Colorado AI Act
SB 24-205 deployer obligations for High-Risk AI Systems
Colorado SB 24-205 takes effect 2026-06-30 and applies to deployers of High-Risk AI Systems operating in Colorado or affecting Colorado residents. The Act requires measures to address algorithmic discrimination and requires deployers to implement risk-management programmes, conduct impact assessments, and notify affected parties on consequential decisions.
Asqav signs every AI agent action with ML-DSA, binds it to the deployer's policy artefact via policy_digest, and chains receipts so an auditor can reconstruct the period covered by an impact assessment without reading the underlying payload.
The receipt format is profiled in the IETF Internet-Draft draft-marques-asqav-compliance-receipts, which binds the format to Sections 6-1-1703(2), 6-1-1703(3), and 6-1-1703(7) of the Colorado Revised Statutes.
Obligations
| Section | Requirement | Asqav binding |
|---|---|---|
| 6-1-1703(2) | Implement a risk-management policy and programme for the High-Risk AI System. | policy_digest resolves through the audit pack to the deployer's risk-management policy in force at action time. Risk-bearing actions carry the risk_class extension. |
| 6-1-1703(3) | Complete an impact assessment annually and within 90 days of any intentional and substantial modification. | Query type, policy_digest, and previousReceiptHash to identify the receipts in the assessment window, including any policy changes within that period. |
| 6-1-1703(7) | On determination of algorithmic discrimination, record the determination and the affected actions. | Emit a protectmcp:lifecycle receipt naming the affected action_ref values and a reason code. |
Bring-your-own KMS, customer-owned storage, and on-prem mode are available for deployer profiles that disallow outbound traffic. See the docs for the full mapping and the IETF draft for the binding text.