{"id":870,"date":"2024-07-08T22:50:17","date_gmt":"2024-07-08T21:50:17","guid":{"rendered":"https:\/\/thethinkingmachine.uk\/?p=870"},"modified":"2024-07-08T23:07:29","modified_gmt":"2024-07-08T22:07:29","slug":"colorado-ai-act","status":"publish","type":"post","link":"https:\/\/thethinkingmachine.uk\/?p=870","title":{"rendered":"Colorado AI Act"},"content":{"rendered":"\n

The United States has moved slower than Europe and other places when it comes to regulating the internet and tech, but one state has emerged as a must follow when it comes to all things data privacy and protection, and it isn\u2019t California. <\/p>\n\n\n\n

California is the high profile name that tends to jumpstart conversations, but it has been Colorado that has been perhaps the most interesting state to track, due to its speed, forward-thinking mindset, ability to get laws passed, and modelability for future states to copy.<\/p>\n\n\n\n

Colorado, the third state to pass comprehensive data privacy legislation after California and Virginia, has been the first US State to pass a comprehensive law on artificial intelligence. (Utah claimed this honour but in fact the Utah law<\/a>\u00a0was not comprehensive but very narrow.\u00a0 Connecticut also came close but that bill died after the Governor refused to sign it. <\/p>\n\n\n\n

The Colorado AI Act<\/a>\u00a0 is a toned down version of the EU AI Act, and whilst Colorado\u2019s AI Act is 26 pages long against the EU AI Act which is over 150 pages, itt carries enough importance to set a meaningful precedent and takes a similar risk-based approach with the focus fully on high risk systems, being \u201cany artificial intelligence system that, when deployed, makes, or is a substantial factor in making a consequential decision.\u201d A consequential decision is where AI is used in relation to services to an individual relating to education enrollment or an education opportunity, employment, a financial, insurance, healthcare or legal services, housing or essential government services and potentially has huge ramifications as algorithms have been in place for years across many sectors doing this work. <\/p>\n\n\n\n

The Act imposes a duty to protect consumers from algorithmic discrimination or bias being any unlawful differential treatment or impact that disfavors an individual or group of individuals on the basis of their actual or perceived age, color, disability, ethnicity, genetic information, limited proficiency in the english language, national origin, race, religion, reproductive health, sex, veteran status, or other classification protected under the laws of this state or federal law and like the EU Act, requires transparency where developers must provide extensive documentation on how the system should work and possible risks (including risks to deployers of the AI) and having mandatory reporting requierments.\u00a0 Under the Act, developers and deployers must also adhere to mandatory AI Governance programs that align with NIST\u2019s new AI standards or ISO 42001 (the two specific standards called out in the law, or any future equivalent), and complete yearly data protection impact assessments (with additional DPIA requirements within 90 days of any \u201csubstantial\u201d alteration to a high risk AI system), although there appears to be a huge hole in the legislation with a \u201crebuttal presumption\u201d that companies can use if they practiced reasonable care and claim to have been in compliance with the AI Act. The Act will go into effect on February 1, 2026, but may be amended prior to enforcement. <\/p>\n\n\n\n

Colorado also amended its data privacy law, the\u00a0Colorado Privacy Act (CPA)<\/a>, to bolster children\u2019s privacy and biometric data this year in line with other States where biometric data has been subject to extensive reining-in although Colorado has amended the CPA to include protections for biometric identifiers and data similar in scope to Illinois\u2019s influential BIPA legislation, which is very restrictive. In contrast to California which regulates all employee data, Colorado will only regulate biometric employee data.<\/p>\n","protected":false},"excerpt":{"rendered":"

The United States has moved slower than Europe and other places when it comes to regulating the internet and tech, … <\/p>\n","protected":false},"author":1,"featured_media":873,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,15,23,2],"tags":[],"class_list":["post-870","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ethics","category-news","category-risk","category-us"],"_links":{"self":[{"href":"https:\/\/thethinkingmachine.uk\/index.php?rest_route=\/wp\/v2\/posts\/870","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thethinkingmachine.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thethinkingmachine.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thethinkingmachine.uk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thethinkingmachine.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=870"}],"version-history":[{"count":1,"href":"https:\/\/thethinkingmachine.uk\/index.php?rest_route=\/wp\/v2\/posts\/870\/revisions"}],"predecessor-version":[{"id":871,"href":"https:\/\/thethinkingmachine.uk\/index.php?rest_route=\/wp\/v2\/posts\/870\/revisions\/871"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thethinkingmachine.uk\/index.php?rest_route=\/wp\/v2\/media\/873"}],"wp:attachment":[{"href":"https:\/\/thethinkingmachine.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=870"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thethinkingmachine.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=870"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thethinkingmachine.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=870"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}