Automated Decision-Making Technology

SENATE BILL 26-189

BY SENATOR(S) Rodriguez and Coleman, Baisley, Amabile, Ball, Benavidez, Bridges, Cutter, Exum, Frizell, Kirkmeyer, Kolker, Lindstedt, Marchman, Pelton B., Pelton R., Rich, Simpson, Snyder; also REPRESENTATIVE(S) Duran and Bacon, Titone, Boesenecker, Brown, Caldwell, Carter, Clifford, English, Flanell, Goldstein, Gonzalez R., Hamrick, Jackson, Lieder, Lindsay, McCormick, Nguyen, Paschal, Rutinel, Slaugh, Smith, Story, Velasco, Winter T., McCluskie.

CONCERNING THE USE OF AUTOMATED DECISION-MAKING TECHNOLOGY IN CONSEQUENTIAL DECISIONS, AND, IN CONNECTION THEREWITH, MAKING AN APPROPRIATION.

Be it enacted by the General Assembly of the State of Colorado:

SECTION 1. In Colorado Revised Statutes, repeal and reenact, with amendments, part 17 of article 1 of title 6 as follows: PART 17 AUTOMATED DECISION-MAKING TECHNOLOGY IN CONSEQUENTIAL DECISIONS

6-1-1701. Definitions.

Capital letters or bold & italic numbers indicate new material added to existing law; dashes through words or numbers indicate deletions from existing law and such material is not part of the act.

AS USED IN THIS PART

17, UNLESS THE CONTEXT OTHERWISE

REQUIRES:

(1) "ADVERSE OUTCOME" MEANS: (a)

A

DECISION THAT DENIES, TERMINATES, REVOKES, OR

MATERIALLY REDUCES OR RESTRICTS A CONSUMER'S ACCESS TO, ELIGIBILITY FOR, SELECTION FOR, COMPENSATION FOR, OR THE PROVISION OF AN OPPORTUNITY OR SERVICE; OR

(b)

A DECISION THAT RESULTS IN MATERIALLY LESS FAVORABLE

DIFFERENTIATED PRICE, COST, COMPENSATION, OR OTHER MATERIAL TERMS THAT ARE REASONABLY LIKELY TO MATERIALLY LIMIT, DELAY, OR EFFECTIVELY DENY, OR OTHER WISE FUNDAMENTALLY ALTER, A CONSUMER'S ACCESS TO, ELIGIBILITY FOR, SELECTION FOR, COMPENSATION FOR, OR THE PROVISION OF AN OPPORTUNITY OR SERVICE COMPARED TO TERMS OFFERED TO SIMILARLY SITUATED CONSUMERS. IF A DECISION OUTCOME IMPOSES MATERIALLY LESS FA VO RAB LE DIFFERENTIATED PRICING OR TERMS, THE DECISION OUTCOME MATERIALLY INFLUENCES PRICE, COST SHARING, COMPENSATION, OR MATERIAL TERMS.

(2) (a) "AUTOMATED DECISION-MAKING TECHNOLOGY" OR "ADMT" MEANS A TECHNOLOGY THAT PROCESSES PERSONAL DATA AND USES COMPUTATION

TO

GENERATE

OUTPUT,

INCLUDING

PREDICTIONS,

RECOMMENDATIONS, CLASSIFICATIONS, RANKINGS, SCORES, OR OTHER INFORMATION THAT IS USED TO MAKE, GUIDE, OR ASSIST A DECISION, JUDGMENT, OR DETERMINATION CONCERNING AN INDIVIDUAL.

(b)

"AUTOMATED DECISION-MAKING TECHNOLOGY" OR "ADMT"

DOES NOT INCLUDE:

(I) THE FOLLOWING TECHNOLOGIES: (A) ANTI-MALWARE;

(B) ANTI-VIRUS; (C) CALCULATORS;

(D) DATABASES;

(E) DATA STORAGE; (F) FIREWALLS;

(G) INTERNET DOMAIN REGISTRATION; (H) INTERNET WEBSITE LOADING; (I) NETWORKING;

(J) SPAM- AND ROBOCALL-FILTERING; (K) SPELL-CHECKING; (L) SPREADSHEETS THAT REQUIRE HUMAN ANALYSIS AND DO NOT USE MACHINE LEARNING, FOUNDATION MODELS, OR LARGE LANGUAGE MODELS;

(M) WEB CACHING; OR (N) WEB HOSTING; (II) A TOOL USED BY AN INDIVIDUAL SOLELY TO SUMMARIZE, ORGANIZE, TRANSLATE, DRAFT, ROUTE, OR PRESENT INFORMATION FOR HUMAN REVIEW OF ADMINISTRATIVE PROCESSING; OR (III)

TECHNOLOGY THAT COMMUNICATES WITH CONSUMERS IN

NATURAL LANGUAGE OR OTHER MEANS READILY UNDERSTOOD BY AN AVERAGE CONSUMER FOR THE PURPOSE OF PROVIDING CONSUMERS WITH INFORMATION, MAKING REFERRALS OR RECOMMENDATIONS, ANSWERING QUESTIONS, OR GENERATING OTHER CONTENT, IF:

(A)

THE TECHNOLOGY IS NOT CONTRACTED, ADVERTISED,

MARKETED, CONFIGURED, OR INTENDED BY A PERSON TO BE USED IN A CONSEQUENTIAL DECISION; AND

(B) THE TECHNOLOGY IS SUBJECT TO AN ACCEPTABLE USE POLICY THAT PROHIBITS GENERA TED CONTENT TO BE USED IN A CONSEQUENTIAL

DECISION.

(3) (a) "CONSEQUENTIAL DECISION" MEANS: (I)

A DECISION, DETERMINATION, OR ACTION MADE ABOUT A

CONSUMER THAT RELATES TO THE PROVISION OF OR A CONSUMER'S ACCESS TO, ELIGIBILITY FOR, SELECTION FOR, OR COMPENSATION FOR A COVERED DOMAIN;OR

(II) A DECISION, DETERMINATION, OR ACTION ABOUT A CONSUMER THAT RELATES TO A DIFFERENTIATED PRICE, COST SHARING, COMP EN SATION, OR OTHER MATERIAL TERMS IN A MANNER THAT IS REASONABLY LIKELY TO MATERIALLY

LIMIT,

DELAY,

EFFECTIVELY

DENY,

OR

OTHERWISE

FUNDAMENTALLY ALTER THE CONSUMER'S ACCESS, ELIGIBILITY, OR OPPORTUNITY FOR A COVERED DOMAIN.

(b) "CONSEQUENTIAL DECISION" DOES NOT INCLUDE: (I) LOW-STAKES OR ROUTINE DECISIONS, ACTIONS, AND BUSINESS PROCESSES THAT DO NOT MATERIALLY INFLUENCE ELIGIBILITY FOR, SELECTION FOR, DENIAL OF, COMPENSATION FOR, PRICING OF, OR ACCESS TO AN OPPORTUNITY OR SERVICE FORA COVERED DOMAIN, INCLUDING ROUTINE SCHEDULING, CLASSROOM PERSONALIZATION, ADMINISTRATIVE ROUTING, CUSTOMER SERVICE TRIAGE, COMMUNICATION OF DECISIONS, OR WORKFLOW MANAGEMENT;

ADVERTISING,

MARKETING,

DIFFERENTIATED

PRODUCT

RECOMMENDATIONS, SEARCH, OR CONTENT MODERATION;

(111) SPREADSHEETS THAT REQUIRE MANUAL HUMAN ANALYSIS AND DO NOT USE MACHINE LEARNING, FOUNDATION MODELS, OR LARGE LANGUAGE MODELS;

(IV)

ACTIONS IN WHICH AN ADMT IS USED TO SUMMARIZE,

ORGANIZE, OR PRESENT INFORMATION FOR HUMAN REVIEW AND THE SYSTEM DOES

NOT

PRODUCE

A

SCORE,

RANKING,

RECOMMENDATION,

CLASSIFICATION, PREDICTION, OR OTHER INFERENCE THAT MATERIALLY INFLUENCES AN OUTCOME OR A DECISION;

(V) NARROW PROCEDURAL TASKS OR DATA-PROCESSING FUNCTIONS

THAT DO NOT GENERA TE A PREDICTION OR INFERENCE ABOUT A CONSUMER OR MATERIALLY INFLUENCE A CONSEQUENTIAL DECISION PROCESS; (VI)

ACTIVITIES

CONSEQUENTIAL

RELATING

TO

DECISION

TECHNOLOGIES

USED

OR

FOR

CYBERSECURITY, SPAM-AND ROBO-CALL FILTERING, SYSTEM RELIABILITY, AND ANTI-MONEY LAUNDERING AND COUNTER-TERRORIST FINANCING CONTROLS; (VII) ACTIVITIES RELATING TO TECHNOLOGIES USED FOR ECONOMIC SANCTIONS COMPLIANCE, INCLUDING UNDER THE FEDERAL "BANK SECRECY ACT", 12 U.S.C. SEC. 1951 ET SEQ.; THE FEDERAL "USA PATRIOT ACT", PUB.L. 107-56; THE FEDERAL TRADE COMMISSION'S RED FLAGS RULE, 16 CFR 681, AS AMENDED; AND SANCTIONS PROGRAMS ADMINISTERED BY THE UNITED STATES DEPARTMENT OF THE TREASURY, EXCLUDING FACIAL RECOGNITION UNLESS THE SOLE PURPOSE OF WHICH IS TO CONFIRM AN INDIVIDUAL'S IDENTITY; (VIII) ACTIVITIES RELATING TO TECHNOLOGIES USED FOR FRAUD PREVENTION,

INCLUDING

IDENTITY

VERIFICATION,

CONSUMER

IDENTIFICATION, MONITORING, AND REPORTING CONTROLS REQUIRED UNDER STATE OR FEDERAL LAW; OR

(IX) ROUTINE ACADEMIC ADMINISTRATION AND STUDENT SUPPORT PROCESSES THAT DO NOT MATERIALLY INFLUENCE A CONSEQUENTIAL DECISION.

(4) (a) "CONSUMER" HAS THE MEANING SET FORTH IN SECTION 6-1-1303 (6)(a).

(b) "CONSUMER" INCLUDES AN EMPLOYEE, A JOB APPLICANT WHO IS A COLORADO RESIDENT, AND ANY INDIVIDUAL WHOSE ACCESS TO, ELIGIBILITY FOR, OR OPPORTUNITY IN COLORADO IS EVALUATED IN A CONSEQUENTIAL DECISION BY A PERSON DOING BUSINESS IN COLORADO. (5)

"COVERED ADMT" MEANS AUTOMATED DECISION-MAKING

TECHNOLOGY THAT IS USED TO MATERIALLY INFLUENCE A CONSEQUENTIAL DECISION. (6) "COVERED DOMAIN" MEANS:

(a) AN EDUCATION ENROLLMENT OR AN EDUCATION OPPORTUNITY; (b) EMPLOYMENT ORAN EMPLOYMENTOPPORTUNITYTHATCREATES OR MAY CREATE AN EMPLOYER-EMPLOYEE RELATIONSHIP; (C) THE LEASE OR PURCHASE OF RESIDENTIAL REAL ESTATE IN COLORADO;

(d) A FINANCIAL OR LENDING SERVICE; (e) INSURANCE, INCLUDING UNDERWRITING, PRICING, COVERAGE, CLAIMS ADJUDICATION, OR OTHER DETERMINATIONS THAT MATERIALLY AFFECT ACCESS TO BENEFITS;

(t) HEALTH-CARE SERVICES; OR (g)

ESSENTIAL GOVERNMENT SERVICES AND PUBLIC BENEFITS,

INCLUDING ELIGIBILITY AND RENEWAL DETERMINATIONS.

(7) "DEPLOYER" MEANS A PERSON DOING BUSINESS IN COLORADO THAT DEPLOYS A COVERED ADMT. (8)

(a)

"DEVELOPER" MEANS A PERSON DOING BUSINESS IN

COLORADO THAT:

(I) DEVELOPS, OFFERS, SELLS, LEASES, LICENSES, OR OTHERWISE MAKES COMMERCIALLY AVAILABLE A COVERED ADMT;

DEVELOPS A COMPONENT THAT IS DESIGNED, MARKETED, INTENDED, DOCUMENTED, ADVERTISED, CONFIGURED, OR CONTRACTED TO BE USED AS PART OF A COVERED ADMT; OR

(III) INTENTIONALLY AND SUBSTANTIALLY MODIFIES AN ADMT SUCH THAT IT BECOMES A COVERED ADMT.

(b) "DEVELOPER" DOES NOT INCLUDE A PERSON THAT: (I) DEVELOPS AND USES AN ADMT: (A) SOLELY FOR RESEARCH PURPOSES AND THE ADMT IS NOT USED

IN A CONSEQUENTIAL DECISION IN THE RESEARCH; OR

(B) FOR INTERNAL PURPOSES, SUCH AS USE AND DEVELOPMENT ACTIVITIES BY AFFILIATES AND COMMERCIAL SUPPORT FUNCTIONS, AND THAT DOES NOT MAKE THE SYSTEM AVAILABLE TO ANOTHER PERSON FOR USE IN A CONSEQUENTIAL DECISION;

(II)

IS A PRECEDING DEVELOPER THAT MAKES AN ADMT

COMMERCIALLY AVAILABLE AND AN UNAFFILIATED PERSON MODIFIES THE COVERED ADMT IN A MANNER THAT CHANGES THE SYSTEM'S INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED USE; OR

(Ill)

HAS DESIGNED, MARKETED, INTENDED, DOCUMENTED,

ADVERTISED,CONFIGURED,ORCONTRACTEDACOMPONENTTHATISUSEDAS PART OF AN ADMT, BUT THE COMPONENT IS INTEGRATED INTO A COVERED ADMT WITHOUT THE ACTUAL KNOWLEDGE OF THE PERSON. (9) "EMPLOYEE" HAS THE MEANING SET FORTH IN SECTION 8-4-101

(5). ( 10) "EMPLOYER" HAS THE MEANING SET FORTH IN SECTION 8-4-101

(6). ( 11) "FERPA" MEANS THE FEDERAL "FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT OF 1974", 20 U.S.C. SEC. 1232g ET SEQ., AND ITS IMPLEMENTING REGULATIONS. (12)

"INTENTIONAL AND SUBSTANTIAL MODIFICATION" MEANS A

DELIBERATE CHANGE MADE TO AN ADMT THAT RESULTS IN A MATERIAL CHANGE TO THE SYSTEM'S

INTENDED,

DOCUMENTED,

ADVERTISED,

CONFIGURED, OR CONTRACTED USE. (13) (a) "MATERIALLY INFLUENCE" MEANS:

(I) AN ADMT OUTPUT IS A NON-DE MINIMIS FACTOR THAT IS USED IN MAKING A CONSEQUENTIAL DECISION; AND

(II)

AN

ADMT

OUTPUT

AFFECTS

THE

OUTCOME

OF

A

CONSEQUENTIAL DECISION, INCLUDING BY CONSTRAINING, RANKING,

SCORING, RECOMMENDING, CLASSIFYING, OR OTHERWISE MEANINGFULLY ALTERING HOW A CONSEQUENTIAL DECISION IS MADE.

(b) "MATERIALLY INFLUENCE" DOES NOT INCLUDE INCIDENTAL, TRIVIAL, OR CLERICAL USES.

(14) (a) "MATERIAL UPDATE" MEANS AN UPDATE, PATCH, RELEASE, REVISION, OR NEW VERSION OF A COVERED ADMT, INCLUDING ASSOCIATED SOFTWARE, MODEL PARAMETERS, DEFAULT SETTINGS, OR DOCUMENTATION, THAT A DEVELOPER KNOWS OR REASONABLY SHOULD KNOW IS LIKELY TO MATERIALLY AFFECT:

(I) THE COVERED AD MT'S OUTPUTS OR PERFORMANCE IN A MANNER RELEVANT TO ITS INTENDED USE; OR

(II) THE DEVELOPER'S STATED INTENDED USE FOR THE COVERED ADMT.

(b)

"MATERIAL

UPDATE"

DOES

NOT

INCLUDE

ROUTINE

MAINTENANCE, COSMETIC CHANGES, OR BUG FIXES THAT DO NOT MATERIALLY INFLUENCE:

(I) A COVERED ADMT'S OUTPUTS OR PERFORMANCE IN A MANNER RELEVANT TO ITS INTENDED USE; OR

(11) ADMT.

A DEVELOPER'S STATED INTENDED USE FOR THE COVERED

"MEANINGFUL HUMAN REVIEW" MEANS REVIEW BY A

INDIVIDUAL DESIGNATED BY THE DEPLOYER WHO HAS AUTHORITY TO APPROVE, MODIFY, OR OVERRIDE A CONSEQUENTIAL DECISION AND WHO:

(a) CONSIDERS RELEVANT, AVAILABLE PRIMARY EVIDENCE; (b) IS TRAINED TO CONDUCT THE REVIEW; (c) DOES NOT DEFAULT TO THE SYSTEM OUTPUT; AND (d) HAS ACCESS TO SUFFICIENT INFORMATION TO UNDERSTAND:

(I) THE OUTPUT'S: (A) INTENDED USE;

(8) MATERIAL LIMITATIONS; AND (C) CATEGORIES OF INPUTS; AND

(II) THE PRINCIPAL FACTORS USED TO GENERATE THE OUTPUT, WITHOUT REQUIRING DISCLOSURE OF PROPRIETARY SOURCE CODE, MODEL WEIGHTS, OR OTHER TRADE SECRETS. (16) "PERSONAL DATA" HAS THE MEANING SET FORTH IN SECTION 6-1-1303 (17). (17)

"TRADE SECRET" HAS THE MEANING SET FORTH IN SECTION

6-1-1702. Developer responsibilities - documentation. (1) ON AND AFTER JANUARY 1, 2027, A DEVELOPER SHALL MAKE AVAILABLE TO EACH DEPLOYER OF A COVERED ADMT DEVELOPED BY THE DEVELOPER,

IN

A

FORM

AND

MANNER

THAT

IS

REASONABLY

UNDERSTANDABLE TO A DEPLOYERAND THAT PROTECTS TRADE SECRETS OR INFORMATION PROTECTED FROM DISCLOSURE BY STATE OR FEDERAL LAW:

(a) A GENERAL STATEMENT DESCRIBING THE INTENDED USES AND KNOWN HARMFUL OR INAPPROPRIATE USES OF THE COVERED ADMT;

(b)

A DESCRIPTION OF THE CATEGORIES OF DAT A, INCLUDING

PERSONAL DATA, USED TO TRAIN THE COVERED ADMT, TO THE EXTENT KNOWN;

(c) KNOWN LIMITATIONS OF THE COVERED ADMT, INCLUDING KNOWN RISKS AND CIRCUMSTANCES IN WHICH THE COVERED ADMT SHOULD NOT BE USED;

(d)

INSTRUCTIONS FOR THE DEPLOYER'S APPROPRIATE USE,

MONITORING, AND MEANINGFUL HUMAN REVIEW, WHERE APPLICABLE;

(e) INFORMATION REASONABLY NECESSARY FOR THE DEPLOYER TO COMPLY WITH SECTION 6-1-1704. IF INFORMATION IS WITHHELD, THE DEVELOPER SHALL NOTIFY THE DEPLOYER.

(2) (a)

A DEVELOPER SHALL PROVIDE TO EACH DEPLOYER OF A COVERED ADMT DEVELOPED BY THE DEVELOPER A NOTICE OF MATERIAL UPDATES, INTENTIONAL AND SUBSTANTIAL MODIFICATIONS, AND CHANGES TO THE INTENDED USE OF, LIMITATIONS FOR, OR RISK MITIGATION FOR THE COVERED ADMT WITHIN A REASONABLE TIME.

(b) A DEVELOPER MAY USE PUBLIC RELEASE NOTES CONTA IN ING THE INFORMATIONREQUIREDBYSUBSECTION(2)(a)OFTHISSECTIONTOCOMPLY WITH THIS SUBSECTION (2) IF THE DEVELOPER PROVIDES DIRECT NOTICE OF THE PUBLIC RELEASE TO EACH DEPLOYER OF THE COVERED ADMT.

(3) A DEVELOPER IS SUBJECT TO THE DISCLOSURE REQUIREMENTS DESCRIBED IN SUBSECTIONS ( 1) AND (2) OF THIS SECTION ONLY FOR A DEPLOYER'S USE OF A COVERED ADMT WHERE THE ADMT WAS MARKETED, ADVERTISED, CONFIGURED, CONTRACTED, SOLD, OR LICENSED TO BE USED TO MATERIALLY INFLUENCE A CONSEQUENTIAL DECISION. ( 4) A DEVELOPER SHALL RETAIN, FOR NOT LESS THAN THREE YEARS AFTER THE CREATION OF A RECORD REQUIRED OR CREATED UNDER THIS SECTION OR FOR A LONGER PERIOD IF REQUIRED BY APPLICABLE STATE OR FEDERAL LAW, RECORDS REASONABLY NECESSARY TO DEMONSTRATE COMPLIANCE WITH THIS SECTION. RECORDS INCLUDE SYSTEM VERSION IDENTIFIERS, CHANGELOGS, AND DOCUMENTATION AND NOTICES OF MATERIAL UPDATES PROVIDED TO DEPLOYERS PURSUANT TO SUBSECTION (2) OF THIS SECTION.

(5) THIS SECTION APPLIES WHEN A DEVELOPER CREATES A COVERED ADMT THAT IS INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED TO BE USED TO MAKE CONSEQUENTIAL DECISIONS OR WHEN THE DEVELOPER BECOMES A WARE THAT THE COVERED ADMT IS BEING USED TO MAKE CONSEQUENTIAL DECISIONS IN A MANNER CONSISTENT WITH THE INTENDED AND CONTRACTED USES.

6-1-1703. Deployer record keeping. A DEPLOYER SHALL RETAIN, FOR NOT LESS THAN THREE YEARS AFTER

THE DATE OF A CONSEQUENTIAL DECISION OR FOR A LONGER PERIOD IF REQUIRED BY APPLICABLE STATE OR FEDERAL LAW, RECORDS REASONABLY NECESSARY TO DEMONSTRATE COMPLIANCE WITH THIS PART 17. RECORDS MAY INCLUDE, AS APPLICABLE, COVERED ADMT VERSION IDENTIFIERS, CHANGELOGS, AND DOCUMENTATION OF MATERIAL MITIGATION CHANGES.

6-1-1704. Deployer disclosures - point-of-interaction notice public posting option - post-adverse outcome disclosures - legislative declaration - trade secrets - compliance with other law - accessibility rules. ( 1) PRIOR TO A DEPLOYER USING A COVERED ADMTTO MATERIALLY INFLUENCE A CONSEQUENTIAL DECISION, THE DEPLOYER SHALL PROVIDE A CLEAR AND CONSPICUOUS NOTICE TO A CONSUMER THAT THE DEPLOYER USED OR WILL USE A COVERED ADMT IN A CONSEQUENTIAL DECISION AFFECTING THE CONSUMER AND INSTRUCTIONS REGARDING HOW THE CONSUMER MAY OBTAIN THE ADDITIONAL INFORMATION DESCRIBED IN THIS SECTION.

(2) A DEPLOYER COMPLIES WITH SUBSECTION ( 1) OF THIS SECTION BY MAINTAINING A PROMINENT PUBLIC NOTICE THAT IS

REASONABLY

ACCESSIBLE AT POINTS OF CONSUMER INTERACTION, INCLUDING THROUGH A LINK OR POSTING THAT IS REASONABLY PROXIMATE TO THE INTERACTION OR TRANSACTION IN WHICH A CONSEQUENTIAL DECISION MAY OCCUR.

IF A DEPLOYER USES A COVERED ADMT TO MATERIALLY

INFLUENCE A CONSEQUENTIAL DECISION THAT RESULTS IN AN ADVERSE OUTCOME FOR A CONSUMER, THE DEPLOYER SHALL PROVIDE WITHIN THIRTY DAYS AFTER MAKING THE DECISION:

(a)

A PLAIN LANGUAGE DESCRIPTION OF THE CONSEQUENTIAL

DECISION AND THE

ROLE THE COVERED

ADMT

PLAYED

IN THE

CONSEQUENTIAL DECISION;

(b) INSTRUCTIONS AND A SIMPLE-TO-FOLLOW PROCESS TO REQUEST ADDITIONAL INFORMATION ABOUT THE COVERED ADMT AND THE INPUTS, INCLUDING THE NAME OF THE COVERED ADMT, THE COVERED ADMT VERSION NUMBER, IF APPLICABLE, THE COVERED ADMT DEVELOPER, AND THE TYPES, CATEGORIES, AND SOURCES OF PERSONAL DATA USED, TO THE EXTENT THE DEPLOYER RECEIVES THE NECESSARY INFORMATION FROM THE

PAGE I I-SENATE BILL 26-189

DEVELOPER IN COMPLIANCE WITH SECTION 6-1-1702; AND

(c)

AN EXPLANATION OF THE CONSUMER RIGHTS DESCRIBED IN

SECTION 6-1-1705 AND HOW TO EXERCISE THEM.

(4) (a) THE GENERAL ASSEMBLY F_INDS THAT THE SPECIFIC CONTENT AND FORMAT OF POST-ADVERSE OUTCOME DISCLOSURES MAY VARY ACROSS CONSEQUENTIAL DECISION DOMAINS. THE GENERAL ASSEMBLY INTENDS THATTHESPECIFICELEMENTSOFPOST-ADVERSEOUTCOMEDISCLOSURESBE FURTHER CLARIFIED THROUGH RULE-MAKING THAT ACCOUNTS FOR SECTOR-SPECIFIC PRACTICES WHILE ENSURING THAT CONSUMERS RECEIVE MEANINGFUL AND UNDERSTANDABLE INFORMATION ABOUT CONSEQUENTIAL DECISIONS.

(b)

ON OR BEFORE JANUARY 1, 2027, THE ATTORNEY GENERAL

SHALL ADOPT RULES TO CLARIFY AND IMPLEMENT THE POST-ADVERSE OUTCOME DISCLOSURE REQUIREMENTS SET FORTH IN SUBSECTION (3) OF THIS SECTION. RULES ADOPTED PURSUANT TO THIS SUBSECTION ( 4) MAY INCLUDE, AS APPROPRIATE:

(I)

RULES CLARIFYING THE CONTENT OF REQUIRED DISCLOSURES

RELATED TO THE TYPES, SOURCES, OR CATEGORIES OF PERSONAL DAT ATHA T A DEPLOYER MUST PROVIDE TO A CONSUMER FOLLOWING AN ADVERSE OUTCOME INVOLVING A COVERED ADMT PURSUANT TO SUBSECTION (3) OF THIS SECTION;

(II)

SECTOR-SPECIFIC GUIDANCE OR ILLUSTRATIVE EXAMPLES

TAILORED TO DIFFERENT COVERED DOMAINS;

(III)

STANDARDS FOR DESCRIBING THE ROLE OF THE COVERED

ADMT IN A CONSEQUENTIAL DECISION IN A MANNER THAT IS REASONABLY UNDERSTANDABLE TO A CONSUMER; AND

(IV) GUIDANCE ADDRESSING HOW THE DISCLOSURE REQUIREMENTS DESCRIBED IN THIS SECTION INTERACT WITH FEDERAL OR STATE LAWS THAT REQUIRE OR GOVERN NOTICES, EXPLANATIONS, OR ADVERSE OUTCOME DISCLOSURES. (5) NOTHING IN THIS SECTION REQUIRES A DEPLOYER TO DISCLOSE A TRADE SECRET OR INFORMATION PROTECTED FROM DISCLOSURE BY STATE

OR FEDERAL LAW. IF A DEPLOYER WITHHOLDS INFORMATION PURSUANT TO THIS SUBSECTION (5), THE DEPLOYER SHALL NOTIFY THE CONSUMER. (6) (a) A CREDITOR, WITH RESPECT TO A CONSEQUENTIAL DECISION INVOLVING THE OFFERING, THE DENIAL, THE PRICING, THE SERVICING, OR OTHER MATERIAL TERMS OF CREDIT, THAT IS REQUIRED TO PROVIDE AND THAT PROVIDES A NOTICE TO A CONSUMER PURSUANT TO THE FEDERAL "EQUAL CREDIT OPPORTUNITY ACT", 15 U.S.C. SEC.1691 ET SEQ., AND ITS IMPLEMENTING REGULATIONS, INCLUDING REGULATION B, 12 CFR 1002, AND, WHEN APPLICABLE, THE FEDERAL "FAIR CREDIT REPORTING ACT", 15 U.S.C. SEC. 1681 ET SEQ., COMPLIES WITH THE NOTICE OR DISCLOSURE REQUIREMENTS OF THIS SECTION THAT RELATE TO THE SAME DECISION OR ADVERSE OUTCOME IF THE NOTICE PROVIDED TO THE CONSUMER PURSUANT TO THE FEDERAL LAWS AND REGULATIONS DESCRIBED IN THIS SUBSECTION (6)(a) ALSO SATISFIES THE NOTICE OR DISCLOSURE REQUIREMENTS OF THIS SECTION.

(b)

IF A CREDITOR COMPLIES WITH THE FEDERAL LAWS AND

REGULATIONS DESCRIBED IN SUBSECTION (6)(a) OF THIS SECTION AND COMPLIES WITH SUBSECTION (6)(a) OF THIS SECTION, THE CREDITOR IS NOT REQUIRED TO PROVIDE A SEPARATE OR DUPLICATIVE NOTICE PURSUANT TO THIS SECTION. (c)

NOTHING IN THIS SUBSECTION (6) SHALL BE CONSTRUED TO

REQUIRE A CREDITOR TO PROVIDE ANY NOTICE OR DISCLOSURE IN A MANNER THAT IS PROHIBITED BY FEDERAL LAW.

(d) FORPURPOSESOFTHISSUBSECTION(6),ANOTICETHATCOMPLIES WITH THE FEDERAL LAWS AND REGULATIONS DESCRIBED IN SUBSECTION (6)(a) OF THIS SECTION AND COMPLIES WITH SUBSECTION (6)(a) OF THIS SECTION MAY INCLUDE A BRIEF STATEMENT INDICATING THAT A COVERED ADMT WAS USED TO MATERIALLY INFLUENCE THE CONSEQUENTIAL DECISION AND INSTRUCTIONS FOR HOW THE CONSUMER MAY OBTAIN ANY ADDITIONAL INFORMATION OR EXERCISE ANY RIGHTS PROVIDED UNDER THIS PART 17. (7) THIS PART 17 SHALL NOT BE CONSTRUED TO REQUIRE A PERSON TO MAKE A DISCLOSURE, PROVIDE AN EXPLANATION, OR FURNISH INFORMATION TO A CONSUMER TO THE EXTENT DOING SO WOULD BE PROHIBITED

BY

FEDERAL

LAW

OR

WOULD

COMPROMISE

THE

CONFIDENTIALITY OR INTEGRITY OF CYBERSECURITY, FRAUD PREVENTION, ANTI-MONEY LAUNDERING, COUNTER-TERRORIST FINANCING, OR ECONOMIC SANCTIONS COMPLIANCE PROGRAMS REQUIRED BYLAW. (8) A DEPLOYER OR DEVELOPER SHALL PROVIDE THE NOTICES AND DISCLOSURES REQUIRED BY THIS PART 17 IN A MANNER THAT IS REASONABLY ACCESSIBLE TO CONSUMERS WITH DISABILITIES AND CONSUMERS WITH LIMITED ENGLISH PROFICIENCY, CONSISTENT WITH APPLICABLE STATE AND FEDERAL LAW. (9) (a) FOR A CONSEQUENTIAL DECISION RELATING TO EDUCATION, A DEPLOYER THAT IS SUBJECT TO FERPA SATISFIES THE NOTICE AND DISCLOSURE REQUIREMENTS OF THIS SECTION BY PROVIDING NOTICE AND DISCLOSURES THROUGH PROCESSES AND CHANNELS THAT ARE CONSISTENT WITH FERPA AND THE DEPLOYER'S FERPA NOTICES AND STUDENT RECORD ACCESS PROCEDURES, INCLUDING, WHERE APPLICABLE, NOTICE TO A PARENT OR GUARDIAN OR AN ELIGIBLE STUDENT.

(b) A DEPLOYER THAT IS SUBJECT TO FERPA IS NOT REQUIRED TO ESTABLISH A SEPARA TE OR DUPLICATIVE NOTICE OR DISCLOSURE PROCESS IF THE DEPLOYER HAS ESTABLISHED A NOTICE OR DISCLOSURE PROCESS TO COMPLY WITH FERPA.

6-1-1705. Consumer rights - correction - human review and reconsideration - rules. (1) (a)

WHEN A CONSUMER EXPERIENCES AN ADVERSE OUTCOME

RES ULTING FROM A CONSEQUENTIAL DECISION IN WHICH A COVERED ADMT MATERIALLY INFLUENCES THE CONSEQUENTIAL DECISION, THE CONSUMER MAY REQUEST AND THE DEPLOYER SHALL PROVIDE IN RESPONSE TO THE REQUEST:

(I) CORRECTING

INSTRUCTIONS FACTUALLY

FOR REQUESTING INCORRECT

OR

PERSONAL

MATERIALLY

DATA

AND

INACCURATE

PERSONAL DATA USED IN A CONSEQUENTIAL DECISION THAT USED A COVERED ADMT CONSISTENT WITH SECTION 6-1-1306; AND

(II)

AN OPPORTUNITY FOR MEANINGFUL HUMAN REVIEW AND

RECONSIDERATION OF THE CONSEQUENTIAL DECISION, TO THE EXTENT COMMERCIALLY REASONABLE.

(b) FOR THE PURPOSES OF THIS SUBSECTION ( 1), THE EXCEPTIONS TO THE DEFINITION OF "CONSUMER" IN SECTION 6-1-1303 (6)(b) AND THE EXCEPTIONS IN SECTION 6-1-1304 (2)(k), (2)(n), AND (2)( o) DO NOT APPLY TO THE RIGHT TO REQUEST CORRECTION OF FACTUALLY INCORRECT OR MATERIALLY INACCURATE PERSONAL DATA PURSUANT TO THIS SUBSECTION

(1). (c)

SUBSECTION

CORRECTION OF EVALUATIONS.

(l)(a) OF THIS SECTION DOES NOT REQUIRE

OPINIONS,

PREDICTIONS,

SCORES,

OR

PROTECTED

(2) (a) FOR A CONSEQUENTIAL DECISION RELATING TO EDUCATION, A

DEPLOYER THAT

IS

SUBJECT TO

FERPA

COMPLIES

WITH

THE

REQUIREMENTS OF SUBSECTION ( 1) OF THIS SECTION THROUGH THE DEPLOYER'S EXISTING STUDENT RECORD

INSPECTION,

REVIEW, AND

AMENDMENT PROCEDURES AND ANY APPLICABLE DISTRICT COMPLAINT OR APPEAL PROCESS, IF THE DEPLOYER OFFERS A REASONABLE MECHANISM FOR A PARENT, GUARDIAN, OR ELIGIBLE STUDENT TO REQUEST CORRECTION OF MATERIALLY INACCURATE PERSONAL DATA AND RECONSIDERATION WHERE APPLICABLE UNDER THIS PART 17. (b) A DEPLOYER THAT IS SUBJECT TO FERPA IS NOT REQUIRED TO ESTABLISH A SEPARATE OR DUPLICATIVE CORRECTION OR HUMAN REVIEW AND RECONSIDERATION PROCESS IF THE DEPLOYER HAS ESTABLISHED A CORRECTION OR HUMAN REVIEW AND RECONSIDERATION PROCESS TO COMPLY WITH FERPA. (3)

ON OR BEFORE JANUARY 1, 2027, THE ATTORNEY GENERAL

SHALL ADOPT RULES TO CLARIFY AND IMPLEMENT THE REQUIREMENTS OF THIS SECTION.

6-1-1706. Enforcement by the attorney general - deceptive trade practice - right to cure - no private right of action - joinder rules reporting - repeal. (1) (a) THE ATTORNEY GENERAL SHALL ENFORCE THIS PART 17 THROUGH THE "COLORADO CONSUMER PROTECTION ACT", THIS ARTICLE 1. (b) VIOLATIONS OF THE DISCLOSURE REQUIREMENTS AND CONSUMER RIGHTS DESCRIBED IN SECTIONS 6-1-1702, 6-1-1703, 6-1-1704, AND

6-1-1705 ARE ENFORCEABLE EXCLUSIVELY BY THE ATTORNEY GENERAL WITHOUT REGARD TO ANY OTHER PROVISION IN THIS TITLE 6. (2) (a)

A VIOLATION OF THIS PART 17 IS A DECEPTIVE TRADE

PRACTICE AND IS SUBJECT TO THE PROVISIONS OF THE "COLORADO CONSUMER PROTECTION ACT", THIS ARTICLE 1.

(b) ANY PROVISION OF THE "COLORADO CONSUMER PROTECTION ACT", THIS ARTICLE 1, THAT IS INCONSISTENT WITH THE EXCLUSIVE ENFORCEMENT AUTHORITY GRANTED TO THE ATTORNEY GENERAL IN THIS SECTION FOR A VIOLATION OF THIS PART 17 DOES NOT APPLY TO ANY SUCH VIOLATION. (3) (a) PRIOR TO ANY ENFORCEMENT ACTION FOR A VIOLATION OF THIS PART 17, THEATTORNEYGENERALSHALLISSUEA NOTICE OF VIOLATION TO A DEVELOPER OR DEPLOYER IF A CURE IS DEEMED POSSIBLE BY THE ATTORNEY GENERAL.

(b) IF THE DEVELOPER OR DEPLOYER FAILS TO CURE A VIOLATION WITHIN SIXTY DAYS AFTER RECEIPT OF A NOTICE OF VIOLATION, THE ATTORNEY GENERAL MAY BRING AN ACTION PURSUANT TO THIS SECTION.

(C) IF THE ATTORNEY GENERAL FINDS AND CAN DEMONSTRATE THAT A DEVELOPER OR DEPLOYER KNOWINGLY VIOLATED THIS PART 17 OR A DEVELOPER OR DEPLOYER REPEATEDLY VIOLATED THIS PART 17, THE ATTORNEY GENERAL IS NOT REQUIRED TO PROVIDE A CURE PERIOD BEFORE SEEKING PENALTIES OR OTHER RELIEF.

(d)

IF A VIOLATION IS DISCOVERED IN THE COURSE OF AN

ENFORCEMENT ACTION, A COURT MAY CONSIDER THAT A DEVELOPER OR DEPLOYER CURED THE VIOLATION WITHIN SIXTY DAYS AFTER RECEIPT OF WRITTEN NOTICE AS A MITIGATING FACTOR IN DETERMINING CIVIL PENALTIES OR OTHER MONETARY RELIEF, IF ANY.

(e) BEGINNING IN JANUARY 2028, AND IN JANUARY EVERY YEAR THEREAFTER, THE ATTORNEY GENERAL SHALL INCLUDE, AS PART OF THE 1

DEPARTMENTOFLAW SPRESENTATIONDURINGITS SMARTACT HEARING REQUIRED BY SECTION 2-7-203, A REPORT CONCERNING ENFORCEMENT ACTIONS BROUGHT AND CURE PERIODS OFFERED BY THE ATTORNEY GENERAL RELATED TO VIOLATIONS OF THIS PART 17, INCLUDING:

(I) THE NUMBER OF ACTIONS FILED BY THE ATTORNEY GENERAL AGAINST DEVELOPERS AND DEPLOYERS, RESPECTIVELY; (II) THE NUMBER OF ACTIONS FILED BY THE ATTORNEY GENERAL AGAINST DEVELOPERS AND DEPLOYERS, RESPECTIVELY, THAT WERE COMPLETED; (III) THE NUMBER OF CURE PERIODS OFFERED BY THE ATTORNEY GENERAL TO DEVELOPERS AND DEPLOYERS, RESPECTIVELY;

(IV) THE NUMBER OF CURE PERIODS OFFERED BY THE ATTORNEY GENERAL THAT WERE NOT MET BY DEVELOPERS AND DEPLOYERS, RESPECTIVELY; AND

(V) THE NUMBER OF VIOLATIONS FILED BY THE ATTORNEY GENERAL AGAINST DEVELOPERS AND DEPLOYERS, RESPECTIVELY, WHERE A CURE PERIOD WAS NOT DEEMED POSSIBLE.

(f) THIS SUBSECTION (3) IS REPEALED, EFFECTIVE JANUARY 1, 2030. (4) NOTHING IN THIS PART 17 CREATES A NEW PRIVATE RIGHT OF ACTION. NOTHING IN THIS PART 17 LIMITS OR REDUCES ANY EXISTING RIGHTS OR REMEDIES AVAILABLE UNDER STATE OR FEDERAL LAW, INCLUDING THE "COLORADO ANTI-DISCRIMINATION ACT", PARTS 3 TO 8 OF ARTICLE 34 OF TITLE 24; THE "COLORADO CONSUMER PROTECTION ACT", THIS ARTICLE 1; PRODUCT LIABILITY LAW; OR OTHER APPLICABLE LAW.

(5) (a) THE ATTORNEY GENERAL MAY ADOPT RULES AS NECESSARY TO IMPLEMENT AND CLARIFY THIS PART 17.

(b) THE ATTORNEY GENERAL MAY ADOPT RULES TO CLARIFY THE APPLICATION OF THE DEFINITION OF "MATERIALLY INFLUENCE", AS DEFINED IN SECTION 6-1-1701

(13), INCLUDING PRESUMPTIONS, ILLUSTRATIVE

EXAMPLES, AND OBJECTIVE INDICATORS.

(c) IN ADOPTING RULES PURSUANT TO THIS PART 17, THE ATTORNEY GENERAL SHALL UTILIZE A PROCESS THAT MEANINGFULLY ENGAGES STAKEHOLDERS,

INCLUDING

CONSUMER

ADVOCATES,

DEPLOYERS,

DEVELOPERS, AND SECTOR REGULA TORS, THROUGH PUBLIC NOTICE, OPPORTUNITY FOR WRITTEN COMMENT, AND AT LEAST ONE PUBLIC HEARING

AND SHALL ADOPT RULES IN ACCORDANCE WITH SECTION 24-4-103. (6) NOTHING IN THIS PART 17 LIMITS THE ABILITY OF A PARTY TO JOIN NECESSARY OR PERMISSIVE PARTIES UNDER THE COLORADO RULES OF CIVIL PROCEDURE, INCLUDING RULES 19 AND 20 OF THE COLORADO RULES OF CIVIL PROCEDURE, IN ANY ACTION ARISING UNDER EXISTING LAW.

6-1-1707. Liability - fault - allocation - no joint and several liability - indemnification prohibited - effect on existing law. ( 1) A DEVELOPER OR DEPLOYER MAY BE HELD LIABLE IN AN ACTION ALLEGING UNLAWFUL DISCRIMINATION UNDER STATE ANTI-DISCRIMINATION LAWS, INCLUDING THE "COLORADO ANTI-DISCRIMINATION ACT", PARTS 3 TO

8 OF ARTICLE 34 OF TITLE 24, ARISING FROM A CONSEQUENTIAL DECISION MATERIALLY INFLUENCED BY A COVERED ADMT. (2) IN AN ACTION DESCRIBED IN SUBSECTION ( 1) OF THIS SECTION, FAULT SHALL BE ALLOCATED AMONG DEPLOYERS AND DEVELOPERS BASED ON THEIR RELATIVE FAULT FOR THE VIOLATION. (3) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO APPORTION LIABILITY TO A CLAIMANT WHERE SUCH APPORTIONMENT IS NOT PROVIDED FOR UNDER EXISTING LAW. ( 4) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO CREATE JOINT AND SEVERAL LIABILITY, EXCEPT TO THE EXTENT PERMITTED UNDER EXISTING LAW.

(5) (a)

A DEVELOPER IS LIABLE IN AN ACTION DESCRIBED IN

SUBSECTION ( 1) OF THIS SECTION ONLY TO THE EXTENT THAT:

(I) THE DEVELOPER'S COVERED ADMT WAS USED BY A DEPLOYER IN A MANNER THAT WAS INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED FOR BY THE DEVELOPER; AND

(II) THE DEVELOPER'S COVERED ADMT MATERIALLY INFLUENCED A CONSEQUENTIAL DECISION THAT GA VE RISE TO THE VIOLATION OF EXISTING LAW.

(b)

A DEVELOPER IS NOT LIABLE UNDER THIS SECTION FOR

VIOLATIONS OF EXISTING LAW ARISING FROM A DEPLOYER'S USE OF A COVERED ADMT IN A MANNER THAT WAS NOT INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED FOR BY THE DEVELOPER. (6) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO LIMIT THE LIABILITY OF A DEPLOYER FOR THE DEPLOYER'S INDEPENDENT ACTS OR OMISSIONS IN A CONSEQUENTIAL DECISION MATERIALLY INFLUENCED BY A COVEREDADMT,INCLUDINGUSINGANADMTINAMANNERTHATWASNOT INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED FOR BY THE DEVELOPER IF THE DEVELOPER OF THE COVERED ADMT COMPLIED WITH SECTION 6-1-1702. (7) (a)

NOTWITHSTANDING ANY OTHER PROVISION OF LAW, IF A

PROVISION OF A CONTRACT FOR THE USE OF AUTOMATED DECISION-MAKING TECHNOLOGY IN MAKING A CONSEQUENTIAL DECISION OR ANY OTHER CONTRACT BETWEEN A DEVELOPER AND DEPLOYER PURPORTS TO INDEMNIFY, DEFEND, OR HOLD HARMLESS OR HAS THE EFFECT OF INDEMNIFYING, DEFENDING, OR HOLDING HARMLESS THE INDEMNITEE FROM OR AGAINST ANY LIABILITY FOR DAMAGES PURSUANT TO THIS SECTION RESULTING FROM THE DEVELOPER'S OR DEPLOYER'S OWN ACTS OR OMISSIONS RELATED TO THE USE OF

AUTOMATED

CONSEQUENTIAL

DECISION-MAKING DECISIONS

IN

TECHNOLOGY

VIOLATION

OF

THE

IN

MAKING

"COLORADO

ANTI-DISCRIMINATION ACT", PARTS 3 TO 8 OF ARTICLE 34 OF TITLE 24, OR OTHER COLORADO ANTI-DISCRIMINATION LAW, THE PROVISION IS CONTRARY TO PUBLIC POLICY AND VOID.

(b) THE LIMITATIONS OF SUBSECTION (7)(a) OF THIS SECTION DO NOT APPLY TO A DEVELOPER WHERE THE USE OF THE COVERED ADMT IN MAKING A CONSEQUENTIAL DECISION WAS NOT INTENDED, DOCUMENTED, MARKETED, ADVERTISED, CONFIGURED, OR CONTRACTED FOR BY THE DEVELOPER IF THE DEVELOPER OF THE COVERED ADMT COMPLIED WITH SECTION 6-1-1702.

(C)

THIS SUBSECTION (7) DOES NOT OTHER WISE LIMIT THE

ENFORCEABILITY OF CONTRACT TERMS BETWEEN PARTIES ACTING IN A COMMERCIAL OR BUSINESS CAPACITY, EXCEPT TO THE EXTENT OTHERWISE PROVIDED BY APPLICABLE LAW.

(d) THIS SUBSECTION (7) DOES NOT PROHIBIT OR LIMIT ANY PERSON FROM OBTAINING OR MAKING A CLAIM ON APPLICABLE INSURANCE FOR ANY

APPLICABLE ALLEGED LIABILITIES OR RELATED LOSSES. (8) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO LIMIT, DISPLACE, OR OTHERWISE AFFECT ANY LIABILITY THAT A DEVELOPER OR A DEPLOYER MAY HA VE, SEPARATE AND APART FROM LIABILITY UNDER THIS SECTION, FOR A VIOLATION OF STATE LAW. COMPLIANCE WITH THE REQUIREMENTS OF THIS PART 17 IS NOT A DEFENSE TO AND DOES NOT OTHERWISE EXCUSE NONCOMPLIANCE WITH ANY APPLICABLE LAW. (9) THE USE OF AN ADMT IN A CONSEQUENTIAL DECISION DOES NOT EXCUSE, JUSTIFY, OR PROVIDE A DEFENSE TO ANY OBLIGATION OR LIABILITY UNDER STATE OR FEDERAL LAW, INCLUDING OBLIGATIONS AND LIABILITY RELATED TO DISCRIMINATION OR CONSUMER PROTECTION.

6-1-1708. Compliance with other legal obligations - insurers covered entities - disclosures. (1) (a) AN INSURER, AS DEFINED IN SECTION 10-1-102 (13), AND AFFILIATED ENTITIES THAT ARE SUBJECT TO THE REQUIREMENTS OF SECTION 10-3-1104.9 ARE IN COMPLIANCE WITH THIS PART 17 IN THE PRACTICE OF INSURANCE.

(b)

IF AN INSURER IS NOT DEEMED IN COMPLIANCE PURSUANT TO

SUBSECTION (l)(a) OF THIS SECTION, THE INSURER SHALL PROVIDE NOTICE AND DISCLOSURE OF ITS USE OF A COVERED ADMT IN MATERIALLY INFLUENCING A CONSEQUENTIAL DECISION REGARDING THE PRACTICE OF INSURANCE PURSUANT TO THE DISCLOSURE REQUIREMENTS OF SECTION 6-1-1704 (3), TO THE EXTENT APPLICABLE. (2) THIS SECTION DOES NOT LIMIT THE APPLICABILITY OF THIS PART 17 TO USES OF COVERED ADMT RELATED TO INSURER EMPLOYMENT OR INSURER EMPLOYMENT OPPORTUNITIES BY INSURERS AND AFFILIATED ENTITIES THAT ARE SUBJECT TO THE REQUIREMENTS

OF SECTION

10-3-1104.9. (3) (a) SECTIONS 6-1-1701, 6-1-1702, 6-1-1703, 6-1-1704, 6-1-1705, AND 6-1-1706 DO NOT APPLY TO A COVERED ENTITY WITHIN THE MEANING OF THE FEDERAL "HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996", 42 U.S.C. SECS. 1320d TO 1320d-9, AND THE REGULATIONS PROMULGATED UNDER THE FEDERAL ACT, ORA COVERED ENTITY'S BUSINESS

AS SOCIA TES FOR ANY SERVICES RENDERED TO A COVERED ENTITY, TO THE EXTENT THE COVERED ENTITY IS DOING BUSINESS IN COLORADO, EXCEPT FOR A CONSEQUENTIAL DECISION RELATED TO EMPLOYMENT OR AN EMPLOYMENT OPPORTUNITY.

(b) NOTWITHSTANDING SUBSECTION (3)(a) OF THIS SECTION, FOR A COVERED ENTITY THAT IS A HEALTH-CARE PROVIDER, AS DEFINED IN 45 CFR 160 .103, THIS SUBSECTION (3) APPLIES ONLY IF THE HEALTH-CARE PROVIDER IS OPERATING FROM A LOCATION WITHIN COLORADO. (c) A COVERED ENTITY SHALL PROVIDE PATIENTS WITH A GENERAL NOTICE OF USE OF ADVANCED TECHNOLOGIES, INCLUDING A COVERED ADMT. THE NOTICE MAY BE INCORPORATED WITH OTHER NOTICES DESCRIBING PATIENT RIGHTS AND HOW THE COVERED ENTITY PROVIDES CARE. (d) NOTWITHSTANDING SUBSECTION (3)(a) OF THIS SECTION, A COVERED ENTITY THAT USES A COVERED ADMTTO DETERMINE A PATIENT'S ELIGIBILITY FOR FINANCIAL ASSISTANCE, INCLUDING DISCOUNTED CARE AS DESCRIBED IN SECTION 25.5-3-502, SHALL PROVIDE A PATIENT THE FOLLOWING DISCLOSURES: (I)

A PLAIN LANGUAGE DESCRIPTION OF THE CONSEQUENTIAL

DECISION AND THE ROLE OF THE COVERED ADMT IN THE CONSEQUENTIAL DECISION;

(II)

THE TYPES OF INFORMATION ABOUT THE INDIVIDUAL THE

COVERED ENTITY RELIED UPON IN MAKING ITS DETERMINATION OF ELIGIBILITY, EXCEPT FOR TRADE SECRETS AND OTHER CONFIDENTIAL OR LEGALLY PROTECTED INFORMATION;

(Ill)

INFORMATION ON HOW TO REQUEST CORRECTION OF

MATERIALLY INACCURATE PERSONAL DATA HELD BY THE COVERED ENTITY CONSISTENT WITH THE FEDERAL "HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996", 42 U.S.C. SECS. 1320d TO 1320d-9 AND SECTION 25.5-3-502; AND (IV)

INFORMATION ON HOW TO REQUEST MEANINGFUL HUMAN

REVIEW OR RECONSIDERATION, WHERE APPLICABLE.

(e) A COVERED ENTITY MAY COMPLY WITH SUBSECTION (3)(d) OF THIS SECTION THROUGH EITHER AN ADVANCE GENERAL DISCLOSURE OF THE INFORMATION REQUIRED BY SUBSECTION (3)(d) OF THIS SECTION OR THROUGH A NOTICE PROVIDED WITHIN THIRTY CALENDAR DAYS AFTER AN ADVERSE OUTCOME. THIS SECTION DOES NOT CREATE A SEPARATE AND DUPLICATIVE DISCLOSURE PROCESS OR APPEAL PROCESS IF THE REVIEW OPPORTUNITIES AND INFORMATION DESCRIBED IN SUBSECTION (3)( d) OF THIS SECTION ARE PROVIDED. (4) SECTIONS 6-1-1701, 6-1-1702, 6-1-1703, 6-1-1704, 6-1-1705, AND 6-1-1706 DO NOT APPLY TO A MEDICAL DEVICE SUBJECT TO OVERSIGHT BY THE UNITED STATES FOOD AND DRUG ADMINISTRATION OR A PHARMACEUTICAL OR MEDICAL DEVICE MANUFACTURER'S RESEARCH AND DEVELOPMENT ACTIVITIES THAT ARE SUBJECT TO OVERSIGHT BY THE UNITED STATES

FOOD

AND

DRUG

ADMINISTRATION,

INCLUDING

CLINICAL

INVESTIGATIONS CONDUCTED UNDER 21 CFR 312. (5) NOTHING IN THIS PART 17 REQUIRES A COVERED ENTITY OR BUSINESS ASSOCIATE, AS THOSE TERMS ARE DEFINED UNDER THE FEDERAL "HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996", 42 U.S.C. SECS. 1320d TO 1320d-9, TO DISCLOSE PROTECTED HEALTH INFORMATION OR OTHER INFORMATION IN A MANNER THAT WOULD VIOLATE FEDERAL LAW. TO THE EXTENT COMPLIANCE WITH SECTION 6-1-1704 OR 6-1-1705 WOULD CONFLICT WITH FEDERAL HEALTH PRIVACY REQUIREMENTS, THE DEPLOYER SHALL COMPLY WITH APPLICABLE FEDERAL LAW AND PROVIDE DISCLOSURES AND ACCESS CONSISTENT WITH THAT LAW. (6)

THIS PART 17 DOES NOT REQUIRE A PERSON TO DISCLOSE

NONPUBLIC PERSONAL INFORMATION IN A MANNER THAT WOULD VIOLATE THE FEDERAL "GRAMM-LEACH-BLILEY ACT", 15 U.S.C. SEC. 6801 ET SEQ., OR ITS IMPLEMENTING REGULATIONS.

6-1-1709. No new private right of action - application of other law. (1) NOTHING IN THIS PART 17 CREATES A NEW PRIVATE RIGHT OF ACTION. (2)

COMPLIANCE WITH THIS PART 17 DOES NOT CONSTITUTE A

DEFENSE TO AND DOES NOT EXCUSE NONCOMPLIANCE WITH ANY APPLICABLE

LAW.

SECTION 2. In Colorado Revised Statutes, 6-1-105, add ( 1)(uuuu) as follows: 6-1-105. Unfair or deceptive trade practices.

( 1) A person engages in a deceptive trade practice when, in the course of the person's business, vocation, or occupation, the person: (uuuu) VIOLATES PART 17 OF THIS ARTICLE I. SECTION 3. In Colorado Revised Statutes, 10-3-1104.9, add (3)(e) as follows: 10-3-1104.9. Insurers' use of external consumer data and information sources, algorithms, and predictive models - unfair discrimination prohibited - rules - stakeholder process required investigations - definitions.

(3) (e) THE COMMISSIONER MAY ADOPT NEW RULES OR UPDATE EXISTING RULES REGARDING NOTICE AND DISCLOSURES FROM INSURERS TO CONSUMERS. SECTION 4. Appropriation. For the 2026-27 state fiscal year, $46, 190 is appropriated to the department oflaw. This appropriation is from the general fund and is based on an assumption that the department will require an additional 0.4 FTE. To implement this act, the department may use this appropriation for consumer protection, antitrust, and civil rights. SECTION 5. Effective date - applicability. (1) Except as otherwise provided in subsection (2) of this section, this act takes effect January 1, 2027.

(2) Sections 6-1-1704 (4), 6-1-1705 (3 ), and 6-1-1706 (6), Colorado Revised Statutes, as amended in section 1 of this act, section 10-3-1104.9 (3 )( e), Colorado Revised Statutes, as enacted in section 3 of this act, section 4 of this act, this section, and section 6 of this act take effect upon passage. (3) This act applies to consequential decisions made on or after

January 1, 2027.

SECTION 6. Safety clause. The general assembly finds , determines, and declares that this act is necessary for the immediate preservation of the public peace, health, or safety or for appropriations for the support and maintenance of the departments of the state and state institutions.

Julie McCluskie SPEAKER OF THE HOUSE OF REPRESENTATIVES

James Rashad Coleman, Sr. PRESIDENT OF THE SENATE

Vanessa Reilly CHIEF CLERK OF THE HOUSE OF REPRESENTATIVES

Esther van Mourik SECRETARY OF THE SENATE

APPROVED on Thursday May 14th 2026 at 10:45am (Date and Time)

Jared S. Polis GOVERNOR OF THE STATE OF COLORADO