We Get AI for Work: Lifting the Veil on Colorado's AI Act

Transcript

INTRO

Artificial intelligence is revolutionizing the workplace, offering unprecedented opportunities for innovation and efficiency. The Colorado AI Act stands at the forefront of this transformation, ensuring that AI is used responsibly and ethically. This pioneering legislation aims to eliminate algorithmic bias, fostering a fair and inclusive environment while promoting the innovative application of AI technologies.

On this episode of We get AI for work, we discuss what makes the Colorado AI Act different from other emerging laws and regulations and how developers and vendors offering AI tools must ensure they have used reasonable care to remain legally compliant and avoid unfairness.

Today's hosts are Eric Felsberg and Joe Lazzarotti, principals in the Long Island and Tampa offices of Jackson Lewis and leaders of the firm's AI Services Group. They are joined by special guest Michelle Duncan, principal in Denver office and member of the AI Services Group.

Eric, Joe, and Michelle, given the consequential decisions employers and deployers must consider when using AI tools responsibly, the question on everyone's mind today is: What are the main provisions that distinguish Colorado's AI law from other jurisdictions, and how does that impact my organization? 

CONTENT

Eric J. Felsberg 

Principal and Artificial Intelligence Group Co-Leader

Hello again, everyone. Welcome back to this installment of AI at Work. My name's Eric Felsberg, and I'm joined by my colleague, Joe Lazzarotti. We have a great topic today, the Colorado AI Act and all of its many features. And to do that, we are thrilled to have a special guest with us today, Michelle Duncan, my friend and principal from our Denver office. Welcome, Michelle. 

Michelle L. Duncan

Principal

Thank you, Eric. Great to be here.

Felsberg

Yes, we're happy to have you. So, Michelle, we have been discussing a lot of AI-related requirements on this podcast, but Colorado seems to be among the most far-reaching with its AI acts. What exactly is being regulated here? Y

Duncan

You're right, Eric. This is one of the most comprehensive AI laws that we've seen to date. Interesting that a very similar law was proposed in Connecticut but was not ultimately enacted, so Colorado is on the cutting edge here. 

One of the main features that distinguishes this law from others is that it requires developers of AI tools or high-risk artificial intelligence systems to use reasonable care. It's really a consumer protection law at its core, so, the language you will notice is framed in protecting consumers from known or reasonably foreseeable risks of — and I'm using air quotes here — algorithmic discrimination in a high-risk system. That's a lot to unpack. 

Joseph J. Lazzarotti 

Principal and Privacy, Data and Cybersecurity Group and Artificial Intelligence & Automation Group Co-Leader

That's interesting, Michelle. Can you dig in a little bit and help us understand what the statute means when they say a high-risk system?

Duncan

Absolutely. The first important consideration is whether a system is used to make or assist a human in making what is called consequential decisions. They're trying to tease out what are the most high-risk or most important decisions that may impact an individual in the state of Colorado. It's incredibly broad what has been listed as possible consequential decisions. 

So, I just want to be really clear: I'm an employment lawyer. We're with Jackson Lewis, we do employment law. This law certainly covers employment and employment opportunities as being consequential decisions, but it covers so much more than that. Consequential decisions can be defined as decisions involving education enrollment, financial lending, government services, healthcare, housing, insurance; so employment is just one small piece of a much bigger puzzle that Colorado is trying to legislate here. 

At its base, the state of Colorado is looking to ensure that these systems that use AI are not resulting in unfairness to the consumer — or in our world, an applicant or employee. Much of that will turn on whether the tool results in algorithmic discrimination. 

Lazzarotti

I know the statute refers to developers and deployers.  Help us understand that. Who might developers be that have this reasonable care obligation? 

Duncan

Yes, absolutely. It's really important because Colorado has enacted a law that places legal obligations not only on the user of an AI tool — in our world, employers often use AI tools as part of their hiring process. Under this framework, an employer who uses an AI tool as a selection procedure would actually be considered to be an employer of a high-risk AI system. There's nothing new there, right? Employers have always had obligations with respect to ensuring that their hiring practices or their processes do not result in disparate impact discrimination, which is often the theory of discrimination that we would look to when we're talking about AI tools. 

What's new here is that developers — we usually call them vendors; these are the companies that are offering these tools, bringing AI tools to the market, selling them to employers as their customers or clients — now for the first time ever actually have legal obligations in the state of Colorado to ensure that they have used reasonable care to avoid algorithmic discrimination. 

This is really one of the hallmark distinguishing factors of this law, that it really is the first one that is putting companies that develop these tools on the hook to be potentially liable if they don't do that in a way that aligns with consumer protection.

Lazzarotti

Okay, the bill draws this distinction. We have developers, have deployers, and deployers can be employers who are using AI for certain purposes and have an obligation also to use reasonable care to avoid algorithmic discrimination. I'd like two questions. First, I'm assuming based upon what you're saying that an employer could also be a developer, right? They're not just employers. I'm assuming that. Tell me if I'm off there. Then, also, maybe you can just address the rebuttable presumption that's in the law and give us a little more information about that. 

Duncan

You are right, Joe. The two definitions of employer and developer could apply to a single entity. If an employer, for example, developed in-house an AI system that it uses to assist or make selection decisions for its own hiring practices, then they could be both a developer of the AI tool as well as a deployer of the AI tool. 

Employers who both develop and deploy these tools, they're in the minority. The vast majority of the clients that we work with in this space are employers who have engaged a third-party vendor who essentially sold them a tool or a platform or software that is meant to be used for recruiting or hiring. So that's really the most common use case, the one where a third-party vendor is involved. 

In the past, vendors have been very reluctant to share a lot of details about their tools that they've developed. Many of them would claim that they're black-box algorithms — if they were to share detailed information about how the algorithm works, they would essentially be giving away their intellectual property; that the algorithmic methodologies that are used are really proprietary with respect to the vendors — and so the one interesting thing that has changed with the Colorado law is that now developers are required to disclose and assess the impact that the tools that they are selling may have out in the marketplace. That is something that we have not seen before. And for many employers, I think they will be sighing a sigh of relief because now we have Colorado state law that supports the requests that have been made for many, many years to vendors to provide information about how the tool was developed, what it's intended to be used for and how the tool works so that employers can determine whether they're legally defensible. 

Felsberg

Michelle, just to take that one step further: The way we understand this is that there's no private right of action here, right? So, any enforcement is left to the state attorney general's office. And interestingly, the attorney general also has discretion under the statute to implement further rulemaking. That's kind of an interesting aspect of this particular law. 

Duncan

No doubt. And Eric, I will tell you, there was a lot of uncertainty right up until Governor Polis signed this law. When he did sign it, he had a very clear message for the legislature in that he asked for continuing work to be done to ensure that the law is not going to operate against the state's ability to provide a home for high-tech companies to operate. There's this thinking that potentially this could discourage some of the vendors or developers of AI tools from locating or staying in Colorado because they will now have legal requirements that they haven't had in the past.

We expect the AG's office to certainly provide additional information, much like we saw in New York City, where we got some additional rulemaking as well as some clarifying questions and answers for the regulated community. We expect that here. But I would wager a bet that the law itself could change. So, we may see an actual amendment to the legislative text as well as rulemaking and clarification from the AG's office. 

Joe, back to your point: This is a consumer protection law, so the framework is slightly different than what we are used to seeing in the employment context. And essentially, there's a rebuttable presumption that deployers used reasonable care if they do XYZ, right? And the XYZ has not yet fully been defined, but we know that developers are required to implement some type of risk-management policy and program. And the state of Colorado points to NIST, which is the National Institute for Standards and Technology, as being one framework that would meet the requirement of using reasonable care. And then also the law provides that the AG's office, the Attorney General's office of Colorado, can also define a framework and that employers or deployers, developers, would have the ability to choose which risk management framework they will use. But part of that is creating policy-program-level sort of guardrails.

Then also there's a requirement to complete impact assessments and to notify consumers about the decisions that are being made using these AI tools. Also, developers are required to make publicly available statements summarizing the system, the data that's being used, and to disclose — and we'll see how frequently this happens — to the attorney general if the developer determines that its tool may result in algorithmic discrimination. So, there's a bit of a self -reporting on the discrimination piece as well.

I think the most significant lift for employers is going to be that the state of Colorado has adopted almost a Fair Credit Reporting Act-style notice and appeal process. So, when consumers are notified that a decision has been returned — presumably a negative decision, like a decision to not hire someone or to not advance them to interview — and that the decision was made by an AI tool, the consumer, the applicant, has the ability to reach out and essentially ask for specific information about what piece of information or sets of information was used by the AI system [as to] why they weren't selected. Also, they have a right to ask for an opportunity to correct data that may have been acted on as part of the AI system.

Eric, I can't even imagine what this is going to do to an employer's hiring process if you're having to respond to individual applicants in this way. 

Feslberg

I agree. And Michelle, just to go back to something you said a moment ago, which is how does the state reconcile this law where it's regulating AI but at the same time certainly [having] a desire to bring tech businesses to the state. We were speaking earlier how we've heard from the LinkedIn founder around this issue. I don't know if you could share with our audience kind of what Reid Hoffman's comment was, but kind of how you think that's going to play out in the state, if at all. 

Duncan

Yes. There was a recent AI summit that happened in Denver and the head of LinkedIn, as you mentioned, as well as the mayor of Denver were both on the stage together. And this law was being discussed. It's not really clear whether the current mayor is in favor of this law or not, but what was very clear from the messaging was that tech leaders believe that this will create a disincentive to tech companies doing business in the state of Colorado because there is no other state currently that requires this type of notice, disclosure, risk management framework. All of this is new with respect to developers of AI tools. 

I do think that being the first is always difficult. But I feel like we have been drinking from a fire hose with respect to the AI legislation. And even though Colorado was the first state to enact comprehensive legislation that puts the developers or vendors on the hook, I don't think it'll be the last. Certainly, we are watching other states, including the state of California, to see whether this framework and these requirements are picked up and sort of mirrored in other state legislation. I think there's more to come. And I will say that this certainly lifts the veil that the vendors have created around transparency and explainability of AI tools. So, you know, we'll see. 

Felsberg

Certainly, a lot to think about. So, Joe and Michelle, any last-minute takeaways?

Lazzarotti

I would only add two things. One, from what Michelle is describing, it sounds like many legislatures borrow from one another. We see the same kind of rebuttable presumption in the data security laws, for example. You can avoid some exposure in litigation if you take some steps, pursuant to certain frameworks, to have safeguards in place. So, it sounds like that's similar to what's going on here and, like many other things, having some risk management plans, some policies and procedures, impact assessments, these are all the kinds of best practices that it's really no time like the present to begin adopting. 

Duncan

Absolutely. Companies have been using artificial intelligence for decades. It feels new to us because it's only been in the last 10 years or so that it has made its way into the human resources area. My comments here would be don't be afraid of AI. We need to embrace it because it's here to stay. But you need to go in eyes wide open with respect to the partners that you bring in, especially when we're talking about using third-party vendors who are selling these AI tools.

There are some exemptions that are built into the Colorado AI law. Small employers, those who have 50 or less or less than 50 full-time employees in Colorado, those who only use the AI system as it is intended to be used by the developer, and also those employers who don't use their own data to train the AI system are potentially exempt from their requirements under the law. What that tells me is we need to be really careful and precise about who we partner with as well as the language that is included in your master services agreements or contracts with the vendor because you want to be able to set yourself up, if possible, to use these exemptions that may apply to employers. 

We're always happy to help and often get involved in discussions on behalf of our clients with vendors to make sure that we understand whether they will be able to help us stay compliant and to make sure that we can rely on the work that they do under the Colorado law to ensure that the system itself is not going to be problematic for the employer. 

Felsberg

Thank you both for a great discussion. And to our listeners, we hope you found this helpful and insightful. If you have any questions or would like to see a particular topic featured on this podcast, please feel free to email us at ai@JacksonLewis.com. 

With that, we thank you all.

OUTRO

Thank you for joining us on We get work™. Please tune into our next program where we will continue to tell you not only what’s legal, but what is effective. We get work™ is available to stream and subscribe to on Apple Podcasts, Libsyn, SoundCloud, Spotify and YouTube. For more information on today’s topic, our presenters and other Jackson Lewis resources, visit jacksonlewis.com.

As a reminder, this material is provided for informational purposes only. It is not intended to constitute legal advice, nor does it create a client-lawyer relationship between Jackson Lewis and any recipient.