Colorado has introduced several laws aimed at regulating the use of AI, including SB169 which prohibits discrimination in insurance practices, SB205 which provides consumer protections against algorithmic discrimination resulting from AI, HB1147 which addresses the use of deepfake content in electoral communications, and SB22-113 which mandates governance of AI-driven facial recognition technologies by state entities. The laws impose transparency, governance, and risk management obligations on insurers, developers, and deployers, and introduce penalties for non-compliance. As proposals for AI laws continue to accelerate, mapping exposure risks and staying on top of regulatory developments is essential for ensuring compliance.

Colorado Governor Jared Polis has signed into law SB24-205, which aims to protect consumers from algorithmic discrimination resulting from artificial intelligence. The law imposes requirements on both developers and deployers of these AI systems in Colorado to demonstrate reasonable care to protect consumers from known or foreseeable risks of algorithmic discrimination through transparency, governance, and mitigation measures. The law comes into effect on February 1, 2026. The AI regulatory ecosystem is evolving, and compliance is essential, particularly when multiple frameworks and jurisdictional differences have to be navigated.

Colorado has passed a law to protect consumers in their interactions with AI systems, SB24-205, which mandates regulation of high-risk AI systems and prevents algorithmic discrimination. Developers of high-risk systems must take reasonable precautions to prevent algorithmic discrimination, such as disclosing information and conducting impact assessments. High-risk system deployers must implement risk management protocols, conduct impact assessments, and provide consumers opportunities to correct incorrect data. The law applies to any person who does business in Colorado, and enforcement lies solely in the power of the Attorney General. The law provides defenses for developers or deployers if they comply with a nationally or internationally recognized AI risk management framework. There are no specified penalties for violations, and compliance can be maximized with Holistic AI's Governance Platform.

In October 2023, President Biden signed the Executive Order (EO) on Safe, Secure, and Trustworthy Artificial Intelligence, which established AI safety and security standards, promoted consumer protection, enabled AI innovation, and advanced American technology leadership. Federal departments and agencies have successfully completed all tasks within 90 days, 150 days, and 180 days. These tasks included establishing disclosure requirements for developers of the most advanced AI systems, evaluating potential AI risks affecting critical infrastructure, preventing foreign entities from developing AI for malicious purposes, expanding investment into AI innovation and talent attraction, and creating an AI task force to expand AI innovation in healthcare. Further actions include the establishment of AI Governance Boards, submission of a report on authenticating, labeling, and detecting synthetic content, and identifying clinical errors arising from the use of AI in healthcare. The EO sets foundations for AI risk management, regulation, and innovation in the US.

The American Privacy Rights Act (APRA) proposal, released by two bipartisan committee chairs, could lead to the first national data privacy framework in the US. It aims to solve the challenge caused by an absence of a national standard, and includes several consumer privacy provisions, restricts data collection and use, and creates a national registry of data brokers. The APRA does not specifically address AI, but its broad domain means it inadvertently covers AI systems that process personal data. Industry leaders have responded positively, but lawmakers are disappointed in the lack of protections for minors and may introduce complementary legislation. The bill has not yet been formally introduced, and Holistic AI can help maximise compliance with the new regulations.