Colorado SB26-189 (Automated Decision-Making Technology)

Summary

Regulates Automated Decision-Making Technologies (ADMT) in consequential decisions affecting areas like education, employment, housing, and financial services within Colorado.

Requires developers to document intended uses, limitations, and data categories used for ADMTs.

Mandates deployers to disclose ADMT usage to consumers and provide post-adverse outcome details if a decision materially impacts them.

Empowers the Attorney General to enforce these provisions under the Colorado Consumer Protection Act, with rule-making to clarify disclosure requirements.

Prohibits indemnification clauses for unlawful discrimination resulting from ADMT decisions, aligning with anti-discrimination laws.

Stipulates specific exemptions for certain technologies, including those used for cybersecurity, healthcare compliance, and under federal oversight.

Establishes consumer rights for data correction and requests for human review.

Clarifies that the Act does not create new private rights of action or excuse noncompliance with existing laws.

Effective January 1, 2027, with some provisions effective upon passage.

Defines "adverse outcome" and "automated decision-making technology" (ADMT) in the context of consequential decisions.

Be it enacted by the General Assembly of the State of Colorado:

SECTION 1. In Colorado Revised Statutes, repeal and reenact, with amendments, part 17 of article 1 of title 6 as follows:

PART 17 AUTOMATED DECISION-MAKING TECHNOLOGY IN CONSEQUENTIAL DECISIONS 6-1-1701.

Definitions.

AS USED IN THIS PART 17, UNLESS THE CONTEXT OTHERWISE REQUIRES:

(1) "ADVERSE OUTCOME" MEANS: (a) A DECISION THAT DENIES, TERMINATES, REVOKES, OR MATERIALLY REDUCES OR RESTRICTS A CONSUMER'S ACCESS TO, ELIGIBILITY FOR, SELECTION FOR, COMPENSATION FOR, OR THE PROVISION OF AN OPPORTUNITY OR SERVICE; OR (b) A DECISION THAT RESULTS IN MATERIALLY LESS FAVORABLE DIFFERENTIATED PRICE, COST, COMPENSATION, OR OTHER MATERIAL TERMS THAT ARE REASONABLY LIKELY TO MATERIALLY LIMIT, DELAY, OR EFFECTIVELY DENY, OR OTHER WISE FUND AMENT ALLY ALTER, A CONSUMER'S ACCESS TO, ELIGIBILITY FOR, SELECTION FOR, COMPENSATION FOR, OR THE PROVISION OF AN OPPORTUNITY OR SERVICE COMPARED TO TERMS OFFERED TO SIMILARLY SITUATED CONSUMERS. IF A DECISION OUTCOME IMPOSES MATERIALLY LESS FA VO RAB LE DIFFERENTIATED PRICING OR TERMS, THE DECISION OUTCOME MATERIALLY INFLUENCES PRICE, COST SHARING, COMPENSATION, OR MATERIAL TERMS.

(2) ( a) "AUTOMATED DECISION-MAKING TECHNOLOGY" OR "ADMT" MEANS A TECHNOLOGY THAT PROCESSES PERSONAL DAT A AND USES COMPUTATION TO GENERATE OUTPUT, INCLUDING PREDICTIONS, RECOMMENDATIONS, CLASSIFICATIONS, RANKINGS, SCORES, OR OTHER INFORMATION THAT IS USED TO MAKE, GUIDE, OR ASSIST A DECISION, JUDGMENT, OR DETERMINATION CONCERNING AN INDIVIDUAL. (b) "AUTOMATED DECISION-MAKING TECHNOLOGY" OR "ADMT" DOES NOT INCLUDE: (I) THE FOLLOWING TECHNOLOGIES: (A) ANTI-MALWARE; (B) ANTI-VIRUS; (C) CALCULATORS; (D) DATABASES; (E) DATA STORAGE; (F) FIREWALLS; (G) INTERNET DOMAIN REGISTRATION; (H) INTERNET WEBSITE LOADING; (I) NETWORKING; (J) SPAM- AND ROBOCALL-FILTERING; (K) SPELL-CHECKING; (L) SPREADSHEETS THAT REQUIRE HUMAN ANALYSIS AND DO NOT USE MACHINE LEARNING, FOUNDATION MODELS, OR LARGE LANGUAGE MODELS; (M) WEB CACHING; OR (N) WEB HOSTING; (II) A TOOL USED BY AN INDIVIDUAL SOLELY TO SUMMARIZE, ORGANIZE, TRANSLATE, DRAFT, ROUTE, OR PRESENT INFORMATION FOR HUMAN REVIEW OF ADMINISTRATIVE PROCESSING; OR (III) TECHNOLOGY THAT COMMUNICATES WITH CONSUMERS IN NATURAL LANGUAGE OR OTHER MEANS READILY UNDERSTOOD BY AN AVERAGE CONSUMER FOR THE PURPOSE OF PROVIDING CONSUMERS WITH INFORMATION, MAKING REFERRALS OR RECOMMENDATIONS, ANSWERING QUESTIONS, OR GENERATING OTHER CONTENT, IF: (A) THE TECHNOLOGY IS NOT CONTRACTED, ADVERTISED, MARKETED, CONFIGURED, OR INTENDED BY A PERSON TO BE USED IN A CONSEQUENTIAL DECISION; AND (B) THE TECHNOLOGY IS SUBJECT TO AN ACCEPTABLE USE POLICY THAT PROHIBITS GENERATED CONTENT TO BE USED IN A CONSEQUENTIAL

Defines "consequential decision" excluding low-stakes actions, routine processes, advertising, and cybersecurity-related activities.

(3) (a) "CONSEQUENTIAL DECISION" MEANS: (I) A DECISION, DETERMINATION, OR ACTION MADE ABOUT A CONSUMER THAT RELATES TO THE PROVISION OF OR A CONSUMER'S ACCESS TO, ELIGIBILITY FOR, SELECTION FOR, OR COMPENSATION FOR A COVERED DOMAIN;OR (II) A DECISION, DETERMINATION, OR ACTION ABOUT A CONSUMER THAT RELATES TO A DIFFERENTIATED PRICE, COST SHARING, COMP EN SA TION, OR OTHER MATERIAL TERMS IN A MANNER THAT IS REASONABLY LIKELY TO MATERIALLY LIMIT, DELAY, EFFECTIVELY DENY, OR OTHERWISE FUNDAMENTALLY ALTER THE CONSUMER'S ACCESS, ELIGIBILITY, OR OPPORTUNITY FOR A COVERED DOMAIN.

(b) "CONSEQUENTIAL DECISION" DOES NOT INCLUDE: (I) LOW-ST AKES OR ROUTINE DECISIONS, ACTIONS, AND BUSINESS PROCESSES THAT DO NOT MATERIALLY INFLUENCE ELIGIBILITY FOR, SELECTION FOR, DENIAL OF, COMPENSATION FOR, PRICING OF, OR ACCESS TO AN OPPORTUNITY OR SERVICE FORA COVERED DOMAIN, INCLUDING ROUTINE SCHEDULING, CLASSROOM PERSONALIZATION, ADMINISTRATIVE ROUTING, CUSTOMER SERVICE TRIAGE, COMMUNICATION OF DECISIONS, OR WORKFLOW MANAGEMENT; (II) ADVERTISING, MARKETING, DIFFERENTIATED PRODUCT RECOMMENDATIONS, SEARCH, OR CONTENT MODERATION; (III) SPREADSHEETS THAT REQUIRE MANUAL HUMAN ANALYSIS AND DO NOT USE MACHINE LEARNING, FOUNDATION MODELS, OR LARGE LANGUAGE MODELS; (IV) ACTIONS IN WHICH AN ADMT IS USED TO SUMMARIZE, ORGANIZE, OR PRESENT INFORMATION FOR HUMAN REVIEW AND THE SYSTEM DOES NOT PRODUCE A SCORE, RANKING, RECOMMENDATION, CLASSIFICATION, PREDICTION, OR OTHER INFERENCE THAT MATERIALLY INFLUENCES AN OUTCOME OR A DECISION; (V) NARROW PROCEDURAL TASKS OR DATA-PROCESSING FUNCTIONS THAT DO NOT GENERA TE A PREDICTION OR INFERENCE ABOUT A CONSUMER OR MATERIALLY INFLUENCE A CONSEQUENTIAL DECISION OR CONSEQUENTIAL DECISION PROCESS; (VI) ACTIVITIES RELATING TO TECHNOLOGIES USED FOR CYBERSECURITY, SPAM-AND ROBO-CALL FILTERING, SYSTEM RELIABILITY, AND ANTI-MONEY LAUNDERING AND COUNTER-TERRORIST FINANCING CONTROLS; (VII) ACTIVITIES RELATING TO TECHNOLOGIES USED FOR ECONOMIC SANCTIONS COMPLIANCE, INCLUDING UNDER THE FEDERAL "BANK SECRECY ACT", 12 U.S.C. SEC. 1951 ET SEQ.; THE FEDERAL "USA PATRIOT ACT", PUB.L. 107-56; THE FEDERAL TRADE COMMISSION'S RED FLAGS RULE, 16 CFR 681, AS AMENDED; AND SANCTIONS PROGRAMS ADMINISTERED BY THE UNITED STATES DEPARTMENT OF THE TREASURY, EXCLUDING FACIAL RECOGNITION UNLESS THE SOLE PURPOSE OF WHICH IS TO CONFIRM AN INDIVIDUAL'S IDENTITY; (VIII) ACTIVITIES RELATING TO TECHNOLOGIES USED FOR FRAUD PREVENTION, INCLUDING IDENTITY VERIFICATION, CONSUMER IDENTIFICATION, MONITORING, AND REPORTING CONTROLS REQUIRED UNDER STATE OR FEDERAL LAW; OR (IX) ROUTINE ACADEMIC ADMINISTRATION AND STUDENT SUPPORT PROCESSES THAT DO NOT MATERIALLY INFLUENCE A CONSEQUENTIAL DECISION.

Defines consumer and covers employee and job applicant AI decisions. Specifies covered ADMT and covered domains.

(4) (a) "CONSUMER" HAS THE MEANING SET FORTH IN SECTION 6-1-1303 (6)(a). (b) "CONSUMER" INCLUDES AN EMPLOYEE, A JOB APPLICANT WHO IS A COLORADO RESIDENT, AND ANY INDIVIDUAL WHOSE ACCESS TO, ELIGIBILITY FOR, OR OPPORTUNITY IN COLORADO IS EVALUATED IN A CONSEQUENTIAL DECISION BY A PERSON DOING BUSINESS IN COLORADO.

(5) "COVERED ADMT" MEANS AUTOMATED DECISION-MAKING TECHNOLOGY THAT IS USED TO MATERIALLY INFLUENCE A CONSEQUENTIAL DECISION.

(6) "COVERED DOMAIN" MEANS: (a) AN EDUCATION ENROLLMENT OR AN EDUCATION OPPORTUNITY; (b) EMPLOYMENT ORAN EMPLOYMENT OPPORTUNITY THAT CREATES OR MAY CREATE AN EMPLOYER-EMPLOYEE RELATIONSHIP; (c) THE LEASE OR PURCHASE OF RESIDENTIAL REAL EST A TE IN COLORADO; (d) A FINANCIAL OR LENDING SERVICE; (e) INSURANCE, INCLUDING UNDERWRITING, PRICING, COVERAGE, CLAIMS ADJUDICATION, OR OTHER DETERMINATIONS THAT MATERIALLY AFFECT ACCESS TO BENEFITS; (f) HEALTH-CARE SERVICES; OR (g) ESSENTIAL GOVERNMENT SERVICES AND PUBLIC BENEFITS, INCLUDING ELIGIBILITY AND RENEWAL DETERMINATIONS.

(7) "DEPLOYER" MEANS A PERSON DOING BUSINESS IN COLORADO THAT DEPLOYS A COVERED ADMT.

(8) (a) "DEVELOPER" MEANS A PERSON DOING BUSINESS IN COLORADO THAT: (I) DEVELOPS, OFFERS, SELLS, LEASES, LICENSES, OR OTHERWISE MAKES COMMERCIALLY AVAILABLE A COVERED ADMT; (II) DEVELOPS A COMPONENT THAT IS DESIGNED, MARKETED, INTENDED, DOCUMENTED, ADVERTISED, CONFIGURED, OR CONTRACTED TO BE USED AS PART OF A COVERED ADMT; OR (III) INTENTIONALLY AND SUBSTANTIALLY MODIFIES AN ADMT SUCH THAT IT BECOMES A COVERED ADMT. (b) "DEVELOPER" DOES NOT INCLUDE A PERSON THAT: (I) DEVELOPS AND USES AN ADMT: (A) SOLELY FOR RESEARCH PURPOSES AND THE ADMT IS NOT USED (B) FOR INTERNAL PURPOSES, SUCH AS USE AND DEVELOPMENT ACTIVITIES BY AFFILIATES AND COMMERCIAL SUPPORT FUNCTIONS, AND THAT DOES NOT MAKE THE SYSTEM AVAILABLE TO ANOTHER PERSON FOR USE IN A CONSEQUENTIAL DECISION; (II) IS A PRECEDING DEVELOPER THAT MAKES AN ADMT COMMERCIALLY AVAILABLE AND AN UNAFFILIATED PERSON MODIFIES THE COVERED ADMT IN A MANNER THAT CHANGES THE SYSTEM'S INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED USE; OR (III) HAS DESIGNED, MARKETED, INTENDED, DOCUMENTED, ADVERTISED, CONFIGURED, OR CONTRACTED A COMPONENT THAT IS USED AS PART OF AN ADMT, BUT THE COMPONENT IS INTEGRATED INTO A COVERED ADMT WITHOUT THE ACTUAL KNOWLEDGE OF THE PERSON.

Defines "intentional and substantial modification" as a deliberate change materially altering an ADMT's intended use.

(9) "EMPLOYEE" HAS THE MEANING SET FORTH IN SECTION 8-4-101 (5).

(10) "EMPLOYER" HAS THE MEANING SET FORTH IN SECTION 8-4-101 (6).

(11) "FERPA" MEANS THE FEDERAL "FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT OF 1974", 20 U.S.C. SEC. 1232g ET SEQ., AND ITS IMPLEMENTING REGULATIONS.

(12) "INTENTIONAL AND SUBSTANTIAL MODIFICATION" MEANS A DELIBERATE CHANGE MADE TO AN ADMT THAT RESULTS IN A MATERIAL CHANGE TO THE SYSTEM'S INTENDED, DOCUMENTED, ADVERTISED, CONFIGURED, OR CONTRACTED USE.

(13) (a) "MATERIALLY INFLUENCE" MEANS: (I) AN ADMT OUTPUT IS A NON-DE MINIMIS FACTOR THAT IS USED IN MAKING A CONSEQUENTIAL DECISION; AND (II) AN ADMT OUTPUT AFFECTS THE OUTCOME OF A CONSEQUENTIAL DECISION, INCLUDING BY CONSTRAINING, RANKING, SCORING, RECOMMENDING, CLASSIFYING, OR OTHERWISE MEANINGFULLY ALTERING HOW A CONSEQUENTIAL DECISION IS MADE. (b) "MATERIALLY INFLUENCE" DOES NOT INCLUDE INCIDENT AL, TRIVIAL, OR CLERICAL USES.

(14) (a) "MATERIAL UPDATE" MEANS AN UPDATE, PATCH, RELEASE, REVISION, OR NEW VERSION OF A COVERED ADMT, INCLUDING ASSOCIATED SOFTWARE, MODEL PARAMETERS, DEFAULT SETTINGS, OR DOCUMENTATION, THAT A DEVELOPER KNOWS OR REASONABLY SHOULD KNOW IS LIKELY TO MATERIALLY AFFECT: (I) THE COVERED AD MT'S OUTPUTS OR PERFORMANCE IN A MANNER RELEVANT TO ITS INTENDED USE; OR (II) THE DEVELOPER'S ST A TED INTENDED USE FOR THE COVERED ADMT. (b) "MATERIAL UPDATE" DOES NOT INCLUDE ROUTINE MAINTENANCE, COSMETIC CHANGES, OR BUG FIXES THAT DO NOT MATERIALLY INFLUENCE: (I) A COVERED ADMT'S OUTPUTS OR PERFORMANCE IN A MANNER RELEVANT TO ITS INTENDED USE; OR (II) A DEVELOPER'S STATED INTENDED USE FOR THE COVERED ADMT.

Defines "Meaningful Human Review" as review by a designated individual with authority to override AI decisions.

(15) "MEANINGFUL HUMAN REVIEW" MEANS REVIEW BY A INDIVIDUAL DESIGNATED BY THE DEPLOYER WHO HAS AUTHORITY TO APPROVE, MODIFY, OR OVERRIDE A CONSEQUENTIAL DECISION AND WHO: (a) CONSIDERS RELEVANT, AVAILABLE PRIMARY EVIDENCE; (b) IS TRAINED TO CONDUCT THE REVIEW; (c) DOES NOT DEFAULT TO THE SYSTEM OUTPUT; AND (d) HAS ACCESS TO SUFFICIENT INFORMATION TO UNDERSTAND: (I) THE OUTPUT'S: (A) INTENDED USE; (B) MATERIAL LIMITATIONS; AND (C) CATEGORIES OF INPUTS; AND (II) THE PRINCIPAL FACTORS USED TO GENERATE THE OUTPUT, WITHOUT REQUIRING DISCLOSURE OF PROPRIETARY SOURCE CODE, MODEL WEIGHTS, OR OTHER TRADE SECRETS.

(16) "PERSONAL DATA" HAS THE MEANING SET FORTH IN SECTION 6-1-1303 (17).

(17) "TRADE SECRET" HAS THE MEANING SET FORTH IN SECTION 7-74-102 (4).

Requires developers to provide documentation and updates for AI systems used in consequential decision-making.

6-1-1702. Developer responsibilities - documentation. (1) ON AND AFTER JANUARY 1, 2027, A DEVELOPER SHALL MAKE AVAILABLE TO EACH DEPLOYER OF A COVERED ADMT DEVELOPED BY THE DEVELOPER, IN A FORM AND MANNER THAT IS REASONABLY UNDERSTANDABLE TO A DEPLOYER AND THAT PROTECTS TRADE SECRETS OR INFORMATION PROTECTED FROM DISCLOSURE BY STATE OR FEDERAL LAW: (a) A GENERAL STATEMENT DESCRIBING THE INTENDED USES AND KNOWN HARMFUL OR INAPPROPRIATE USES OF THE COVERED ADMT; (b) A DESCRIPTION OF THE CATEGORIES OF DAT A, INCLUDING PERSONAL DATA, USED TO TRAIN THE COVERED ADMT, TO THE EXTENT KNOWN; (c) KNOWN LIMITATIONS OF THE COVERED ADMT, INCLUDING KNOWN RISKS AND CIRCUMSTANCES IN WHICH THE COVERED ADMT SHOULD NOT BE USED; (d) INSTRUCTIONS FOR THE DEPLOYER'S APPROPRIATE USE, MONITORING, AND MEANINGFUL HUMAN REVIEW, WHERE APPLICABLE; (e) INFORMATION REASONABLY NECESSARY FOR THE DEPLOYER TO COMPLY WITH SECTION 6-1-1704. IF INFORMATION IS WITHHELD, THE DEVELOPER SHALL NOTIFY THE DEPLOYER.

(2) (a) A DEVELOPER SHALL PROVIDE TO EACH DEPLOYER OF A COVERED ADMT DEVELOPED BY THE DEVELOPER A NOTICE OF MATERIAL UPDATES, INTENTIONAL AND SUBSTANTIAL MODIFICATIONS, AND CHANGES TO THE INTENDED USE OF, LIMITATIONS FOR, OR RISK MITIGATION FOR THE COVERED ADMT WITHIN A REASONABLE TIME. (b) A DEVELOPER MAY USE PUBLIC RELEASE NOTES CONT A IN ING THE INFORMATION REQUIRED BY SUBSECTION (2)(a) OF THIS SECTION TO COMPLY WITH THIS SUBSECTION (2) IF THE DEVELOPER PROVIDES DIRECT NOTICE OF THE PUBLIC RELEASE TO EACH DEPLOYER OF THE COVERED ADMT.

(3) A DEVELOPER IS SUBJECT TO THE DISCLOSURE REQUIREMENTS DESCRIBED IN SUBSECTIONS (1) AND (2) OF THIS SECTION ONLY FOR A DEPLOYER'S USE OF A COVERED ADMT WHERE THE ADMT WAS MARKETED, ADVERTISED, CONFIGURED, CONTRACTED, SOLD, OR LICENSED TO BE USED TO MATERIALLY INFLUENCE A CONSEQUENTIAL DECISION.

(4) A DEVELOPER SHALL RETAIN, FOR NOT LESS THAN THREE YEARS AFTER THE CREATION OF A RECORD REQUIRED OR CREATED UNDER THIS SECTION OR FOR A LONGER PERIOD IF REQUIRED BY APPLICABLE ST ATE OR FEDERAL LAW, RECORDS REASONABLY NECESSARY TO DEMONSTRATE COMPLIANCE WITH THIS SECTION. RECORDS INCLUDE SYSTEM VERSION IDENTIFIERS, CHANGE LOGS, AND DOCUMENTATION AND NOTICES OF MATERIAL UPDATES PROVIDED TO DEPLOYERS PURSUANT TO SUBSECTION (2) OF THIS SECTION.

(5) THIS SECTION APPLIES WHEN A DEVELOPER CREATES A COVERED ADMT THAT IS INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED TO BE USED TO MAKE CONSEQUENTIAL DECISIONS OR WHEN THE DEVELOPER BECOMES A WARE THAT THE COVERED ADMT IS BEING USED TO MAKE CONSEQUENTIAL DECISIONS IN A MANNER CONSISTENT WITH THE INTENDED AND CONTRACTED USES.

Requires deployers to retain compliance demonstration records for at least three years after a consequential decision.

6-1-1703. Deployer record keeping.

A DEPLOYER SHALL RETAIN, FOR NOT LESS THAN THREE YEARS AFTER THE DATE OF A CONSEQUENTIAL DECISION OR FOR A LONGER PERIOD IF REQUIRED BY APPLICABLE STATE OR FEDERAL LAW, RECORDS REASONABLY NECESSARY TO DEMONSTRATE COMPLIANCE WITH THIS PART 17. RECORDS MAY INCLUDE, AS APPLICABLE, COVERED ADMT VERSION IDENTIFIERS, CHANGELOGS, AND DOCUMENTATION OF MATERIAL MITIGATION CHANGES.

Requires deployers to disclose ADMT use in consequential decisions and provide access to related information.

6-1-1704. Deployer disclosures - point-of-interaction notice - public posting option - post-adverse outcome disclosures - legislative declaration - trade secrets - compliance with other law - accessibility - rules.

(1) PRIOR TO A DEPLOYER USING A COVERED ADMTTO MATERIALLY INFLUENCE A CONSEQUENTIAL DECISION, THE DEPLOYER SHALL PROVIDE A CLEAR AND CONSPICUOUS NOTICE TO A CONSUMER THAT THE DEPLOYER USED OR WILL USE A COVERED ADMT IN A CONSEQUENTIAL DECISION AFFECTING THE CONSUMER AND INSTRUCTIONS REGARDING HOW THE CONSUMER MAY OBTAIN THE ADDITIONAL INFORMATION DESCRIBED IN THIS SECTION.

(2) A DEPLOYER COMPLIES WITH SUBSECTION (1) OF THIS SECTION BY MAINTAINING A PROMINENT PUBLIC NOTICE THAT IS REASONABLY ACCESSIBLE AT POINTS OF CONSUMER INTERACTION, INCLUDING THROUGH A LINK OR POSTING THAT IS REASONABLY PROXIMATE TO THE INTERACTION OR TRANSACTION IN WHICH A CONSEQUENTIAL DECISION MAY OCCUR.

(3) IF A DEPLOYER USES A COVERED ADMT TO MATERIALLY INFLUENCE A CONSEQUENTIAL DECISION THAT RESULTS IN AN ADVERSE OUTCOME FOR A CONSUMER, THE DEPLOYER SHALL PROVIDE WITHIN THIRTY DAYS AFTER MAKING THE DECISION: (a) A PLAIN LANGUAGE DESCRIPTION OF THE CONSEQUENTIAL DECISION AND THE ROLE THE COVERED ADMT PLAYED IN THE CONSEQUENTIAL DECISION; (b) INSTRUCTIONS AND A SIMPLE-TO-FOLLOW PROCESS TO REQUEST ADDITIONAL INFORMATION ABOUT THE COVERED ADMT AND THE INPUTS, INCLUDING THE NAME OF THE COVERED ADMT, THE COVERED ADMT VERSION NUMBER, IF APPLICABLE, THE COVERED ADMT DEVELOPER, AND THE TYPES, CATEGORIES, AND SOURCES OF PERSONAL DATA USED, TO THE EXTENT THE DEPLOYER RECEIVES THE NECESSARY INFORMATION FROM THE DEVELOPER IN COMPLIANCE WITH SECTION 6-1-1702; AND (c) AN EXPLANATION OF THE CONSUMER RIGHTS DESCRIBED IN SECTION 6-1-1705 AND HOW TO EXERCISE THEM.

Requires the Attorney General to adopt rules for post-adverse outcome disclosures by January 1, 2027.

( 4) (a) THE GENERAL ASSEMBLY F_INDS THAT THE SPECIFIC CONTENT AND FORMAT OF POST-ADVERSE OUTCOME DISCLOSURES MAY VARY ACROSS CONSEQUENTIAL DECISION DOMAINS. THE GENERAL ASSEMBLY INTENDS THAT THE SPECIFIC ELEMENTS OF POST-ADVERSE OUTCOME DISCLOSURES BE FURTHER CLARIFIED THROUGH RULE-MAKING THAT ACCOUNTS FOR SECTOR-SPECIFIC PRACTICES WHILE ENSURING THAT CONSUMERS RECEIVE MEANINGFUL AND UNDERSTAND ABLE INFORMATION ABOUT CONSEQUENTIAL DECISIONS. (b) ON OR BEFORE JANUARY 1, 2027, THE ATTORNEY GENERAL SHALL ADOPT RULES TO CLARIFY AND IMPLEMENT THE POST-ADVERSE OUTCOME DISCLOSURE REQUIREMENTS SET FORTH IN SUBSECTION (3) OF THIS SECTION. RULES ADOPTED PURSUANT TO THIS SUBSECTION (4) MAY INCLUDE, AS APPROPRIATE: (I) RULES CLARIFYING THE CONTENT OF REQUIRED DISCLOSURES RELATED TO THE TYPES, SOURCES, OR CATEGORIES OF PERSONAL DATA THAT A DEPLOYER MUST PROVIDE TO A CONSUMER FOLLOWING AN ADVERSE OUTCOME INVOLVING A COVERED ADMT PURSUANT TO SUBSECTION (3) OF THIS SECTION; (II) SECTOR-SPECIFIC GUIDANCE OR ILLUSTRATIVE EXAMPLES TAILORED TO DIFFERENT COVERED DOMAINS; (III) STANDARDS FOR DESCRIBING THE ROLE OF THE COVERED ADMT IN A CONSEQUENTIAL DECISION IN A MANNER THAT IS REASONABLY UNDERSTANDABLE TO A CONSUMER; AND (IV) GUIDANCE ADDRESSING HOW THE DISCLOSURE REQUIREMENTS DESCRIBED IN THIS SECTION INTERACT WITH FEDERAL OR STATE LAWS THAT REQUIRE OR GOVERN NOTICES, EXPLANATIONS, OR ADVERSE OUTCOME DISCLOSURES.

(5) NOTHING IN THIS SECTION REQUIRES A DEPLOYER TO DISCLOSE A TRADE SECRET OR INFORMATION PROTECTED FROM DISCLOSURE BY STATE OR FEDERAL LAW. IF A DEPLOYER WITHHOLDS INFORMATION PURSUANT TO THIS SUBSECTION (5), THE DEPLOYER SHALL NOTIFY THE CONSUMER.

(6) (a) A CREDITOR, WITH RESPECT TO A CONSEQUENTIAL DECISION INVOLVING THE OFFERING, THE DENIAL, THE PRICING, THE SERVICING, OR OTHER MATERIAL TERMS OF CREDIT, THAT IS REQUIRED TO PROVIDE AND THAT PROVIDES A NOTICE TO A CONSUMER PURSUANT TO THE FEDERAL "EQUAL CREDIT OPPORTUNITY ACT", 15 U.S.C. SEC.1691 ET SEQ., AND ITS IMPLEMENTING REGULATIONS, INCLUDING REGULATION B, 12 CFR 1002, AND, WHEN APPLICABLE, THE FEDERAL "FAIR CREDIT REPORTING ACT", 15 U.S.C. SEC. 1681 ET SEQ., COMPLIES WITH THE NOTICE OR DISCLOSURE REQUIREMENTS OF THIS SECTION THAT RELATE TO THE SAME DECISION OR ADVERSE OUTCOME IF THE NOTICE PROVIDED TO THE CONSUMER PURSUANT TO THE FEDERAL LAWS AND REGULATIONS DESCRIBED IN THIS SUBSECTION (6)(a) ALSO SATISFIES THE NOTICE OR DISCLOSURE REQUIREMENTS OF THIS SECTION. (b) IF A CREDITOR COMPLIES WITH THE FEDERAL LAWS AND REGULATIONS DESCRIBED IN SUBSECTION (6)(a) OF THIS SECTION AND COMPLIES WITH SUBSECTION (6)(a) OF THIS SECTION, THE CREDITOR IS NOT REQUIRED TO PROVIDE A SEPARATE OR DUPLICATIVE NOTICE PURSUANT TO THIS SECTION. (c) NOTHING IN THIS SUBSECTION (6) SHALL BE CONSTRUED TO REQUIRE A CREDITOR TO PROVIDE ANY NOTICE OR DISCLOSURE IN A MANNER THAT IS PROHIBITED BY FEDERAL LAW. (d) FOR PURPOSES OF THIS SUBSECTION (6), A NOTICE THAT COMPLIES WITH THE FEDERAL LAWS AND REGULATIONS DESCRIBED IN SUBSECTION (6)(a) OF THIS SECTION AND COMPLIES WITH SUBSECTION (6)(a) OF THIS SECTION MAY INCLUDE A BRIEF STATEMENT INDICATING THAT A COVERED ADMT WAS USED TO MATERIALLY INFLUENCE THE CONSEQUENTIAL DECISION AND INSTRUCTIONS FOR HOW THE CONSUMER MAY OBTAIN ANY ADDITIONAL INFORMATION OR EXERCISE ANY RIGHTS PROVIDED UNDER THIS PART 17.

Exempts required disclosures when prohibited by law or compromising security, and requires accessibility for disabled consumers.

(7) THIS PART 17 SHALL NOT BE CONSTRUED TO REQUIRE A PERSON TO MAKE A DISCLOSURE, PROVIDE AN EXPLANATION, OR FURNISH INFORMATION TO A CONSUMER TO THE EXTENT DOING SO WOULD BE PROHIBITED BY FEDERAL LAW OR WOULD COMPROMISE THE CONFIDENTIALITY OR INTEGRITY OF CYBERSECURITY, FRAUD PREVENTION, ANTI-MONEY LAUNDERING, COUNTER-TERRORIST FINANCING, OR ECONOMIC SANCTIONS COMPLIANCE PROGRAMS REQUIRED BYLAW.

(8) A DEPLOYER OR DEVELOPER SHALL PROVIDE THE NOTICES AND DISCLOSURES REQUIRED BY THIS PART 17 IN A MANNER THAT IS REASONABLY ACCESSIBLE TO CONSUMERS WITH DISABILITIES AND CONSUMERS WITH LIMITED ENGLISH PROFICIENCY, CONSISTENT WITH APPLICABLE STATE AND FEDERAL LAW.

(9) (a) FOR A CONSEQUENTIAL DECISION RELATING TO EDUCATION, A DEPLOYER THAT IS SUBJECT TO FERP A SATISFIES THE NOTICE AND DISCLOSURE REQUIREMENTS OF THIS SECTION BY PROVIDING NOTICE AND DISCLOSURES THROUGH PROCESSES AND CHANNELS THAT ARE CONSISTENT WITH FERP A AND THE DEPLOYER'S FERP A NOTICES AND STUDENT RECORD ACCESS PROCEDURES, INCLUDING, WHERE APPLICABLE, NOTICE TO A PARENT OR GUARDIAN OR AN ELIGIBLE STUDENT. (b) A DEPLOYER THAT IS SUBJECT TO FERPA IS NOT REQUIRED TO ESTABLISH A SEP ARA TE OR DUPLICATIVE NOTICE OR DISCLOSURE PROCESS IF THE DEPLOYER HAS ESTABLISHED A NOTICE OR DISCLOSURE PROCESS TO COMPLY WITH FERPA.

Requires deployers to provide instructions for data correction and meaningful review of AI-influenced consequential decisions.

6-1-1705. Consumer rights - correction - human review and reconsideration - rules. (1) (a) WHEN A CONSUMER EXPERIENCES AN ADVERSE OUTCOME RES UL TING FROM A CONSEQUENTIAL DECISION IN WHICH A COVERED ADMT MATERIALLY INFLUENCES THE CONSEQUENTIAL DECISION, THE CONSUMER MAY REQUEST AND THE DEPLOYER SHALL PROVIDE IN RESPONSE TO THE REQUEST: (I) INSTRUCTIONS FOR REQUESTING PERSONAL DATA AND CORRECTING FACTUALLY INCORRECT OR MATERIALLY INACCURATE PERSONAL DATA USED IN A CONSEQUENTIAL DECISION THAT USED A COVERED ADMT CONSISTENT WITH SECTION 6-1-1306; AND (II) AN OPPORTUNITY FOR MEANINGFUL HUMAN REVIEW AND RECONSIDERATION OF THE CONSEQUENTIAL DECISION, TO THE EXTENT COMMERCIALLY REASONABLE. (b) FOR THE PURPOSES OF THIS SUBSECTION (1), THE EXCEPTIONS TO THE DEFINITION OF "CONSUMER" IN SECTION 6-1-1303 (6)(b) AND THE EXCEPTIONS IN SECTION 6-1-1304 (2)(k), (2)(n), AND (2)( o) DO NOT APPLY TO THE RIGHT TO REQUEST CORRECTION OF FACTUALLY INCORRECT OR MATERIALLY INACCURATE PERSONAL DATA PURSUANT TO THIS SUBSECTION (1). (c) SUBSECTION (l)(a) OF THIS SECTION DOES NOT REQUIRE CORRECTION OF OPINIONS, PREDICTIONS, SCORES, OR PROTECTED EVALUATIONS.

(2) (a) FOR A CONSEQUENTIAL DECISION RELATING TO EDUCATION, A DEPLOYER THAT IS SUBJECT TO FERP A COMPLIES WITH THE REQUIREMENTS OF SUBSECTION (1) OF THIS SECTION THROUGH THE DEPLOYER'S EXISTING STUDENT RECORD INSPECTION, REVIEW, AND AMENDMENT PROCEDURES AND ANY APPLICABLE DISTRICT COMPLAINT OR APPEAL PROCESS, IF THE DEPLOYER OFFERS A REASONABLE MECHANISM FOR A PARENT, GUARDIAN, OR ELIGIBLE STUDENT TO REQUEST CORRECTION OF MATERIALLY INACCURATE PERSONAL DATA AND RECONSIDERATION WHERE APPLICABLE UNDER THIS PART 17. (b) A DEPLOYER THAT IS SUBJECT TO FERPA IS NOT REQUIRED TO ESTABLISH A SEPARATE OR DUPLICATIVE CORRECTION OR HUMAN REVIEW AND RECONSIDERATION PROCESS IF THE DEPLOYER HAS ESTABLISHED A CORRECTION OR HUMAN REVIEW AND RECONSIDERATION PROCESS TO COMPLY WITH FERP A. (3) ON OR BEFORE JANUARY 1, 2027, THE ATTORNEY GENERAL SHALL ADOPT RULES TO CLARIFY AND IMPLEMENT THE REQUIREMENTS OF THIS SECTION.

Authorizes the Colorado Attorney General to exclusively enforce AI-related violations under the Colorado Consumer Protection Act.

6-1-1706. Enforcement by the attorney general - deceptive trade practice - right to cure - no private right of action - joinder rules - reporting - repeal.

(1) (a) THE ATTORNEY GENERAL SHALL ENFORCE THIS PART 17 THROUGH THE "COLORADO CONSUMER PROTECTION ACT", THIS ARTICLE 1. (b) VIOLATIONS OF THE DISCLOSURE REQUIREMENTS AND CONSUMER RIGHTS DESCRIBED IN SECTIONS 6-1-1702, 6-1-1703, 6-1-1704, AND 6-1-1705 ARE ENFORCEABLE EXCLUSIVELY BY THE ATTORNEY GENERAL WITHOUT REGARD TO ANY OTHER PROVISION IN THIS TITLE 6.

(2) (a) A VIOLATION OF THIS PART 17 IS A DECEPTIVE TRADE PRACTICE AND IS SUBJECT TO THE PROVISIONS OF THE "COLORADO CONSUMER PROTECTION ACT", THIS ARTICLE 1. (b) ANY PROVISION OF THE "COLORADO CONSUMER PROTECTION ACT", THIS ARTICLE 1, THAT IS INCONSISTENT WITH THE EXCLUSIVE ENFORCEMENT AUTHORITY GRANTED TO THE ATTORNEY GENERAL IN THIS SECTION FOR A VIOLATION OF THIS PART 17 DOES NOT APPLY TO ANY SUCH VIOLATION.

(3) (a) PRIOR TO ANY ENFORCEMENT ACTION FOR A VIOLATION OF THIS PART 17, THE ATTORNEY GENERAL SHALL ISSUE A NOTICE OF VIOLATION TO A DEVELOPER OR DEPLOYER IF A CURE IS DEEMED POSSIBLE BY THE ATTORNEY GENERAL. (b) IF THE DEVELOPER OR DEPLOYER FAILS TO CURE A VIOLATION WITHIN SIXTY DAYS AFTER RECEIPT OF A NOTICE OF VIOLATION, THE ATTORNEY GENERAL MAY BRING AN ACTION PURSUANT TO THIS SECTION. (c) IF THE ATTORNEY GENERAL FINDS AND CAN DEMONSTRATE THAT A DEVELOPER OR DEPLOYER KNOWINGLY VIOLATED THIS PART 17 OR A DEVELOPER OR DEPLOYER REPEATEDLY VIOLATED THIS PART 17, THE ATTORNEY GENERAL IS NOT REQUIRED TO PROVIDE A CURE PERIOD BEFORE SEEKING PENALTIES OR OTHER RELIEF. (d) IF A VIOLATION IS DISCOVERED IN THE COURSE OF AN ENFORCEMENT ACTION, A COURT MAY CONSIDER THAT A DEVELOPER OR DEPLOYER CURED THE VIOLATION WITHIN SIXTY DAYS AFTER RECEIPT OF WRITTEN NOTICE AS A MITIGATING FACTOR IN DETERMINING CIVIL PENAL TIES OR OTHER MONETARY RELIEF, IF ANY. (e) BEGINNING IN JANUARY 2028, AND IN JANUARY EVERY YEAR THEREAFTER, THE ATTORNEY GENERAL SHALL INCLUDE, AS PART OF THE DEPARTMENT OF LAW’S PRESENTATION DURING ITS “SMART ACT” HEARING REQUIRED BY SECTION 2-7-203, A REPORT CONCERNING ENFORCEMENT ACTIONS BROUGHT AND CURE PERIODS OFFERED BY THE ATTORNEY GENERAL RELATED TO VIOLATIONS OF THIS PART 17, INCLUDING: (I) THE NUMBER OF ACTIONS FILED BY THE ATTORNEY GENERAL AGAINST DEVELOPERS AND DEPLOYERS, RESPECTIVELY; (II) THE NUMBER OF ACTIONS FILED BY THE ATTORNEY GENERAL AGAINST DEVELOPERS AND DEPLOYERS, RESPECTIVELY, THAT WERE COMPLETED; (III) THE NUMBER OF CURE PERIODS OFFERED BY THE ATTORNEY GENERAL TO DEVELOPERS AND DEPLOYERS, RESPECTIVELY; (IV) THE NUMBER OF CURE PERIODS OFFERED BY THE ATTORNEY GENERAL THAT WERE NOT MET BY DEVELOPERS AND DEPLOYERS, RESPECTIVELY; AND (V) THE NUMBER OF VIOLATIONS FILED BY THE ATTORNEY GENERAL AGAINST DEVELOPERS AND DEPLOYERS, RESPECTIVELY, WHERE A CURE PERIOD WAS NOT DEEMED POSSIBLE. (f) THIS SUBSECTION (3) IS REPEALED, EFFECTIVE JANUARY 1, 2030.

Allows the Attorney General to adopt rules for implementing and clarifying "materially influence" definition and stakeholder engagement.

(4) NOTHING IN THIS PART 17 CREATES A NEW PRIVATE RIGHT OF ACTION. NOTHING IN THIS PART 17 LIMITS OR REDUCES ANY EXISTING RIGHTS OR REMEDIES AVAILABLE UNDER STATE OR FEDERAL LAW, INCLUDING THE "COLORADO ANTI-DISCRIMINATION ACT", PARTS 3 TO 8 OF ARTICLE 34 OF TITLE 24; THE "COLORADO CONSUMER PROTECTION ACT", THIS ARTICLE 1; PRODUCT LIABILITY LAW; OR OTHER APPLICABLE LAW.

(5) (a) THE ATTORNEY GENERAL MAY ADOPT RULES AS NECESSARY TO IMPLEMENT AND CLARIFY THIS PART 17. (b) THE ATTORNEY GENERAL MAY ADOPT RULES TO CLARIFY THE APPLICATION OF THE DEFINITION OF "MATERIALLY INFLUENCE", AS DEFINED IN SECTION 6-1-1701 (13), INCLUDING PRESUMPTIONS, ILLUSTRATIVE EXAMPLES, AND OBJECTIVE INDICATORS. (c) IN ADOPTING RULES PURSUANT TO THIS PART 17, THE ATTORNEY GENERAL SHALL UTILIZE A PROCESS THAT MEANINGFULLY ENGAGES STAKEHOLDERS, INCLUDING CONSUMER ADVOCATES, DEPLOYERS, DEVELOPERS, AND SECTOR REGULA TORS, THROUGH PUBLIC NOTICE, OPPORTUNITY FOR WRITTEN COMMENT, AND AT LEAST ONE PUBLIC HEARING AND SHALL ADOPT RULES IN ACCORDANCE WITH SECTION 24-4-103.

(6) NOTHING IN THIS PART 17 LIMITS THE ABILITY OF A PARTY TO JOIN NECESSARY OR PERMISSIVE PARTIES UNDER THE COLORADO RULES OF CIVIL PROCEDURE, INCLUDING RULES 19 AND 20 OF THE COLORADO RULES OF CIVIL PROCEDURE, IN ANY ACTION ARISING UNDER EXISTING LAW.

Holds developers or deployers liable for discrimination if AI materially influences decisions under state laws.

6-1-1707. Liability - fault - allocation - no joint and several liability - indemnification prohibited - effect on existing law.

(1) A DEVELOPER OR DEPLOYER MAY BE HELD LIABLE IN AN ACTION ALLEGING UNLAWFUL DISCRIMINATION UNDER STATE ANTI-DISCRIMINATION LAWS, INCLUDING THE "COLORADO ANTI-DISCRIMINATION ACT", PARTS 3 TO 8 OF ARTICLE 34 OF TITLE 24, ARISING FROM A CONSEQUENTIAL DECISION MATERIALLY INFLUENCED BY A COVERED ADMT.

(2) IN AN ACTION DESCRIBED IN SUBSECTION (1) OF THIS SECTION, FAULT SHALL BE ALLOCATED AMONG DEPLOYERS AND DEVELOPERS BASED ON THEIR RELATIVE FAULT FOR THE VIOLATION.

(3) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO APPORTION LIABILITY TO A CLAIMANT WHERE SUCH APPORTIONMENT IS NOT PROVIDED FOR UNDER EXISTING LAW.

(4) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO CREATE JOINT AND SEVERAL LIABILITY, EXCEPT TO THE EXTENT PERMITTED UNDER EXISTING LAW.

(5) (a) A DEVELOPER IS LIABLE IN AN ACTION DESCRIBED IN SUBSECTION (1) OF THIS SECTION ONLY TO THE EXTENT THAT: (I) THE DEVELOPER'S COVERED ADMT WAS USED BY A DEPLOYER IN A MANNER THAT WAS INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED FOR BY THE DEVELOPER; AND (II) THE DEVELOPER'S COVERED ADMT MATERIALLY INFLUENCED A CONSEQUENTIAL DECISION THAT GA VE RISE TO THE VIOLATION OF EXISTING LAW. (b) A DEVELOPER IS NOT LIABLE UNDER THIS SECTION FOR VIOLATIONS OF EXISTING LAW ARISING FROM A DEPLOYER'S USE OF A COVERED ADMT IN A MANNER THAT WAS NOT INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED FOR BY THE DEVELOPER.

(6) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO LIMIT THE LIABILITY OF A DEPLOYER FOR THE DEPLOYER'S INDEPENDENT ACTS OR OMISSIONS IN A CONSEQUENTIAL DECISION MATERIALLY INFLUENCED BY A COVERED ADMT ,INCLUDING USING AN ADMT IN A MANNER THAT WAS NOT INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED FOR BY THE DEVELOPER IF THE DEVELOPER OF THE COVERED ADMT COMPLIED WITH SECTION 6-1-1702.

Declares indemnity contracts void if they shield liability from discriminatory use of automated decision-making technology.

(7) (a) NOTWITHSTANDING ANY OTHER PROVISION OF LAW, IF A PROVISION OF A CONTRACT FOR THE USE OF AUTOMATED DECISION-MAKING TECHNOLOGY IN MAKING A CONSEQUENTIAL DECISION OR ANY OTHER CONTRACT BETWEEN A DEVELOPER AND DEPLOYER PURPORTS TO INDEMNIFY, DEFEND, OR HOLD HARMLESS OR HAS THE EFFECT OF INDEMNIFYING, DEFENDING, OR HOLDING HARMLESS THE INDEMNITEE FROM OR AGAINST ANY LIABILITY FOR DAMAGES PURSUANT TO THIS SECTION RESULTING FROM THE DEVELOPER'S OR DEPLOYER'S OWN ACTS OR OMISSIONS RELATED TO THE USE OF AUTOMATED DECISION-MAKING TECHNOLOGY IN MAKING CONSEQUENTIAL DECISIONS IN VIOLATION OF THE "COLORADO ANTI-DISCRIMINATION ACT", PARTS 3 TO 8 OF ARTICLE 34 OF TITLE 24, OR OTHER COLORADO ANTI-DISCRIMINATION LAW, THE PROVISION IS CONTRARY TO PUBLIC POLICY AND VOID. (b) THE LIMITATIONS OF SUBSECTION (7)(a) OF THIS SECTION DO NOT APPLY TO A DEVELOPER WHERE THE USE OF THE COVERED ADMT IN MAKING A CONSEQUENTIAL DECISION WAS NOT INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED FOR BY THE DEVELOPER IF THE DEVELOPER OF THE COVERED ADMT COMPLIED WITH SECTION 6-1-1702. (c) THIS SUBSECTION (7) DOES NOT OTHER WISE LIMIT THE ENFORCEABILITY OF CONTRACT TERMS BETWEEN PARTIES ACTING IN A COMMERCIAL OR BUSINESS CAPACITY, EXCEPT TO THE EXTENT OTHERWISE PROVIDED BY APPLICABLE LAW. (d) THIS SUBSECTION (7) DOES NOT PROHIBIT OR LIMIT ANY PERSON FROM OBTAINING OR MAKING A CLAIM ON APPLICABLE INSURANCE FOR ANY APPLICABLE ALLEGED LIABILITIES OR RELATED LOSSES.

(8) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO LIMIT, DISPLACE, OR OTHER WISE AFFECT ANY LIABILITY THAT A DEVELOPER OR A DEPLOYER MAY HA VE, SEP ARA TE AND APART FROM LIABILITY UNDER THIS SECTION, FOR A VIOLATION OF STATE LAW. COMPLIANCE WITH THE REQUIREMENTS OF THIS PART 17 IS NOT A DEFENSE TO AND DOES NOT OTHERWISE EXCUSE NONCOMPLIANCE WITH ANY APPLICABLE LAW.

(9) THE USE OF AN ADMT IN A CONSEQUENTIAL DECISION DOES NOT EXCUSE, JUSTIFY, OR PROVIDE A DEFENSE TO ANY OBLIGATION OR LIABILITY UNDER STATE OR FEDERAL LAW, INCLUDING OBLIGATIONS AND LIABILITY RELATED TO DISCRIMINATION OR CONSUMER PROTECTION.

Requires insurers to disclose the use of advanced technologies materially influencing consequential insurance decisions.

6-1-1708. Compliance with other legal obligations - insurers - covered entities - disclosures.

(1) (a) AN INSURER, AS DEFINED IN SECTION 10-1-102 (13), AND AFFILIATED ENTITIES THAT ARE SUBJECT TO THE REQUIREMENTS OF SECTION 10-3-1104.9 ARE IN COMPLIANCE WITH THIS PART 17 IN THE PRACTICE OF INSURANCE. (b) IF AN INSURER IS NOT DEEMED IN COMPLIANCE PURSUANT TO SUBSECTION (l)(a) OF THIS SECTION, THE INSURER SHALL PROVIDE NOTICE AND DISCLOSURE OF ITS USE OF A COVERED ADMT IN MATERIALLY INFLUENCING A CONSEQUENTIAL DECISION REGARDING THE PRACTICE OF INSURANCE PURSUANT TO THE DISCLOSURE REQUIREMENTS OF SECTION 6-1-1704 (3), TO THE EXTENT APPLICABLE.

(2) THIS SECTION DOES NOT LIMIT THE APPLICABILITY OF THIS PART 17 TO USES OF COVERED ADMT RELATED TO INSURER EMPLOYMENT OR INSURER EMPLOYMENT OPPORTUNITIES BY INSURERS AND AFFILIATED ENTITIES THAT ARE SUBJECT TO THE REQUIREMENTS OF SECTION 10-3-1104.9.

(3) (a) SECTIONS 6-1-1701, 6-1-1702, 6-1-1703, 6-1-1704, 6-1-1705, AND 6-1-1706 DO NOT APPLY TO A COVERED ENTITY WITHIN THE MEANING OF THE FEDERAL "HEAL TH INSURANCE PORT ABILITY AND ACCOUNT ABILITY ACT OF 1996", 42 U.S.C. SECS. 1320d TO 1320d-9, AND THE REGULATIONS PROMULGATED UNDER THE FEDERAL ACT, OR A COVERED ENTITY'S BUSINESS AS SOCIA TES FOR ANY SERVICES RENDERED TO A COVERED ENTITY, TO THE EXTENT THE COVERED ENTITY IS DOING BUSINESS IN COLORADO, EXCEPT FOR A CONSEQUENTIAL DECISION RELATED TO EMPLOYMENT OR AN EMPLOYMENT OPPORTUNITY. (b) NOTWITHSTANDING SUBSECTION (3)(a) OF THIS SECTION, FOR A COVERED ENTITY THAT IS A HEALTH-CARE PROVIDER, AS DEFINED IN 45 CFR 160 .103, THIS SUBSECTION (3) APPLIES ONLY IF THE HEAL TH-CARE PROVIDER IS OPERA TING FROM A LOCATION WITHIN COLORADO. (c) A COVERED ENTITY SHALL PROVIDE PATIENTS WITH A GENERAL NOTICE OF USE OF ADVANCED TECHNOLOGIES, INCLUDING A COVERED ADMT. THE NOTICE MAY BE INCORPORATED WITH OTHER NOTICES DESCRIBING PATIENT RIGHTS AND HOW THE COVERED ENTITY PROVIDES CARE. (d) NOTWITHSTANDING SUBSECTION (3)(a) OF THIS SECTION, A COVERED ENTITY THAT USES A COVERED ADMTTO DETERMINE A PATIENT'S ELIGIBILITY FOR FINANCIAL ASSISTANCE, INCLUDING DISCOUNTED CARE AS DESCRIBED IN SECTION 25.5-3-502, SHALL PROVIDE A PATIENT THE FOLLOWING DISCLOSURES: (I) A PLAIN LANGUAGE DESCRIPTION OF THE CONSEQUENTIAL DECISION AND THE ROLE OF THE COVERED ADMT IN THE CONSEQUENTIAL DECISION; (II) THE TYPES OF INFORMATION ABOUT THE INDIVIDUAL THE COVERED ENTITY RELIED UPON IN MAKING ITS DETERMINATION OF ELIGIBILITY, EXCEPT FOR TRADE SECRETS AND OTHER CONFIDENTIAL OR LEGALLY PROTECTED INFORMATION; (III) INFORMATION ON HOW TO REQUEST CORRECTION OF MATERIALLY INACCURATE PERSONAL DAT A HELD BY THE COVERED ENTITY CONSISTENT WITH THE FEDERAL "HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996", 42 U.S.C. SECS. 1320d TO 1320d-9 AND SECTION 25.5-3-502; AND (IV) INFORMATION ON HOW TO REQUEST MEANINGFUL HUMAN REVIEW OR RECONSIDERATION, WHERE APPLICABLE. (e) A COVERED ENTITY MAY COMPLY WITH SUBSECTION (3)(d) OF THIS SECTION THROUGH EITHER AN ADVANCE GENERAL DISCLOSURE OF THE INFORMATION REQUIRED BY SUBSECTION (3)(d) OF THIS SECTION OR THROUGH A NOTICE PROVIDED WITHIN THIRTY CALENDAR DAYS AFTER AN ADVERSE OUTCOME. THIS SECTION DOES NOT CREATE A SEPARATE AND DUPLICATIVE DISCLOSURE PROCESS OR APPEAL PROCESS IF THE REVIEW OPPORTUNITIES AND INFORMATION DESCRIBED IN SUBSECTION (3)( d) OF THIS SECTION ARE PROVIDED.

Exempts FDA-regulated medical devices from certain sections. Mandates compliance with federal health privacy and nonpublic personal information laws.

(4) SECTIONS 6-1-1701, 6-1-1702, 6-1-1703, 6-1-1704, 6-1-1705, AND 6-1-1706 DO NOT APPLY TO A MEDICAL DEVICE SUBJECT TO OVERSIGHT BY THE UNITED STATES FOOD AND DRUG ADMINISTRATION OR A PHARMACEUTICAL OR MEDICAL DEVICE MANUFACTURER'S RESEARCH AND DEVELOPMENT ACTIVITIES THAT ARE SUBJECT TO OVERSIGHT BY THE UNITED STATES FOOD AND DRUG ADMINISTRATION, INCLUDING CLINICAL INVESTIGATIONS CONDUCTED UNDER 21 CFR 312.

(5) NOTHING IN THIS PART 17 REQUIRES A COVERED ENTITY OR BUSINESS ASSOCIATE, AS THOSE TERMS ARE DEFINED UNDER THE FEDERAL "HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996", 42 U.S.C. SECS. 1320d TO 1320d-9, TO DISCLOSE PROTECTED HEALTH INFORMATION OR OTHER INFORMATION IN A MANNER THAT WOULD VIOLATE FEDERAL LAW. TO THE EXTENT COMPLIANCE WITH SECTION 6-1-1704 OR 6-1-1705 WOULD CONFLICT WITH FEDERAL HEALTH PRIVACY REQUIREMENTS, THE DEPLOYER SHALL COMPLY WITH APPLICABLE FEDERAL LAW AND PROVIDE DISCLOSURES AND ACCESS CONSISTENT WITH THAT LAW.

(6) THIS PART 17 DOES NOT REQUIRE A PERSON TO DISCLOSE NONPUBLIC PERSONAL INFORMATION IN A MANNER THAT WOULD VIOLATE THE FEDERAL "GRAMM-LEACH-BLILEY ACT", 15 U.S.C. SEC. 6801 ET SEQ., OR ITS IMPLEMENTING REGULATIONS.

Specifies that compliance with Part 17 neither creates new rights nor excuses noncompliance with other laws.

6-1-1709. No new private right of action - application of other law.

(1) NOTHING IN THIS PART 17 CREATES A NEW PRIVATE RIGHT OF ACTION.

(2) COMPLIANCE WITH THIS PART 17 DOES NOT CONSTITUTE A DEFENSE TO AND DOES NOT EXCUSE NONCOMPLIANCE WITH ANY APPLICABLE LAW.

Requires the Commissioner to potentially adopt or update rules on notices and disclosures from insurers to consumers.

SECTION 2. In Colorado Revised Statutes, 6-1-105, add ( 1 )(uuuu) as follows:

6-1-105. Unfair or deceptive trade practices.

(1) A person engages in a deceptive trade practice when, in the course of the person's business, vocation, or occupation, the person: (uuuu) VIOLATES PART 17 OF THIS ARTICLE I.

SECTION 3. In Colorado Revised Statutes, 10-3-1104.9, add (3)( e) as follows:

10-3-1104.9. Insurers' use of external consumer data and information sources, algorithms, and predictive models - unfair discrimination prohibited - rules - stakeholder process required - investigations - definitions.

(3) (e) THE COMMISSIONER MAY ADOPT NEW RULES OR UPDATE EXISTING RULES REGARDING NOTICE AND DISCLOSURES FROM INSURERS TO CONSUMERS.

Appropriates $46,190 to the Department of Law for consumer protection, antitrust, and civil rights purposes.

SECTION 4. Appropriation. For the 2026-27 state fiscal year, $46, 190 is appropriated to the department oflaw. This appropriation is from the general fund and is based on an assumption that the department will require an additional 0.4 FTE. To implement this act, the department may use this appropriation for consumer protection, antitrust, and civil rights.

SECTION 5. Effective date - applicability. (1) Except as otherwise provided in subsection (2) of this section, this act takes effect January 1, 2027.

(2) Sections 6-1-1704 ( 4 ), 6-1-1705 (3 ), and 6-1-1706 ( 6), Colorado Revised Statutes, as amended in section 1 of this act, section 10-3-1104.9 (3 )( e ), Colorado Revised Statutes, as enacted in section 3 of this act, section 4 of this act, this section, and section 6 of this act take effect upon passage.

(3) This act applies to consequential decisions made on or after January 1, 2027.

SECTION 6. Safety clause. The general assembly finds, determines, and declares that this act is necessary for the immediate preservation of the public peace, health, or safety or for appropriations for the support and maintenance of the departments of the state and state institutions.