On Friday, May 17, 2024 Colorado Governor Jared Polis signed (Consumer Protections for Interactions with Artificial Intelligence) into law with an effective date of February 1, 2026.

Unlike the artificial intelligence (AI) laws enacted in other states (such as and ), the new law is the first comprehensive legislation in the United States targeted towards “high-risk artificial intelligence systems.” In particular, the law requires that both developers and entities that deploy high-risk AI systems use reasonable care to prevent algorithmic discrimination and presents a rebuttable presumption that reasonable care was used if they meet certain requirements and publicly disclose certain information about such high-risk AI systems.

Although the law does little to regulate the use of AI systems that may not be deemed “high-risk,” it could nonetheless provide a model for other legislatures that are contemplating regulation.

Scope

Unlike the Colorado Privacy Act, the law applies to all developers and deployers (i.e., companies) using “high-risk artificial intelligence systems” that do business in Colorado, regardless of the number of consumers effected.

High-Risk AI Systems

The law defines “high-risk AI systems” as those that make or are a substantial factor in making “consequential” decisions. It defines a “substantial factor” as a factor that assists in making a consequential decision, is capable of altering the outcome of a substantial decision, or is generated by an AI system. Some AI systems that are explicitly considered “high-risk AI systems” under the law include AI systems used in:

• Education enrollment or opportunity
• Employment or employment opportunity
• Financial or lending services
• Essential government services
• Health care services
• Housing
• Insurance
• Legal services

The law excludes AI systems that either: (i) perform narrow procedural tasks; or (ii) detect decision-making patterns or deviations from prior decision-making patterns and are not intended to replace or influence human assessment or review. The statute also excludes certain technologies, such as cybersecurity software and spam filtering, when they are not a substantial factor in making consequential decisions.

Algorithmic Discrimination

The law requires that both developers and deployers of high-risk AI systems use reasonable care to avoid algorithmic discrimination i.e., any condition that results in unlawful differential treatment or impact based on actual or perceived age, color, disability, ethnicity, genetic information, language barriers, national origin, race, religion, reproductive health, sex, veteran status, or other classifications. However, the law excludes any discrimination that may result from the use of a high-risk AI system by a developer or company deploying the system for the sole purposes of:

• Self-testing their own systems to identify and rectify incidents or risks of discriminatory behavior/outputs.
• Expanding an applicant, customer, or participant pool to increase diversity or redress historical discrimination.

The law also excludes any acts or omissions by a private club or other establishment that is not open to the public.

Developer Responsibilities

The law creates a rebuttable presumption that the developer of an AI system exercised reasonable care to avoid algorithm discrimination if the developer follows certain procedures in its development, including:

• Providing deployers of such high-risk AI systems with information about the system, including its purpose, intended benefits, intended use, operation, potential risks, and any known or foreseeable algorithmic discrimination. The developer must also provide information about how the system was trained and evaluated for performance and evidence of algorithmic discrimination.
• Providing deployers all documentation necessary to conduct an impact assessment of the high-risk AI system.
• Publicly making available information that summarizes the types of high-risk systems developed or intentionally modified by the developer.
• Providing deployers with information on how the developer themselves manages any reasonable or foreseeable risk of algorithmic discrimination in the development and in the event that the high-risk AI system is modified later.
• Disclosing to the Colorado State Attorney General and deployers any known or reasonably foreseeable risks of algorithmic discrimination within 90 days of being informed of such risks.

Developers who do not follow such procedures may face an uphill battle to prove that they have used reasonable care to avoid algorithmic discrimination.

User Responsibilities

Companies deploying these AI systems are also tasked with using reasonable care to protect consumers from any known or foreseeable risks of discrimination. The law creates a two-tier rebuttable presumption that the deployer of an AI system exercised reasonable care to avoid algorithmic discrimination if the organization follows certain procedures including:

For all users:

• Reviewing the deployment of each high-risk AI system at least annually for any evidence of algorithmic discrimination.
• Providing information to a consumer about consequential decisions concerning that consumer made by high-risk AI systems and providing consumers with an opportunity to correct any incorrect personal data that may be used in making such a consequential decision. Deployers must also provide consumers with an opportunity to appeal an adverse consequential decision made by a high-risk AI system through human review (if technically feasible).
• Disclosing that the high-risk AI system has or is reasonably likely to have caused algorithmic discrimination to the Colorado State Attorney General within 90 days of discovery.

Only for companies who, at all times that the high-risk AI system is deployed, meet all of the following requirements: (a) have more than fifty (50) full-time employees, (b) does not use the deployer’s own data to train the high-risk AI system; and (c) uses the high-risk AI system only for the intended uses disclosed by the deployer.

• Implementing risk management policies and programs for the high-risk AI system.
• Conducting an impact assessment of each high-risk AI system.
• Publicly making available information that summarizes the types of high-risk systems deployed, along with information on how the deployer manages any known or foreseeable risk of algorithmic discrimination.
• Publicly making available information regarding the nature, source, and extent of the information collected and used by the deployer in the high-risk AI system.

Additional Requirements

The law further requires that any developer or deployer that makes available any AI system that is intended to interact with consumers disclose to consumers that they are interacting with an AI system and not a live person.

Other Exclusions

The law does not apply to a developer or a deployer engaging in specified activities, including to comply with other federal, state, or municipal laws, cooperating and conducting specified investigations, taking steps to protect the life or physical safety of a consumer, and conducting certain research activities.

Enforcement

The law does not allow for a private right of action, and instead leaves exclusive enforcement to the Colorado State Attorney General. The Attorney General also has discretion under the statute to implement further rulemaking, including additional documentation and requirement rules for developers, requirements for notices and disclosures, requirements for risk management policies and impact assessments, scope and guidance adjustments related any rebuttable presumptions, and the requirements for the defenses to enforcement.

However, the law also provides developers and deployers with an affirmative defense if they are in compliance with other nationally or internationally recognized AI risk management frameworks specified either in the bill or by the Attorney General. Currently, this includes the NIST AI Risk Management Framework and ISO/IEC 42001.

Impacts to Business

The new law ultimately provides developers and companies deploying high-risk AI systems with a framework for how they can evaluate and use reasonable care to avoid algorithmic discrimination. While the new law doesn’t go into effect until February 1, 2026, developers and deployers of high-risk AI systems may need to devote significant resources to meeting their documentation and other obligations before the new law goes into effect.

Developers should begin the following actions to prepare for the new law:

• Begin to compile, or better yet, create at the time the high-risk AI system is conceptualized or created, all necessary documentation that needs to be disclosed to consumers or made available to deployers for them to conduct an impact assessment. Important to this documentation should be a description of how the developer trains the high-risk AI system and how it tests for and remediates potential algorithmic discrimination.
• Be prepared to respond and provide additional documentation to deployers of such high-risk AI systems who may require more detailed documentation or otherwise question the content of the documentation.
• Begin drafting the public statements regarding the types of high-risk systems that the developer has developed (or intentionally and substantially modified) and be prepared to describe and potentially defend how the developer manages known or foreseeable risk of algorithmic discrimination.
• Begin putting policies in place (with appropriate legal and other stakeholder review) for notifying the Attorney General of algorithmic discrimination caused or reasonably likely caused by the high-risk artificial intelligence system.

Users, on the other hand, should begin the following action items to prepare for the new law:

• Begin to develop a risk management policy and program that is based on a standard AI risk management framework, such as the NIST AI Risk Management Framework and/or ISO/IEC 42001.
• Begin developing an impact assessment for high-risk AI systems that they deploy, and be prepared to request more information from developers as necessary.
• Put processes in place to review each high-risk AI system for algorithmic discrimination at least once annually (more often if there is a significant change in the system or the use of such a system).
• Consider drafting form notices to consumers containing all required items if a high-risk AI system makes a consequential decision concerning the consumer, and provide consumers with an opportunity to appeal such a decision for human review.
• Begin developing procedures for consumers to correct any incorrect personal data used by high-risk AI systems. Businesses that are subject to the Colorado Privacy Act will already be familiar with providing consumers with the right to correct incorrect personal data and how to verify that the personal data was originally incorrect.
• Begin drafting the public statements regarding the types of high-risk systems that the currently deployed and information about how known or foreseeable risks of algorithmic discrimination are being managed. Businesses that are subject to the Colorado Privacy Act will already be familiar the requirement that these public statements also include the nature, source, and extent of information collected and used by the deployer.
• Begin putting policies in place (with appropriate legal and other stakeholder review) for notifying the Attorney General of algorithmic discrimination caused or reasonably likely caused by a high-risk AI system.

Both developers and deployers should also continue to monitor any further guidance from the Colorado State Attorney General. Based on the pattern of regulations issued by the Attorney General pursuant to the Colorado Privacy Act, additional regulations issued may be extensive and require more details than facially required by the law.

Further Reading

For a deeper dive into what this new law means for employers and the use of AI systems within the context of human resources, Â鶹´«Ă˝â€™s Labor & Employment team has created a primer on the expected impact. Click here to read the companion piece.

If you have any other questions regarding the requirements of this law, please contact any of the authors or other Partners or Senior Counsel in Â鶹´«Ă˝ & Lardner’s Artificial Intelligence area of focus.

The Federal Trade Commission (FTC) recently submitted a to the U.S. Copyright Office in response to its “Notice of Inquiry” in the Federal Register examining copyright issues related to artificial intelligence (AI). The FTC’s comment focuses largely on potential threats to competition from AI and potential unfair copyright practices involving AI. It further suggests that certain actions relating to AI may violate Section 5 of the Federal Trade Commission Act, even if the actions are otherwise consistent with copyright law.

FTC Concerns

Focusing on potential competitive threats from AI, the submission argues that “the rising importance of AI to the economy may further lock in the market dominance of large incumbent technology firms.” According to the FTC, many of these incumbents are vertically integrated and “control many of the inputs necessary for the effective development and deployment of AI tools, including cloud-based or local computing power and access to large stores of training data.” In turn, the comment cautions that such companies may have an incentive “to unlawfully entrench their market positions in AI and related markets including digital content markets.” In other words, the FTC’s concern is that if large, vertically integrated incumbent firms control all of the inputs for AI, then they may also control all of the AI’s decision-making, including decisions that might exclude or disadvantage competitors.

The FTC comment acknowledges that while “[m]any large technology firms possess vast financial resources that enable them to indemnify the users of their generative AI tools,” training an AI tool on protected content without the creator’s consent or selling output generated from such an application may potentially “constitute an unfair method of competition or an unfair or deceptive practice, especially when the copyright violation deceives consumers.” The FTC goes on to warn that it “will vigorously use the full range of its authorities to protect Americans from deceptive and unfair conduct” and notes that “[t]he FTC is empowered under Section 5 of the FTC Act to protect the public against unfair methods of competition, including when powerful firms unfairly use AI technologies in a manner that tends to harm competitive conditions.”

The FTC also emphasizes the potential for both consumers and creators to be harmed when authorship does not match up with consumer expectations, which can be exacerbated by AI practices. For example, according to the FTC, “deepfakes” – using AI to generate music, videos, text or images that have similar, but not identical, characteristics to the underlying source content – may potentially constitute a deceptive practice or an unfair method of competition.

Other threats to competition underscored by the FTC comment include that AI tools could be “used to facilitate collusive behavior” that unfairly inflates prices, causes price discrimination, or manipulates output. These types of AI compliance issues have been on the FTC’s radar for some time. As far back as 2017, the FTC was over purported “algorithmic collusion” the concept that adoption of AI-powered pricing algorithms across competitors can potentially constitute an anticompetitive agreement to set artificially inflated prices.

Other Recent Actions

While the comment to the U.S. Copyright Office raises more questions than it answers, recent actions signal an increased willingness on the FTC’s part to consider competition and consumer protection issues in AI. On November 21, the FTC authorized the use of civil investigative demands (CIDs) in nonpublic investigations involving AI-driven products and services. CIDs are compulsory and function like subpoenas, allowing for the collection of documents, information and testimony. , the authorization “streamlines” the FTC’s ability to issue CIDs. In practice, the resolution allows a single commissioner, instead of a majority of sitting commissioners, to approve compulsory process requests in any investigation within the scope of the resolution for the next 10 years. What practical effect this resolution will have remains to be seen; however, businesses engaged in conduct that may be implicated by the resolution should be aware that FTC staff will now have an expedited ability to carry out compulsory process requests, which will very likely increase the number and scope of investigations conducted by the FTC.

The FTC also recently revealed that it has collected more than on AI’s impact on the US$576 billion cloud computing industry. Most of these public comments addressed issues specifically related to competition, including software licensing practices, egress fees, and minimum spend contracts. With respect to minimum spend contracts, some of the public comments expressed concerns regarding the power of large incumbent technology firms, with some of the commenters pointing out that certain provisions in cloud computing contracts incentivize customers to consolidate their use of cloud services to a single cloud provider. Similarly, several commenters noted that egress fees assessed for moving data in or out of specific cloud environments could discourage customers from using multiple cloud providers or switching from one cloud environment to another.

FTC Chair Lina Khan was explicit about the agency’s focus on AI during a at Stanford University, noting “[t]he FTC is firing on all cylinders” with respect to AI. Khan reiterated that there “is no exemption from the laws on the books” for AI, and that the FTC will be “clear-eyed in ensuring that claims of innovation are not used as cover for lawbreaking.”

Impact

AI is rapidly evolving, and questions of law and liability certainly remain, but as federal scrutiny increases, companies and executives should be aware of the antitrust risks posed by incorporating AI into their businesses and take steps to ensure that such use complies with the antitrust laws. For example, companies should ensure that their AI practices do not unreasonably foreclose rivals, create unfair or coercive power asymmetries, facilitate collusion, or lead to unreasonably low standards of competition.

On November 14, 2023, the Wisconsin State Assembly passed , otherwise known as the Wisconsin Data Privacy Act (WDPA). The bill passed on its third reading and was immediately ordered to the Wisconsin State Senate. If passed by the senate and signed by the governor, the WDPA will become effective on January 1, 2025. As written, the WDPA closely mirrors other comprehensive state consumer privacy laws including Virginia, Colorado, and Connecticut, all of which are currently in effect.

Applicability

Subject to the exceptions described below, the WDPA is applicable to all persons that conduct business in Wisconsin or produce products or services that are targeted to Wisconsin residents and that meet either of the following criteria:

• Controls or processes the personal data of at least 100,000 Wisconsin residents (“consumers”) during a calendar year; and/or
• Controls or processes the personal data of at least 25,000 consumers and derives over 50% of gross annual revenue from the sale of personal data.

These persons are referred to as “controllers” under the WDPA. Like other state-level comprehensive consumer privacy laws except California, the WDPA does not have a revenue threshold.

Key Exemptions

The WDPA has broad entity and information exceptions. The entity exceptions include state and local agencies, financial institutions subject to the Gramm-Leach-Bliley Act (GLBA), HIPAA-covered entities or business associates, nonprofit organizations, and higher education institutions.

The WDPA also exempts employment and business-to-business information, unlike California. Other key exemptions include publicly available information, information governed by the Fair Credit Reporting Act, the Driver’s Privacy Protection Act, Family Educational Rights and Privacy Act, the Farm Credit Act, and the Children’s Online Privacy Protection Act. The WDPA also has a broad range of health-related exceptions, including information that is protected health information (PHI) regulated by HIPAA, the Cures Act of 2021, or any other federal or Wisconsin law governing health care information or records, and certain identifiable patient information related to clinical research and trials, among others.

Consumer Rights

The WDPA will provide Wisconsin residents with the following rights concerning their personal data:

• Right to Know/Access. Consumers have the right to confirm if a controller is processing the consumer’s personal data and to gain access to that personal data unless the confirmation requires the controller to reveal a trade secret.
• Right to Data Portability. Consumers have the right to receive a copy of their personal data in a portable and readily usable format so the data can be transmitted to a third party where processing is conducted by automated means; however, the controller will not be required to reveal a trade secret.
• Right to Correct. Consumers have the right to have inaccurate personal data corrected.
• Right to Delete. Consumers have the right to have their personal data deleted.
• Right to Opt-Out. Consumers have the right to opt-out of the following uses of their personal information:
  • Processing of their personal data for purposes of targeted advertising.
  • Selling their personal data for monetary consideration.
  • Automated decision-making that produce legal or similarly significant effects concerning the consumer.

Controllers will have 45 days to respond to consumer requests, with the option for one additional 45-day extension when reasonably necessary.

Business Obligations

The WDPA requires controllers to comply with certain obligations when processing personal data as follows:

• Consent for Processing Sensitive Data. A controller is prohibited from processing “sensitive data” about a consumer without the consumer’s consent. Under the WDPA, “sensitive data” includes personal data that reveals race or ethnicity, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status. Sensitive data also includes genetic or biometric data, the personal data collected from a child known to be younger than 13 years of age, and precise geolocation data within a radius of 1,750 feet.
• Data Processing Agreements. The WDPA will require controllers to enter into a data processing agreement (DPA) with each processor that processes personal data on behalf of the controller. The DPA must include clear instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and each party’s rights and obligations under the agreement.
• Data Protection Assessments. A controller must conduct and document a data protection assessment of the following processing activities: the processing of personal data for targeted advertising purposes, the sale of personal data, and the processing of personal information for the purpose of profiling (where the profiling presents a reasonably foreseeable risk of harm to the consumer). A controller is also required to weigh the benefits of each processing activity against the potential risks to the rights of consumers.
• Privacy Notices. A controller must provide a reasonably accessible, clear, and meaningful privacy notice that includes the categories of personal data processed by the controller, the purpose of processing personal data, how consumers can exercise their rights and how a consumer may appeal a controller’s decision not to comply with a consumer rights request, the categories of personal data that the controller shares with third parties, and the categories of third parties with whom the controller shares personal data. The privacy notice must also describe whether it sells personal data to a third party or whether it processes personal data for targeted advertising and clearly and conspicuously disclose such processing and how a consumer may exercise their right to opt-out of such processing. Finally, the privacy notice must describe one or more secure and reliable means for consumers to submit requests to exercise their rights.
• Other Requirements/Prohibitions. A controller must (i) limit the collection of personal data to what is adequate, relevant, and reasonably necessary for the disclosed purposes for which the data is processed; and (ii) establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data. A controller cannot (i) process personal data for purposes that are not reasonably necessary to the disclosed purposes unless the controller has received the consumer’s consent; or (ii) deny goods or services, charge different prices or rates for goods or services, or provide a different level of quality of good to the consumer because the consumer exercised their rights.

Enforcement

As written, the WDPA does not contain a private cause of action and will be enforced by the Wisconsin Attorney General. The WDPA provides that each violation by a controller may result in up to a US$7,500 penalty, plus recovery of the Attorney General’s reasonable expenses.

Impact to Businesses

Wisconsin is among a handful of other states looking to add to the existing patchwork of consumer privacy laws at the state level. Although the WDPA closely mirrors other comprehensive state consumer privacy laws, this is a good opportunity for organizations conducting business in Wisconsin to review their data programs to confirm these requirements are met. Organizations not subject to other state consumer privacy laws at this time will want to confirm if they will meet the thresholds in the WDPA (as currently proposed) and if so, ensure the organization will be ready to implement these requirements expeditiously should the WDPA be passed into law.

For more information about complying with the WDPA or any other consumer privacy laws, please contact any of the partners or senior counsel in Â鶹´«Ă˝ & Lardner’s Cybersecurity and Data Privacy team.

The author gratefully acknowledges the contributions of Lauren Hudon, a student at Marquette University Law School and Law Clerk at Â鶹´«Ă˝.