EveryAILaw.comDoes Colorado ADMT Act (SB 26-189) require Record-Keeping & Documentation?
Colorado • enacted
Yes — 2 provisions
Requirements at a glance
This regulation imposes 10 specific requirements for Record-Keeping & Documentation across 2 provisions:
- Form and protected information — Make subsection (1) documentation available to each deployer in a reasonably understandable form and manner that protects trade secrets and information protected from disclosure by state or federal law (§ 6-1-1702(1))
- Use statement — Developers must provide deployers a general statement of intended uses and known harmful or inappropriate uses of the covered ADMT (§ 6-1-1702(1)(a))
- Training data categories — Describe categories of data, including personal data, used to train the covered ADMT, to the extent known (§ 6-1-1702(1)(b))
- Known limitations — Disclose known limitations, risks, and circumstances in which the ADMT should not be used (§ 6-1-1702(1)(c))
- Human-review instructions — Provide instructions for the deployer's appropriate use, monitoring, and meaningful human review where applicable (§ 6-1-1702(1)(d))
- Deployer-compliance info — Provide information reasonably necessary for the deployer to comply with § 6-1-1704; notify the deployer if information is withheld (§ 6-1-1702(1)(e))
- Update notices — Provide notice of material updates, intentional and substantial modifications, and changes to intended use/limitations/risk mitigation within a reasonable time; public release notes permitted with direct notice of the release to each deployer (§ 6-1-1702(2))
- Recordkeeping — Retain records reasonably necessary to demonstrate compliance, including version identifiers, changelogs, documentation, and update notices, for at least 3 years after record creation or longer if applicable state or federal law requires (§ 6-1-1702(4))
- Retention period — Retain records for not less than 3 years after the date of a consequential decision (or longer if required by other law) reasonably necessary to demonstrate compliance with part 17 (§ 6-1-1703)
- Record contents — Records may include covered ADMT version identifiers, changelogs, and documentation of material mitigation changes (§ 6-1-1703)
Developer Documentation
Section 6-1-1702 applies when a developer creates covered ADMT intended, documented, marketed, advertised, configured, or contracted to make consequential decisions, or becomes aware it is being used to make such decisions consistently with its intended and contracted uses (§ 6-1-1702(5)). The subsection (1)-(2) disclosure duties apply only where the ADMT was marketed, advertised, configured, contracted, sold, or licensed to materially influence a consequential decision (§ 6-1-1702(3)). The definitions and exclusions for consequential decisions and covered ADMT still apply (§ 6-1-1701(3), (5)). Section 6-1-1708 provides sector qualifications. Qualifying insurers and affiliates are deemed compliant in the practice of insurance, but employment decisions remain covered. The HIPAA exclusion covers a covered entity doing business in Colorado and its business associates for services rendered to that covered entity, with an exception for employment and employment-opportunity decisions; for healthcare providers the subsection (3) treatment applies only when operating from a Colorado location. FDA-supervised medical devices and specified pharmaceutical or medical-device research and development activities are also excluded (§ 6-1-1708(1)-(4)).
Requirements
| Requirement | Details |
|---|---|
| Form and protected information | Make subsection (1) documentation available to each deployer in a reasonably understandable form and manner that protects trade secrets and information protected from disclosure by state or federal law (§ 6-1-1702(1)) |
| Use statement | Developers must provide deployers a general statement of intended uses and known harmful or inappropriate uses of the covered ADMT (§ 6-1-1702(1)(a)) |
| Training data categories | Describe categories of data, including personal data, used to train the covered ADMT, to the extent known (§ 6-1-1702(1)(b)) |
| Known limitations | Disclose known limitations, risks, and circumstances in which the ADMT should not be used (§ 6-1-1702(1)(c)) |
| Human-review instructions | Provide instructions for the deployer's appropriate use, monitoring, and meaningful human review where applicable (§ 6-1-1702(1)(d)) |
| Deployer-compliance info | Provide information reasonably necessary for the deployer to comply with § 6-1-1704; notify the deployer if information is withheld (§ 6-1-1702(1)(e)) |
| Update notices | Provide notice of material updates, intentional and substantial modifications, and changes to intended use/limitations/risk mitigation within a reasonable time; public release notes permitted with direct notice of the release to each deployer (§ 6-1-1702(2)) |
| Recordkeeping | Retain records reasonably necessary to demonstrate compliance, including version identifiers, changelogs, documentation, and update notices, for at least 3 years after record creation or longer if applicable state or federal law requires (§ 6-1-1702(4)) |
Penalties
| Violation | Fine |
|---|---|
| Non-compliance | Deceptive trade practice under the Colorado Consumer Protection Act; AG enforcement only, 60-day right to cure (only where the AG deems cure possible; unavailable for knowing or repeated violations, § 6-1-1706(3)(c); the whole cure subsection is repealed 2030-01-01, § 6-1-1706(3)(f)); no private right of action |
Sources: SB 26-189 Signed Act
Deployer Record-Keeping
Requirements
| Requirement | Details |
|---|---|
| Retention period | Retain records for not less than 3 years after the date of a consequential decision (or longer if required by other law) reasonably necessary to demonstrate compliance with part 17 (§ 6-1-1703) |
| Record contents | Records may include covered ADMT version identifiers, changelogs, and documentation of material mitigation changes (§ 6-1-1703) |
Penalties
| Violation | Fine |
|---|---|
| Non-compliance | Deceptive trade practice under the Colorado Consumer Protection Act; AG enforcement only, 60-day right to cure (only where the AG deems cure possible; unavailable for knowing or repeated violations, § 6-1-1706(3)(c); the whole cure subsection is repealed 2030-01-01, § 6-1-1706(3)(f)); no private right of action |
Sources: SB 26-189 Signed Act