1.AI System Inventory
A live, maintained record of every AI system touching Colorado consumers in a covered context. Reviewed quarterly; updated within 30 days of any new deployment or substantial modification.
- Vendor name + developer (if different)
- Model name, version, and date deployed
- Training data sources and provenance
- Deployment surface — where the AI meets the consumer
- Covered context(s) under SB 26-189 that the system operates in
- Business owner inside the organization with accountability
- Date of last impact assessment
- Date of next scheduled annual review
- Quarterly inventory review log with sign-off
2.Impact Assessment
Required before deploying any in-scope AI system and annually thereafter; also within 90 days of any substantial modification. Signed by an accountable executive; retained for at least three years.
- System purpose and intended Colorado consumer use case
- Data inputs: training, real-time consumer, third-party
- Disparate-impact risks by protected class
- Bias testing methodology and cross-class results
- Mitigation measures, residual risk, and escalation triggers
- Human oversight mechanism and operational effectiveness
- Consumer disclosure language and delivery channels
- Vendor conformance documentation linked
- Executive sign-off recorded; 3-year retention
3.Consumer Deployer Disclosures
Pre-interaction and post-decision notice to the Colorado consumer. Plain language, accessible at the point of decision, and not buried in privacy policies.
- Pre-interaction disclosure: AI use stated plainly
- Pre-interaction disclosure: high-level purpose stated
- Post-decision disclosure for adverse outcomes
- Plain-language description of data categories used
- Working contact channel (email or web form)
- Right to human review of any adverse decision
- Counsel review on language; version-controlled edits
- Disclosure live at the deployment surface
4.Vendor Management
Vendors held contractually accountable for conformance, change notice, audit cooperation, and records retention. The deployer remains responsible for compliance even when the tool is purchased.
- Procurement clause: model card + training data summary
- Procurement clause: known limitations + evaluation results on request
- Procurement clause: 30-day notice on material model updates
- Procurement clause: cooperation with deployer bias audits
- Procurement clause: records retention supporting 3-year assessment retention
- Change-trigger log: which vendor update triggers deployer re-assessment
5.Ongoing Monitoring & 90-Day Reporting
Quarterly reviews, annual reassessment, change-trigger rules, and 90-day AG reporting on incidents of algorithmic discrimination. The monitoring loop converts an annual posture into continuous compliance.
- Quarterly inventory review — sign-off logged
- Annual impact assessment — within 90 days of system anniversary
- Change-trigger rules defined (vendor update / metric drift / incident)
- Triggered re-assessment within 90 days of triggering event
- Internal incident log with protected-class breakdowns
- 90-day AG reporting procedure documented and rehearsed
- Cooperation procedure for AG inquiries
- Remediation tracking for completed incidents