Guide to the Colorado AI Act (CAIA)

#Guide #Checklist #ForLeadership #StateRegulations #AIImpacts #AIStandards #Fairness&Bias

This manual consists of four sections: 

I. What is the Colorado AI Act - High-level description of the CAIA and its objectives.

II. Comparing the CAIA to Leading AI Guidance in the U.S. - Visualizes similarities and differences between the CAIA, the National Institute for Standards and Technology’s Risk Management Framework, and ISO 42001.

III. Guiding Questions for Organizations to Assess System-Level Risk - Provides a decision tree for organizations to follow to determine whether their AI systems qualify as high-risk under the CAIA.

IV. Important Definitions - Highlights key definitions mentioned in the CAIA that are necessary to understand its provisions.

Document Checklists - Two comprehensive checklists of AI documentation and content requirements that developers and deployers must maintain to be compliant with the CAIA

I. What is the Colorado AI Act?

The Colorado AI Act (CAIA) is one of the first state-based statutes in the U.S. to regulate AI systems. Signed in May 2024, the CAIA establishes obligations for developers and deployers of high-risk AI systems to implement measures which protect consumers from foreseeable risks of algorithmic discrimination. The obligations included in the CAIA become effective on or after February 2, 2026. 

The subsections of the CAIA highlight documentation requirements organizations must fulfill, risk management policies and programs deployers must maintain, and information sharing practices deployers must conduct. In the final subsections of the CAIA, the Colorado Senate also situates the provisions of this act within the broader legal context in the U.S. and details the Attorney General’s enforcement role in relation to this legislation. It’s also important to note that the Attorney General has the authority to create additional rules as needed, to enforce the CAIA.

5 Central Takeaways of the CAIA:

II. Comparing the CAIA to Leading AI Standards in the U.S.

Although the CAIA includes several overlapping requirements with leading industry AI frameworks in the U.S., it’s important to note that the CAIA imposes some obligations which differ from the National Institute for Standards and Technology (NIST)’s Risk Management Framework (RMF) and the International Organization for Standardization (ISO)’s 42001 recommendations.

III. Guiding Questions for Organizations to Assess System-Level Risk

Organizations can use the decision tree below to determine whether their AI system qualifies as high-risk under the CAIA.

IV. Important Definitions

In subsection 2, the CAIA provides an overview of relevant definitions to understand the subsequent content of the statute. We have included some of the most important definitions along with their notable exclusions highlighted by the CAIA.

V. Document Checklists

In subsections 2-4, the CAIA details several documentation requirements for developers and deployers of high-risk AI systems, along with their required content, which organizations must maintain to prove they have attempted to mitigate foreseeable risks of algorithmic discrimination for consumers. The checklists below serve as reference guides for organizations hoping to compare their documentation practices against the CAIA.