of decisions that produce legal or similarly significant effects”;
- the Deployer’s contact information; and
- instructions on how to access the online summary of “high-risk” AI tool use posted on the Deployer’s website.
The right to opt out of profiling derives from the Colorado Privacy Act, which defines “profiling,” as applied to the employment context, as the use of an AI tool to evaluate, analyze, or predict aspects of a Colorado resident’s health, reliability, behaviors, location or movement.
SB205 requires extensive and comprehensive notices to individuals about the use of high-risk AI tools. These notices must come in two forms—one published on the business’s publicly available website and one provided “directly” to Colorado residents. Deployers must provide an additional notice to Colorado residents who are subject to a consequential adverse decision, such as denial of employment, made by or with the assistance of an AI tool.
Developers and Deployers must publish, online, a summary of the “high-risk” AI tools that they have developed or deployed, respectively, and how they “manage known or reasonably foreseeable” risks of algorithmic discrimination (any condition in which an AI System materially increases the risk of an unlawful differential treatment or impact that disfavors an individual or group of individuals on the basis of their actual or perceived age, color, disability, ethnicity, genetic information, limited proficiency in the English language, national origin, race, religion, reproductive health, sex veteran status, or other classification protected under the laws of the State of Colorado" . Deployers must also publish “in detail, the nature, source, and extent of the information collected and used” by them (presumably with respect to AI tool inputs and use).
Of greater business impact is SB205’s requirement that Deployers notify each Coloradan subject to the use of a “high-risk” AI tool that will be a substantial factor in making a consequential decision about the individual. The notice must also include:
- the purpose of the AI tool, and a plain-language description of the tool;
- the nature of the underlying “consequential decision” being made by the AI tool;
- Colorado residents’ right to opt out of any “profiling in furtherance of decisions that produce legal or similarly significant effects”;
- the Deployer’s contact information; and
- instructions on how to access the online summary of “high-risk” AI tool use posted on the Deployer’s website.
The right to opt out of profiling derives from the Colorado Privacy Act, which defines “profiling,” as applied to the employment context, as the use of an AI tool to evaluate, analyze, or predict aspects of a Colorado resident’s health, reliability, behaviors, location or movement.
SB205’s greatest business impact may be the requirement that Deployers provide notice if the “consequential decision” being made is adverse to an individual. In this adverse action notice, the Deployer must explain in some detail (a) the reasons for the adverse decision, (b) the impact of the AI tool on the decision, (c) the data used by the tool in making (or assisting with) the decision, and (d) the sources of those data. The Deployer must then provide the individual both an opportunity to “correct any incorrect personal data” that was used by the AI tool and an opportunity to appeal the adverse decision—including, “if technically feasible,” human review of the decision. This notice-and-appeal process could potentially eliminate all of the speed and efficiency gains that, in part, make AI tools worthwhile to invest in, develop, and adopt.
SB205 requires that all these statements and notices be provided “in all languages” used by the Deployer “in the ordinary course of the Deployer’s business,” and in a format that is accessible to those with a disability.
Source(s): Littler, received on May 16, 2024; www.forbes.com, accessed on May 21, 2024; Colorado SB 205, accessed on May 21, 2024