Colorado AI Act: Impact Assessment

Policy for the Colorado AI Act impact assessment obligation. Section 6-1-1703(3) requires deployers to complete impact assessments annually and within 90 days of any substantial modification to a high-risk AI system. Assessments must cover purpose, intended use, deployed context, data categories, outputs, transparency measures, and monitoring. Records must be maintained for at least three years following final deployment. This policy detects AI system modifications without updated impact assessments, missing assessment documentation, and gaps in the assessment lifecycle. Note: insurers regulated under the Colorado Division of Insurance are subject to separate AI governance requirements and are generally exempt from these provisions. Deployers with fewer than 50 employees that do not use their own fine-tuned models may qualify for small deployer exemptions under Sec. 6-1-1703(6).