What Are the Requirements for the AI Act Notice in Colorado?

Colorado SB 24-205 requires businesses to provide **consumer notice** whenever AI is used to make or substantially assist in making a "consequential decision." This isn't a suggestion — it's a legal mandate with penalties for non-compliance. The notice requirement serves two purposes: 1. **Transparency:** Consumers have a right to know when AI affects decisions about them 2. **Recourse:** Consumers must be informed of their right to contest AI-driven decisions This guide covers exactly what the notice must include, when it must be delivered, and the format requirements.

Related: complete SB 24-205 compliance guide · full disclosure requirements · human-in-the-loop documentation

Consumer notice is required whenever your AI system makes or substantially assists in a **consequential decision** — defined by SB 24-205 as decisions that have a material legal or similarly significant effect on: - **Employment:** Hiring, promotion, termination, compensation, assignments - **Financial services:** Lending, credit, insurance underwriting, pricing - **Healthcare:** Diagnosis, treatment recommendations, coverage, triage - **Housing:** Tenant screening, rental pricing, mortgage approvals - **Education:** Admissions, grading, financial aid, disciplinary actions - **Legal services:** Risk assessment, case evaluation, settlement recommendations **Key distinction:** The notice is required when AI *makes or substantially assists* the decision — not only when AI is the sole decision-maker. If a human reviews but routinely follows the AI's recommendation, notice is still required.

SB 24-205 requires the notice to contain specific elements. Missing any element puts you out of compliance: **Required elements:** 1. **Disclosure that AI is being used** — Plain language statement that an AI system is involved in the decision 2. **Description of the AI system's purpose** — What the AI does and what type of decision it's making 3. **Types of data used** — General categories of information the AI processes (not specific features, but categories like "employment history," "credit data," "demographic information") 4. **Right to opt out** — Information about how the consumer can request a human review or alternative process (where applicable) 5. **Right to contest** — How the consumer can appeal or dispute the AI's decision 6. **Contact information** — How to reach a human at your organization regarding the AI decision **Important:** The notice must be in **plain language** — not legal jargon, not technical descriptions. If a reasonable consumer can't understand the notice, it doesn't meet the standard.

Timing matters. SB 24-205 requires notice at two points: **1. Pre-decision notice (before the AI decision is made):** - Inform the consumer that AI will be used in the decision - Delivered before or at the time data is collected for the AI system - Example: A lending application page should disclose that AI-assisted underwriting will be used before the applicant submits their information **2. Post-decision notice (when an adverse decision is made):** - Required when the AI contributes to an adverse decision (denial, unfavorable terms, negative outcome) - Must include the specific factors that contributed to the decision - Must include instructions for contesting the decision - Must include information about requesting human review **Best practice:** Deliver both. Pre-decision notice at the point of interaction, post-decision notice with the outcome. CO-AIMS generates both automatically.

SB 24-205 doesn't mandate a specific format, but it requires notices to be: - **Clear and conspicuous** — Not buried in a terms of service document or privacy policy footer - **Plain language** — Written at a level the average consumer can understand - **Accessible** — Available in the same medium as the interaction (web notice for web interactions, written notice for mail-based processes) - **Timely** — Delivered at the appropriate pre-decision or post-decision window **Recommended formats:** - In-app banners or modals for web/mobile interactions - Dedicated disclosure page linked prominently from decision workflows - Email notifications with clear subject lines for email-based processes - Physical letters for mail-based processes (lending, insurance) **What NOT to do:** - Don't bury the notice in a 50-page privacy policy - Don't use technical AI jargon ("neural network inference" → "automated analysis") - Don't deliver notice only after the decision is finalized with no recourse information - Don't make the notice so generic it communicates nothing ("We may use technology to assist our processes")"

Don't confuse consumer notice with the AG notification requirement. They're different obligations: **Consumer notice:** Required for every consequential AI decision. Tells the individual about AI involvement. **AG notification:** Required within 90 days of discovering algorithmic discrimination. Notifies the Colorado Attorney General of the incident. Both are legally required. Both have separate content requirements. Missing either one is a violation. CO-AIMS generates consumer notices automatically and provides AG notification templates with pre-populated incident data.

Failing to provide adequate consumer notice is a violation of SB 24-205: - **$20,000+ per violation** — Each consumer not properly notified is a separate violation - **No cure window for pattern violations** — If your entire disclosure process is missing, this isn't a one-time mistake - **Compound with other violations** — If you also have bias issues AND missing notices, each is a separate enforcement action - **Reputational damage** — Consumer trust erodes when people discover AI was used without disclosure The notice requirement is one of the easiest parts of SB 24-205 to get right — and one of the most commonly overlooked. CO-AIMS auto-generates compliant notices for every AI system you register, customized to the decision type and delivery channel.