Privacy Daily is a service of Warren Communications News.
Businesses in a 'Bind'

With Colorado AI Law Changes Uncertain, Lawyer Advises Complying Now

It’s time to start “operationalizing the laundry list of requirements currently in the Colorado AI Act because it looks like a last-minute reprieve is unlikely,” said Denver-based privacy attorney Josh Hansen of Shook Hardy, as state legislators returned for the fifth day of their special session Monday.

Sign up for a free preview to unlock the rest of this article

Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.

Troutman’s David Stauss cautioned patience, however. “The special session isn’t over,” he said in an email. “We’ll know more in the next day or two.”

The situation remained fluid Monday after a furious weekend. Going into Saturday, Colorado legislators had narrowed down the number of proposals to amend the state’s AI law from four to two (see 2508220024). On Sunday, the Senate Appropriations Committee revised a bill (SB-4) by Majority Leader Robert Rodriguez (D) and sent it to the Senate floor. Getting to that point required Rodriguez to shuffle the membership of the Appropriations Committee, reported the Colorado Sun.

Meanwhile in the House, the Appropriations Committee on Friday modified an alternative bill (HB-1008) by a bipartisan group, including Rep. William Lindstedt (D), into a simple delay of the Colorado AI Act until Oct. 1, 2026. That would effectively punt a decision on what changes to make until the next session, which starts Jan. 14. HB-1008 reached the House floor Saturday.

On Sunday night, Colorado labor and civil society groups reached agreement on a new version of Rodriguez’s bill, the so-called Colorado Sunshine Act, said Nina DiSalvo, Towards Justice's policy director. However, she said, “Big Tech is now actively working to scuttle the deal.” DiSalvo argued that the agreed-upon policy “would reduce red tape on Colorado businesses and ensure that Big Tech can be held accountable when the technology it creates -- used as intended -- results in illegal discrimination.”

The new version of the AI Sunshine Act would “limit applicability only to technology that materially impacts life-altering decisions in the lives of Coloradans,” said a fact sheet prepared by the labor and consumer groups. To help Colorado businesses, it would reduce disclose requirements and eliminate impact assessments and the right to appeal, it said. “The negotiated bill only requires notice of which algorithms are involved in a decision and disclosure of algorithmic inputs upon request.”

Also under the revised bill, consumers could “access and correct inaccurate personal data used by hidden algorithms upon request through procedures in existing Colorado law,” said the fact sheet. Large AI developers would be required to provide information to Colorado businesses and government agencies “about the risk that their technology could lead to violations of civil rights and consumer protection laws,” and the bill “would require developers to share responsibility for discrimination when it flows directly from the technology.”

The Software & Information Industry Association is “concerned" that the proposed amendment to SB-4 "would create unprecedented restrictions on AI innovation and create an untenable liability framework for businesses in the state," Senior Vice President Paul Lekas said in an emailed statement Monday. "This amendment, crafted without sufficient public input, would essentially gut existing anti-discrimination protections for Coloradans by shifting responsibility away from those making critical decisions onto providers with no role in employment practices or consumer interactions." That could harm AI development in Colorado "and set it apart from other states by burdening businesses with liability for actions they can neither see nor control," he added.

With “time running short” on the special session, Hansen said via email that “it seems that the odds may favor a proposal that punts everything to next year when the Legislature will have more time to engage with stakeholders and reach consensus on the changes.” The Shook Hardy lawyer said the “growing coalition within the Legislature behind some version of SB 4 increases the odds of a substantive bill passing,” but on the other hand, “this also increases the likelihood that there is a standoff that leads to no changes -- like what we saw during the regular session this year.”

“In the meantime, I think most companies are concerned that a failure to do something now about the Colorado AI Act puts them in a bind,” he said. “Although everyone agrees that the law needs changes, we are working with clients to operationalize the law as it stands now because they can't wait to see if changes happen before” Feb. 1, when the current version will take effect. “Any further delay on legislative changes just means businesses will spend more time and money on compliance measures for provisions that seem destined to materially change” or, perhaps, won’t “take effect at all.”

Colorado’s struggles to make a workable AI law should be a warning to legislators in other states, added Hansen: “Take your time to get it right the first time because competing stakeholders make any changes really hard … Given those challenges, to say nothing of the growing partisanship around general AI laws, I expect most states will continue their more incremental approach to AI regulation rather than pursuing the more sweeping proposal that Colorado adopted.”