With about a week remaining in this year’s legislation session, a new bill was introduced late Monday, changing the state of Colorado’s controversial artificial intelligence law, or at least the impact on small businesses.
Senate Bill 318 reduces the administrative tasks that must be done to protect consumers from discrimination when using AI systems to receive work, housing, personal loans, healthcare, insurance coverage, educational opportunities, or legal or essential government services.
The measure also delays implementation for about a year, making the resource-intensive portion of the AI Act first applied to businesses with more than 500 employees worldwide, rather than 50 or more. It will gradually resign until April 1, 2029, when companies with fewer than 100 workers are exempt.
Without a revision of Colorado’s current AI law, even businesses that did not develop AI will need to complete risk assessments, inform consumers that AI will be used to make important decisions, and respond to consumers who challenge critical decisions that are affected by AI. The law will come into effect on February 1st.
“Drafting policy on AI is a difficult battle,” said Robert Rodriguez, the Senate majority leader, who is a Denver Democrat and a major sponsor of the bill. “As soon as you land on a viable policy, you’ll notice that the technology is two steps behind where it is.”
Senate Bill 318 “builds on the laws of the first legislation to implement common sense guardrails last year, addressing concerns we hear from stakeholders and confirming that it is catching up to this evolving AI landscape,” he added. “The ultimate goal of this policy is to ensure that consumers are protected for AI rides, whether they like it or not.”
Consumer advocates were reluctantly OK with how the law ended last year, as they aimed to protect consumers from computer systems trained with biased data.
But the change in the bill was disappointing, Matthew Scheller said he was focused on workers’ rights as a senior policy council at the Center for Democracy Technology.
“The industry got almost all the changes we wanted, but the public interest groups only got a small portion of what we wanted,” he said. “That being said, the bill strips the law to that foundation, but that foundation is still there and it’s still strong. Labor, consumer and civil rights groups are still being handled, but I think I understand that the tech industry has spent a year trying to model Colorado and feels it’s in favour of the power in DC.
However, small businesses still have a huge burden for AI developers and businesses that may use AI, including technologies they have not developed. Chris Erickson, co-founder of Denver’s venture capital firm Range Venture, said some of them were just behind.
“The first few years will give you some relief from some parts of the bill, but that’s been increasing quite a bit. And over time you’re still left with a fairly small sized company where you still have to implement a bunch of these things,” Erickson said.
He further said, “What we saw here is just a few expansions of what’s already problematic. We all run as efficiently as possible by businesses, especially local businesses, and we are not yet present, but we are on our way to the US.
Is the law not in effect yet?
The measure changes Senate Bill 205, which was passed in Congress last year and faced protests from the technology and business community when it was signed into law by Gov. Jared Police.
Some say it hurts the development of AI in Colorado, while others say businesses will go elsewhere because there is no similar law in the US.
They also have problems with the term “deployer,” a company that uses their AI or someone else to make the resultant decision. You may be liable if your AI decision falls in any of eight eligible categories: education, employment, financial services, healthcare, housing, insurance, legal services, and critical government services.
With the pushback, Police, along with Rodriguez and state attorney general Phil Weiser, pursued the revision. A legislative task force was created and volunteers from the business and consumer advocates community began a meeting in August to find a compromise. They were not found much. This led Rodriguez to spend several weeks drafting the update.
Some of the region’s top technology leaders were unhappy with the proposed revision. Brian Leach, CEO of Ibotta, a Denver high-tech company with a popular consumer retail app, was one of 200 tech executives who contacted Police last year in criticizing the law.
Leach said he was in mind last summer, with the aim of police and Rodriguez committing to amending the bill to address “an overly broad definition of AI” and “active disclosure requirements.” In their letter, they said the goal was to “conform to what’s going on at the federal level, instead of creating a state-by-state patchwork of regulations.”
That didn’t happen with Senate Bill 318, Leach said.
“Since then,” Leach said in an email: “Several other states have refused to implement such a bill, and we continue to be alone with our approach. Unfortunately, we learn that the reform bill proposed by Senator Rodriguez is back to the public commitment that the Senator made in his signature letter on June 13, 2024. Our reputation as a business-friendly state and the ability to continue creating jobs.”
He feels that it only takes about a week to see what happened with the bill and should not be introduced.
“Instead, we will urge Congress to delay implementation of the original bill for a year, allowing it to be a complete and fair consideration whether to implement, amend or abolish the original AI bill,” Leach said.
Proposed changes to AI law
The bill clarifies the definition of “algorithmic discrimination.” This is as an AI that makes decisions that violate local, state, or federal anti-discrimination laws. The bill added a new term “main foundation” to clarify that the legislation only affects AI systems that “make consequential decisions without meaningful human involvement.”
He also emphasized that technology, in which AI is not a substantial factor in the consequential decision, will be excluded. Some of them are cited in current law, but I don’t think that such decisions can be made, such as spell checking, generator AI systems such as ChatGPT, or generic AI systems such as video games.
However, the revision is complicated due to the already long law that appears to support the business community that was Police’s intention when calling for changes last year.
The bill blurs some of the language the industry has felt, like the requirement to protect consumers from algorithmic discrimination using “rational care.”
We propose to limit what consumers can appeal to decisions “based on false personal data or illegal information.” These include job openings that are no longer available, such as deadlines and disadvantageous decisions that are not limited to competition.
It narrows the meaning of “housing” and “financial or lending services.” A housing decision refers only to a person’s primary residence. According to the bill, financial or lending services decisions only cover individual and household financial services.
It also exempts technology startups that have raised less than $10 million from third-party investors, with revenues of less than $5 million for less than five years.
Non-exempt companies should create risk management policies that spell out potential discriminatory risks and how they mitigate them and update them annually. In a statement, businesses should inform them in a statement how decisions are made by AI systems and what personal information will be considered.
Trade secrets are still protected, as before.
Starting January 1, 2027, it will be up to the Attorney General to establish rules, investigate violations, and enforce civil penalties of up to $20,000 for each violation. Companies and developers who find and fix inadvertent violations that affect fewer than 1,000 customers can’t rely on them.
Online, members of Rocky Mountain AI Interest Group primarily supported the changes affecting small businesses. However, many noted that, while improvements from existing laws, still have tedious features and “it’s difficult to measure how the bill actually works.”
“Overall, SB 25-318 softens the original law while maintaining targeted consumer protection. It takes on a more balanced approach between innovation and accountability,” Dan Murray, founder of the organization that led the group last year, testified at the state capitol against the original AI law. “Colorado continues its national conversation about how to carefully regulate AI.”
Vivek Krishnamurthy, a professor at the University of Colorado Law School, said that in order to help the side find a compromise, the new bill appears to address all the concerns raised by the business side.
We’ve added a new category of businesses based on employee numbers, company revenue, and how much decisions their high-risk system will make. This allows for the incredible deployment of consumer disclosure and necessary risk assessments for businesses of any size that use AI in any way about consumers.
He removed the “reasonable care” reference that requires developers to avoid “reasonably foreseeable risks of discrimination,” he said. And unless they are asked, companies do not need to notify AG if they find a known risk.
“I can’t see anything in my first reading that would bring victory to those who want more algorithmic accountability,” Krishnamurthy said. “If you think there are no AI regulations at all, then if this passes, we’re pleased that there are still laws governing the use of Colorado’s high-risk artificial intelligence systems.”
Reading the bill’s explanation, Rodriguez essentially adhered to his original premise that the law is to add guardrails, so companies do not rely too much on technology systems that can unfairly determine the fate of a person.
“This is a typical compromise bill,” said Grace Gedye, policy analyst at Consumer Reports. “I don’t think anyone thinks they’re getting everything they want here.”
The bill has about a week to pass the legislature, which closes its current session on May 7th. The first committee is not yet scheduled as of Tuesday.
Colorado Sun Reporter Jesse Paul contributed to this story.
