The Colorado Automated Decision-Making Technology Law ("Colorado ADMT law") will take effect on January 1, 2027. The Colorado ADMT law repeals and replaces the Colorado artificial intelligence law, which was discussed in the following articles.
This article discusses Colorado attorney general enforcement of and no new private right of action under, liability under, and exceptions to the Colorado ADMT law.
Colorado Attorney General Enforcement
The Colorado attorney general shall enforce the Colorado ADMT law through the Colorado Consumer Protection Act, Article 1. A violation of the Colorado ADMT law is a deceptive trade practice and is subject to the provisions of the Colorado Consumer Protection Act, Article 1. Any provision of the Colorado Consumer Protection Act, Article 1, that is inconsistent with the exclusive enforcement authority granted to the Colorado attorney general herein for a violation of the Colorado ADMT law does not apply to any such violation.
Violations of the developer and the deployer obligations under the Colorado ADMT law are enforceable exclusively by the Colorado attorney general without regard to any other provision in Title 6.
Until January 1, 2030, prior to any enforcement action for a violation of the Colorado ADMT law, the Colorado attorney general shall issue a notice of violation to a developer or deployer if a cure is deemed possible by the Colorado attorney general. If the developer or deployer fails to cure a violation within 60 days after receipt of a notice of violation, the Colorado attorney general may bring an action pursuant hereto. If the Colorado attorney general finds and can demonstrate that a developer or deployer knowingly violated the Colorado ADMT law or a developer or deployer repeatedly violated the Colorado ADMT law, the Colorado attorney general is not required to provide a cure period before seeking penalties or other relief.
If a violation is discovered in the course of an enforcement action, a court may consider that a developer or deployer cured the violation within 60 days after receipt of written notice as a mitigating factor in determining civil penalties or other monetary relief, if any.
Nothing in the Colorado ADMT law limits or reduces any existing rights or remedies available under state or federal law, including the Colorado Anti-Discrimination Act, Parts 3 to 8 of Article 34 of Title 24, the Colorado Consumer Protection Act, Article 1, product liability law, or other applicable law.
The Colorado attorney general may adopt rules as necessary to implement and clarify the Colorado ADMT law. The Colorado attorney general may adopt rules to clarify the application of the Colorado ADMT law definition of materially influence, including presumptions, illustrative examples, and objective indicators.
In adopting rules pursuant to the Colorado ADMT law, the Colorado attorney general shall utilize a process that meaningfully engages stakeholders, including consumer advocates, deployers, developers, and sector regulators, through public notice, opportunity for written comment, and at least one public hearing and shall adopt rules in accordance with Col. Rev. Stat. § 24-4-103.
Nothing in the Colorado ADMT law limits the ability of a party to join necessary or permissive parties under the Colorado Rules of Civil Procedure, including Rules 19 and 20 of the Colorado Rules of Civil Procedure, in any action arising under existing law.
Nothing in the Colorado ADMT law creates a new private right of action. Compliance with the Colorado ADMT law does not constitute a defense to and does not excuse noncompliance with any applicable law.
Liability Under Colorado ADMT Law
A developer or deployer may be held liable in an action alleging unlawful discrimination under state anti-discrimination laws, including the Colorado Anti-Discrimination Act, Parts 3 to 8 of Article 34 of Title 24, arising from a consequential decision materially influenced by a covered ADMT. In an action described in the immediately preceding sentence, fault shall be allocated among deployers and developers based on their relative fault for the violation. Nothing herein shall be construed for the following.
Apportion liability to a claimant where such apportionment is not provided for under existing law; or
Create joint and several liability, except to the extent permitted under existing law.
A developer is liable in an action described in the immediately preceding paragraph only to the extent that the developer's covered ADMT was for the following.
Was used by a deployer in a manner that was intended, documented, marketed, advertised, configured, or contracted for by the developer; and
Materially influenced a consequential decision that gave rise to the violation of existing law.
A developer is not liable hereunder for violations of existing law arising from a deployer's use of a covered ADMT in a manner that was not intended, documented, marketed, advertised, configured, or contracted for by the developer.
Nothing herein shall be construed to limit the liability of a deployer for the deployer's independent acts or omissions in a consequential decision materially influenced by a covered ADMT, including using an ADMT in a manner that was not intended, documented, marketed, advertised, configured, or contracted for by the developer if the developer of the covered ADMT complied with the developer obligations under the Colorado ADMT law.
Notwithstanding any other provision of law, if a provision of a contract for the use of automated decision-making technology in making a consequential decision or any other contract between a developer and deployer purports to indemnify, defend, or hold harmless or has the effect of indemnifying, defending, or holding harmless the indemnitee from or against any liability for damages pursuant hereto resulting from the developer's or deployer's own acts or omissions related to the use of automated decision-making technology in making consequential decisions in violation of the Colorado Anti-Discrimination Act, Parts 3 to 8 of Article 34 of Title 24, or other Colorado anti-discrimination law, the provision is contrary to public policy and void.
The limitations in the immediately preceding sentence do not apply to a developer where the use of the covered ADMT in making a consequential decision was not intended, documented, marketed, advertised, configured, or contracted for by the developer if the developer of the covered ADMT complied with the developer obligations under the Colorado ADMT law. This paragraph does not do the following.
Otherwise limit the enforceability of contract terms between parties acting in a commercial or business capacity, except to the extent otherwise provided by applicable law; or
Prohibit or limit any person from obtaining or making a claim on applicable insurance for any applicable alleged liabilities or related losses.
Nothing herein shall be construed to limit, displace, or otherwise affect any liability that a developer or a deployer may have, separate and apart from liability hereunder, for a violation of state law. Compliance with the requirements of the Colorado ADMT law is not a defense to and does not otherwise excuse noncompliance with any applicable law.
The use of an ADMT in a consequential decision does not excuse, justify, or provide a defense to any obligation or liability under state or federal law, including obligations and liability related to discrimination or consumer protection.
Exceptions to the Colorado ADMT Law
An insurer, as defined in Col. Rev. Stat. § 10-1-102 (13), and affiliated entities that are subject to the requirements of Col. Rev. Stat. § 10-3-1104.9 are in compliance with the Colorado ADMT law in the practice of insurance. If an insurer is not deemed in compliance pursuant to the immediately preceding sentence, the insurer shall provide notice and disclosure of its use of a covered ADMT in materially influencing a consequential decision regarding the practice of insurance pursuant to the disclosure requirements of Col. Rev. Stat. § 6-1-1704(3), to the extent applicable. This paragraph does not limit the applicability of the Colorado ADMT law to uses of covered ADMT related to insurer employment or Insurer employment opportunities by insurers and affiliated entities that are subject to the requirements of Col. Rev. Stat. § 10-3-1104.9.
Col. Rev. Stat. §§ 6-1-1701, 6-1-1702, 6-1-1703, 6-1-1704, 6-1-1705, and 6-1-1706 do not apply to a covered entity within the meaning of the federal Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. §§ 1320d to 1320d-9, and the regulations promulgated under the federal act, or a covered entity's business associates for any services rendered to a covered entity, to the extent the covered entity is doing business in Colorado, except for a consequential decision related to employment or an employment opportunity.
A covered entity shall provide patients with a general notice of use of advanced technologies, including a covered ADMT. The notice may be incorporated with other notices describing patient rights and how the covered entity provides care. Notwithstanding the first sentence of this paragraph, for a covered entity that is a healthcare provider, as defined in 45 CFR 160.103, this paragraph applies only if the healthcare provider is operating from a location within Colorado. Notwithstanding the first sentence of this paragraph, a covered entity that uses a covered ADMT to determine a patient's eligibility for financial assistance, including discounted care as described in Col. Rev. Stat. § 25.5-3-502, shall provide a patient the following disclosures.
A plain language description of the consequential decision and the role of the covered ADMT in the consequential decision;
The types of information about the individual the covered entity relied upon in making its determination of eligibility, except for trade secrets and other confidential or legally protected information;
Information on how to request correction of materially inaccurate personal data held by the covered entity consistent with the federal Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. §§ 1320d to 1320d-9 and Col. Rev. Stat. § 25.5-3-502; and
Information on how to request meaningful human review or reconsideration, where applicable. A covered entity may comply with this obligation through either an advance general disclosure of the information required hereby or through a notice provided within 30 calendar days after an adverse outcome. This paragraph does not create a separate and duplicative disclosure process or appeal process if the review opportunities and information described herein are provided.
Col. Rev. Stat. §§ 6-1-1701, 6-1-1702, 6-1-1703, 6-1-1704, 6-1-1705, and 6-1-1706 do not apply to a medical device subject to oversight by the US Food and Drug Administration (FDA) or a pharmaceutical or medical device manufacturer's research and development activities that are subject to oversight by the US FDA, including clinical investigations conducted under 21 CFR 312.
Nothing in the Colorado ADMT law requires a covered entity or business associate, as those terms are defined under the federal Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. §§ 1320d to 1320d-9, to disclose protected health information or other information in a manner that would violate federal law. To the extent compliance with Col. Rev. Stat. §§ 6-1-1704 or 6-1-1705 would conflict with federal health privacy requirements, the deployer shall comply with applicable federal law and provide disclosures and access consistent with that law.
The Colorado ADMT law does not require a person to disclose nonpublic personal information in a manner that would violate the federal Gramm–Leach–Bliley Act, 15 U.S.C. §§ 6801 et seq., or its implementing regulations.
Opinions expressed in Expert Commentary articles are those of the author and are not necessarily held by the author's employer or IRMI. Expert Commentary articles and other IRMI Online content do not purport to provide legal, accounting, or other professional advice or opinion. If such advice is needed, consult with your attorney, accountant, or other qualified adviser.
The Colorado Automated Decision-Making Technology Law ("Colorado ADMT law") will take effect on January 1, 2027. The Colorado ADMT law repeals and replaces the Colorado artificial intelligence law, which was discussed in the following articles.
This article discusses Colorado attorney general enforcement of and no new private right of action under, liability under, and exceptions to the Colorado ADMT law.
Colorado Attorney General Enforcement
The Colorado attorney general shall enforce the Colorado ADMT law through the Colorado Consumer Protection Act, Article 1. A violation of the Colorado ADMT law is a deceptive trade practice and is subject to the provisions of the Colorado Consumer Protection Act, Article 1. Any provision of the Colorado Consumer Protection Act, Article 1, that is inconsistent with the exclusive enforcement authority granted to the Colorado attorney general herein for a violation of the Colorado ADMT law does not apply to any such violation.
Violations of the developer and the deployer obligations under the Colorado ADMT law are enforceable exclusively by the Colorado attorney general without regard to any other provision in Title 6.
Until January 1, 2030, prior to any enforcement action for a violation of the Colorado ADMT law, the Colorado attorney general shall issue a notice of violation to a developer or deployer if a cure is deemed possible by the Colorado attorney general. If the developer or deployer fails to cure a violation within 60 days after receipt of a notice of violation, the Colorado attorney general may bring an action pursuant hereto. If the Colorado attorney general finds and can demonstrate that a developer or deployer knowingly violated the Colorado ADMT law or a developer or deployer repeatedly violated the Colorado ADMT law, the Colorado attorney general is not required to provide a cure period before seeking penalties or other relief.
If a violation is discovered in the course of an enforcement action, a court may consider that a developer or deployer cured the violation within 60 days after receipt of written notice as a mitigating factor in determining civil penalties or other monetary relief, if any.
Nothing in the Colorado ADMT law limits or reduces any existing rights or remedies available under state or federal law, including the Colorado Anti-Discrimination Act, Parts 3 to 8 of Article 34 of Title 24, the Colorado Consumer Protection Act, Article 1, product liability law, or other applicable law.
The Colorado attorney general may adopt rules as necessary to implement and clarify the Colorado ADMT law. The Colorado attorney general may adopt rules to clarify the application of the Colorado ADMT law definition of materially influence, including presumptions, illustrative examples, and objective indicators.
In adopting rules pursuant to the Colorado ADMT law, the Colorado attorney general shall utilize a process that meaningfully engages stakeholders, including consumer advocates, deployers, developers, and sector regulators, through public notice, opportunity for written comment, and at least one public hearing and shall adopt rules in accordance with Col. Rev. Stat. § 24-4-103.
Nothing in the Colorado ADMT law limits the ability of a party to join necessary or permissive parties under the Colorado Rules of Civil Procedure, including Rules 19 and 20 of the Colorado Rules of Civil Procedure, in any action arising under existing law.
Nothing in the Colorado ADMT law creates a new private right of action. Compliance with the Colorado ADMT law does not constitute a defense to and does not excuse noncompliance with any applicable law.
Liability Under Colorado ADMT Law
A developer or deployer may be held liable in an action alleging unlawful discrimination under state anti-discrimination laws, including the Colorado Anti-Discrimination Act, Parts 3 to 8 of Article 34 of Title 24, arising from a consequential decision materially influenced by a covered ADMT. In an action described in the immediately preceding sentence, fault shall be allocated among deployers and developers based on their relative fault for the violation. Nothing herein shall be construed for the following.
A developer is liable in an action described in the immediately preceding paragraph only to the extent that the developer's covered ADMT was for the following.
A developer is not liable hereunder for violations of existing law arising from a deployer's use of a covered ADMT in a manner that was not intended, documented, marketed, advertised, configured, or contracted for by the developer.
Nothing herein shall be construed to limit the liability of a deployer for the deployer's independent acts or omissions in a consequential decision materially influenced by a covered ADMT, including using an ADMT in a manner that was not intended, documented, marketed, advertised, configured, or contracted for by the developer if the developer of the covered ADMT complied with the developer obligations under the Colorado ADMT law.
Notwithstanding any other provision of law, if a provision of a contract for the use of automated decision-making technology in making a consequential decision or any other contract between a developer and deployer purports to indemnify, defend, or hold harmless or has the effect of indemnifying, defending, or holding harmless the indemnitee from or against any liability for damages pursuant hereto resulting from the developer's or deployer's own acts or omissions related to the use of automated decision-making technology in making consequential decisions in violation of the Colorado Anti-Discrimination Act, Parts 3 to 8 of Article 34 of Title 24, or other Colorado anti-discrimination law, the provision is contrary to public policy and void.
The limitations in the immediately preceding sentence do not apply to a developer where the use of the covered ADMT in making a consequential decision was not intended, documented, marketed, advertised, configured, or contracted for by the developer if the developer of the covered ADMT complied with the developer obligations under the Colorado ADMT law. This paragraph does not do the following.
Nothing herein shall be construed to limit, displace, or otherwise affect any liability that a developer or a deployer may have, separate and apart from liability hereunder, for a violation of state law. Compliance with the requirements of the Colorado ADMT law is not a defense to and does not otherwise excuse noncompliance with any applicable law.
The use of an ADMT in a consequential decision does not excuse, justify, or provide a defense to any obligation or liability under state or federal law, including obligations and liability related to discrimination or consumer protection.
Exceptions to the Colorado ADMT Law
An insurer, as defined in Col. Rev. Stat. § 10-1-102 (13), and affiliated entities that are subject to the requirements of Col. Rev. Stat. § 10-3-1104.9 are in compliance with the Colorado ADMT law in the practice of insurance. If an insurer is not deemed in compliance pursuant to the immediately preceding sentence, the insurer shall provide notice and disclosure of its use of a covered ADMT in materially influencing a consequential decision regarding the practice of insurance pursuant to the disclosure requirements of Col. Rev. Stat. § 6-1-1704(3), to the extent applicable. This paragraph does not limit the applicability of the Colorado ADMT law to uses of covered ADMT related to insurer employment or Insurer employment opportunities by insurers and affiliated entities that are subject to the requirements of Col. Rev. Stat. § 10-3-1104.9.
Col. Rev. Stat. §§ 6-1-1701, 6-1-1702, 6-1-1703, 6-1-1704, 6-1-1705, and 6-1-1706 do not apply to a covered entity within the meaning of the federal Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. §§ 1320d to 1320d-9, and the regulations promulgated under the federal act, or a covered entity's business associates for any services rendered to a covered entity, to the extent the covered entity is doing business in Colorado, except for a consequential decision related to employment or an employment opportunity.
A covered entity shall provide patients with a general notice of use of advanced technologies, including a covered ADMT. The notice may be incorporated with other notices describing patient rights and how the covered entity provides care. Notwithstanding the first sentence of this paragraph, for a covered entity that is a healthcare provider, as defined in 45 CFR 160.103, this paragraph applies only if the healthcare provider is operating from a location within Colorado. Notwithstanding the first sentence of this paragraph, a covered entity that uses a covered ADMT to determine a patient's eligibility for financial assistance, including discounted care as described in Col. Rev. Stat. § 25.5-3-502, shall provide a patient the following disclosures.
Col. Rev. Stat. §§ 6-1-1701, 6-1-1702, 6-1-1703, 6-1-1704, 6-1-1705, and 6-1-1706 do not apply to a medical device subject to oversight by the US Food and Drug Administration (FDA) or a pharmaceutical or medical device manufacturer's research and development activities that are subject to oversight by the US FDA, including clinical investigations conducted under 21 CFR 312.
Nothing in the Colorado ADMT law requires a covered entity or business associate, as those terms are defined under the federal Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. §§ 1320d to 1320d-9, to disclose protected health information or other information in a manner that would violate federal law. To the extent compliance with Col. Rev. Stat. §§ 6-1-1704 or 6-1-1705 would conflict with federal health privacy requirements, the deployer shall comply with applicable federal law and provide disclosures and access consistent with that law.
The Colorado ADMT law does not require a person to disclose nonpublic personal information in a manner that would violate the federal Gramm–Leach–Bliley Act, 15 U.S.C. §§ 6801 et seq., or its implementing regulations.
Opinions expressed in Expert Commentary articles are those of the author and are not necessarily held by the author's employer or IRMI. Expert Commentary articles and other IRMI Online content do not purport to provide legal, accounting, or other professional advice or opinion. If such advice is needed, consult with your attorney, accountant, or other qualified adviser.