A look into Colorado's pioneering AI legislation

Eva Marie Uzcategui/Bloomberg

State legislators across the country have been working to pass bills increasing consumer protections against potential biases in generative artificial intelligence models. A recent effort from Colorado lawmakers is one of the first to cross the finish line.

Consumer Protections for Artificial Intelligence (SB24-205) was signed into law by Colorado Governor Jared Polis in May and focuses on "high-risk AI systems" that are classified in the bill's text as "systems that, when deployed, make, or are a substantial factor in making, a consequential decision." One example of a consequential decision is the approval or denial of a financial or lending service. 

Under the new legislation, developers are required to take "reasonable care" to protect consumers from the risks of algorithmic discrimination. They must disclose intricate details about the systems as well as documentation needed for conducting impact assessments to deployers of their products. Developers need to also publish a publicly available statement outlining the various systems in operation and how risks of algorithmic discrimination are managed.

"This bill is among the first in the country to attempt to regulate the burgeoning artificial intelligence industry on such a scale. … I appreciate the sponsors' interest in preventing discrimination and prioritizing consumer protection as Colorado leads this space," Polis said in a May signing statement. A similar effort was introduced in Connecticut in February, but failed to be signed into law.

Technology

Preparing for banking's AI revolution

March 19, 2024 4:20 PM

The bill requires deployers across the state to implement a risk management policy and program for high-risk systems, conduct an impact assessment of the systems, annually review each system's deployment to check for algorithmic biases and more.

Companies that deploy AI models will need to alert the state attorney general to any instances of discrimination that are uncovered within 90 days. If they are in compliance with a recognized risk management framework and have taken actions to discover and correct such violations, the legislation gives them the right to raise an affirmative defense that could, if granted, negate any legal consequences.

Disclosures such as those made to the attorney general, in addition to appeal processes, are key parts of the legislation. Deployers will need to provide consumers with opportunities to both correct personal data used in decisions made by high-risk systems and appeal (when feasible) adverse decisions.  

The changes are set to go into full effect on Feb. 1, 2026.

"The goal was always to try to balance consumer protections with innovation," said Sen. Robert Rodriguez, D-Colo., who was a prime sponsor of the bill. "[AI] is new, it's cool, it's neat and we all like it, but it's got problems."

Traditional AI had been front of mind for many banking executives as the pandemic's shift to remote work fueled a tech boom across the financial services industry in 2020. But the debut of OpenAI's ChatGPT two years later saw interest shift toward large language models able to both execute predetermined tasks and create wholly new results. 

Research released in March by Arizent, the publisher of American Banker, polled 127 banking experts across the industry. More than 45% of respondents said they are either using or likely to use generative AI to help improve general office productivity, with 36% also incorporating the technology into fraud prevention and detection.

While consumer protection was the prime focus of the bill, other sponsors said they tried to draft it in such a way as to not hinder innovation in the state.

Rep. Brianna Titone, D-Colo., said including elements of transparency and working with tech companies to help sculpt the legislation was crucial to help set a proper balance between overregulation and lack of oversight.

"We have a lot of companies using AI in Colorado, and the last thing we want to do is stifle innovation of the companies that are doing a lot of great work. … It's about trying to balance the negative unintended consequences of AI with that innovation," Titone said.

Bank regulators have expressed differing views on the need for new laws to govern AI. In September, the Consumer Financial Protection Bureau issued guidance on the use of artificial intelligence in underwriting and the explanations given to consumers who are denied credit. The bureau said that creditors must provide specific reasons and details to explain why a consumer is denied credit or why a credit limit was changed, regardless of whether the decision was made by AI. 

In January, officials with the Federal Deposit Insurance Corp. said they have the tools to make banks that use AI comply with existing rules. 

Financial institutions and fintech firms alike have called for increased clarity into what the impact to their industries could look like, but by and large felt prepared for any new compliance guidelines due to operating in an already highly regulated environment.

Legal experts specializing in this technology say that when adopting AI-powered tools, recordkeeping and audit reviews are a best practice and in some cases a requirement due to the complexity of the models.

"One message is clear from new laws and enforcement: Ignorance of an AI system's operation is not an excuse, and regulators like the Federal Trade Commission are holding both the developers and users of AI technologies responsible for their effects," said James Sherer, partner at BakerHostetler and co-leader of the firm's emerging technology and AI teams.

Alongside Colorado's new bill, lawmakers in the state have passed another measure to establish a 26-member AI taskforce comprised of four legislative members and 22 industry figures that represent entities from the AI industry. This group will help draft recommendations for further regulations and establish a code of conduct for evaluating the impact of AI usage in the state.

The path of innovation going forward is uncertain and will vary widely depending on each use case.

"We are likely to see some form of tollgate approach, where low risk use cases are encouraged with minimal oversight, moderate risk use cases receive increased scrutiny, transparency and reporting and high-risk use cases involving substantial or fundamental rights [are subject to] strict requirements and in certain cases, prohibitions," said Joel Wuesthoff, managing director at the global consulting firm Protiviti.