Colorado Automated Decision-Making Law: Definitions and Developer Obligations

Deployer

Deployer means a person doing business in Colorado that deploys a covered ADMT. Covered ADMT means automated decision-making technology that is used to materially influence a consequential decision. Automated decision-making technology or ADMT means a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual, and excludes the following technologies.

• Anti-malware;
• Anti-virus;
• Calculators;,
• Databases;
• Data storage;
• Firewalls;
• Internet domain registration;
• Internet website loading;
• Networking;
• Spam- and robocall-filtering;
• Spell-checking;
• Spreadsheets that require human analysis and do not use machine learning, foundation models, or large language models;
• Web caching; or
• Web hosting.

ADMT also excludes the following.

• A tool used by an individual solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing; or
• Technology that communicates with consumers in natural language or other means readily understood by an average consumer for the purpose of providing consumers with information, making referrals or recommendations, answering questions, or generating other content, if the following.
  • The technology is not contracted, advertised, marketed, configured, or intended by a person to be used in a consequential decision; and
  • The technology is subject to an acceptable use policy that prohibits generated content to be used in a consequential decision.

Materially influence means an ADMT output does the following.

• Is a non-de minimis factor that is used in making a consequential decision; and
• Affects the outcome of a consequential decision, including by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how a consequential decision is made.

Materially influence excludes incidental, trivial, or clerical uses.

Consequential decision means the following.

• A decision, determination, or action made about a consumer that relates to the provision of or a consumer's access to, eligibility for, selection for, or compensation for a covered domain; or
• A decision, determination, or action about a consumer that relates to a differentiated price, cost sharing, compensation, or other material terms in a manner that is reasonably likely to materially limit, delay, effectively deny, or otherwise fundamentally alter the consumer's access, eligibility, or opportunity for a covered domain.

Consequential decision excludes the following.

• Low-stakes or routine decisions, actions, and business processes that do not materially influence eligibility for, selection for, denial of, compensation for, pricing of, or access to an opportunity or service for a covered domain, including routine scheduling, classroom personalization, administrative routing, customer service triage, communication of decisions, or workflow management;
• Advertising, marketing, differentiated product recommendations, search, or content moderation;
• Spreadsheets that require manual human analysis and do not use machine learning, foundation models, or large language models;
• Actions in which an ADMT is used to summarize, organize, or present information for human review and the system does not produce a score, ranking, recommendation, classification, prediction, or other inference that materially influences an outcome or a decision;
• Narrow procedural tasks or data-processing functions that do not generate a prediction or inference about a consumer or materially influence a consequential decision or consequential decision process;
• Activities relating to technologies used for cybersecurity, spam-and robo-call filtering, system reliability, and anti-money laundering and counter-terrorist financing controls;
• Activities relating to technologies used for economic sanctions compliance, including under the federal Bank Secrecy Act, 12 U.S.C. § 1951 et seq., the federal USA Patriot Act, Pub. L. 107-56, the Federal Trade Commission's Red Flags Rule, 16 CFR 681, as amended, and sanctions programs administered by the United States Department of the Treasury, excluding facial recognition unless the sole purpose of which is to confirm an individual's identity;
• Activities relating to technologies used for fraud prevention, including identity verification, consumer identification, monitoring, and reporting controls required under state or federal law; or
• Routine academic administration and student support processes that do not materially influence a consequential decision.

Personal data means information that is linked or reasonably linkable to an identified or identifiable individual and excludes de-identified data or publicly available information.

Covered domain means the following.

• An education enrollment or an education opportunity;
• Employment or an employment opportunity that creates or may create an employer-employee relationship;
• The lease or purchase of residential real estate in Colorado;
• A financial or lending service;
• Insurance, including underwriting, pricing, coverage, claims adjudication, or other determinations that materially affect access to benefits;
• Health-care services; or
• Essential government services and public benefits, including eligibility and renewal determinations.

Consumer means an individual who is a Colorado resident acting only in an individual or household context and includes an employee, a job applicant who is a Colorado resident, and any individual whose access to, eligibility for, or opportunity in Colorado is evaluated in a consequential decision by a person doing business in Colorado.

Employee means any person, including a migratory laborer, performing labor or services for the benefit of an employer. Relevant factors in determining whether a person is an employee include the degree of control the employer may or does exercise over the person and the degree to which the person performs work that is the primary work of the employer, except that an individual primarily free from control and direction in the performance of the service, both under their contract for the performance of service and in fact, and who is customarily engaged in an independent trade, occupation, profession, or business related to the service performed is not an employee.

Employer has the same meaning as set forth in the federal Fair Labor Standards Act of 1938, 29 U.S.C. § 203(d), and includes a foreign labor contractor, a migratory field labor contractor or crew leader, and each individual who owns or controls at least 25 percent of the ownership interests in an employer, except that this does not apply to a minority owner of an employer that demonstrates full delegation of its authority to control day-to-day operations of the employer; the state or its agencies or entities, counties, cities, and counties; municipal corporations; quasi-municipal corporations; school districts; and irrigation, reservoir, or drainage conservation companies or districts organized and existing under the laws of Colorado.

Developer

Developer means a person doing business in Colorado that does the following.

• Develops, offers, sells, leases, licenses, or otherwise makes commercially available a covered ADMT;
• Develops a component that is designed, marketed, intended, documented, advertised, configured, or contracted to be used as part of a covered ADMT; or
• intentionally and substantially modifies an ADMT such that it becomes a covered ADMT.

Developer excludes a person who develops and uses an ADMT that does the following.

• Solely for research purposes and the ADMT is not used in a consequential decision in the research; or
• For internal purposes, such as use and development activities by affiliates and commercial support functions, and that does not make the system available to another person for use in a consequential decision.

Developer also excludes the following.

• The preceding developer that makes an ADMT commercially available and an unaffiliated person modifies the covered ADMT in a manner that changes the system's intended, documented, marketed, advertised, configured, or contracted use; or
• A person that has designed, marketed, intended, documented, advertised, configured, or contracted a component that is used as part of an ADMT, but the component is integrated into a covered ADMT without the actual knowledge of the person.

Intentional and substantial modification means a deliberate change made to an ADMT that results in a material change to the system's intended, documented, advertised, configured, or contracted use.

Developer Obligations

There are developer obligations when a developer creates a covered ADMT that is intended, documented, marketed, advertised, configured, or contracted to be used to make consequential decisions or when the developer becomes aware that the covered ADMT is being used to make consequential decisions in a manner consistent with the intended and contracted uses.