Overview
On May 5, 2025, the Colorado Senate rejected an attempt by state lawmakers to amend Colorado’s landmark artificial intelligence (AI) law, known as Senate Bill (SB) 205. Colorado State Senator Robert Rodriguez and State Representative Brianna Titone introduced the amendment, SB 318, in response to criticisms from certain stakeholders that SB 205 was too burdensome and impractical. Among other changes, SB 318 would have removed SB 205’s requirement for developers and deployers of AI to use “reasonable care” to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination, in addition to requirements regarding impact assessments and reporting. As a result of the amendment’s failure, SB 205 will likely go into effect on February 1, 2026, as planned.
This article examines the impetus behind SB 318, the reasons for SB 318’s failure and what that failure means, and how developers and deployers can prepare for SB 205.
In Depth
SB 318: WHY WAS IT INTRODUCED AND WHAT DID IT SAY?
SB 205 created a basic framework for legislative action to prevent algorithmic discrimination in high-risk AI. Several other states have leveraged this framework in their respective AI legislation. After SB 205 was enacted, however, many stakeholders, including Colorado Governor Jared Polis, criticized the bill as overly broad and having the potential to slow innovation. In response, Colorado’s legislature created a task force to amend SB 205, which led to the introduction of SB 318.
SB 318 would have materially decreased SB 205’s burden on developers and deployers and shifted the law to be more business friendly. SB 318 would have delayed enactment of the law until 2027, and certain small businesses would not have been required to comply until 2029. Under SB 205, developers and deployers must comply by February 1, 2026.
WHY DID SB 318 FAIL AND WHAT DOES IT MEAN?
Senator Rodriguez explained in a Colorado Senate Business, Labor and Technology Committee hearing on May 5, 2025, that he introduced SB 318 as an attempt to address the criticism of SB 205, despite a lack of stakeholder buy-in for the proposal. Committee members heard from stakeholders both in favor of and in opposition to SB 318, and there was general agreement that while well-intentioned, SB 318 was insufficient to address key concerns about SB 205. Stakeholders felt that the definition of “consequential decision,” which informs which AI systems are “high-risk,” was still overly broad, compliance with the monitoring and disclosure requirements related to algorithmic discrimination prevention was not technically feasible, and the notice requirements connected to the deployment of AI were too intrusive. Because of these criticisms and a lack of consensus, Senator Rodriguez decided to kill SB 318.
The Colorado legislative session ended on May 7, 2025, and will not reconvene until January 2026. As a result, it is highly likely that, barring a fast-moving bill introduced at the beginning of the 2026 legislative session, deployers and developers will be required to comply with SB 205 on February 1, 2026.
HOW CAN DEPLOYERS AND DEVELOPERS PREPARE FOR SB 205?
In the wake of SB 318’s failure, developers and deployers should create a plan to enable compliance with SB 205 by the February 1, 2026, deadline. Developers and deployers should pay particularly close attention to the following key requirements.
Developers and deployers should first evaluate the extent to which they are required to comply with SB 205. SB 205’s more onerous requirements apply to entities that develop or deploy AI systems that may be considered “high risk” under SB 205. A high-risk AI system is defined as one that “makes, or is a substantial factor in making, a consequential decision,” including “a decision that has a material legal or similarly significant effect on the provision or denial to any consumer of, or the cost or terms of . . . health-care services.” SB 205 has a number of exceptions, including for HIPAA covered entities that provide healthcare recommendations generated by AI that require a provider to take action to implement the recommendation. However, even this exception has limits, as it does not apply to AI systems that are considered “high risk.” Other notable health-related exceptions include high-risk AI that is in compliance with standards set forth by the Office of the National Coordinator for Health Information Technology (as long as those standards are at least as stringent as SB 205’s standards) or that has been approved, authorized, certified, cleared, developed, or granted by the US Food and Drug Administration.
SB 205 requires developers and deployers of high-risk AI systems to use reasonable care to protect consumers from “reasonably foreseeable risks” of algorithmic discrimination arising from the intended and contracted uses of the high-risk AI system. Developers and deployers can create a rebuttable presumption of compliance with this requirement if they provide notice to deployers or consumers, as applicable, including detailed information about the AI system and plans to address risks of algorithmic discrimination related to those systems. Before February 1, 2026, developers and deployers should compile, review, and revise documentation with the disclosures required under SB 205.
Deployers of high-risk AI systems only establish a rebuttable presumption of compliance if they implement a detailed risk management policy and program to mitigate and prevent reasonably foreseeable or known risks of algorithmic discrimination. Deployers should review their current policies and risk management programs in order to conform with the specific requirements of SB 205.
While the requirements are less burdensome, certain of SB 205’s provisions require compliance by developers and deployers of any AI system, not just those that are high risk. SB 205 requires deployers of any AI system to disclose the use of such system to consumers upon each interaction unless it would be obvious to a reasonable person that they are interacting with AI. Prior to SB 205’s effective date, deployers should work with developers to insert appropriate notice provisions into AI systems that interact with consumers.
* * *
To discuss the potential legal implications of SB 205 for your business, reach out to one of the authors of this article or your regular McDermott lawyer.
