AI in Medical Devices: Colorado SB 24-205, FDA Rules, and the Dual Compliance Problem

If your company deploys AI-enabled medical devices in Colorado, you are subject to two entirely separate regulatory frameworks operating simultaneously: **Federal:** FDA regulation of Software as a Medical Device (SaMD), including the FDA's Predetermined Change Control Plan for AI/ML-based devices, 510(k) clearance requirements, and post-market surveillance obligations. **State:** Colorado SB 24-205 classification of healthcare decisions as "consequential decisions," triggering algorithmic discrimination protections, bias audit requirements, consumer disclosure mandates, and the 60-day cure window enforcement mechanism. These frameworks were not designed to work together. FDA focuses on safety and efficacy. Colorado focuses on bias and discrimination. The overlap creates obligations that neither framework alone accounts for. Here is the critical insight most medical device companies miss: **FDA clearance does not satisfy Colorado SB 24-205.** A 510(k)-cleared AI diagnostic that produces disparate impact across protected classes triggers Colorado enforcement regardless of its FDA status.

Related: medical device bias audit guide · SB 24-205 compliance guide · bias audit process

Colorado SB 24-205 applies when AI makes or substantially influences a "consequential decision." In healthcare, this includes: **Definitely covered:** - Clinical decision support systems that recommend treatment paths - AI-powered diagnostic tools (radiology AI, pathology AI, dermatology screening) - Triage algorithms in emergency departments - Patient risk stratification models used for resource allocation - AI systems that influence insurance coverage or prior authorization decisions **Likely covered:** - Remote patient monitoring AI that triggers clinical alerts - Predictive models for patient deterioration (sepsis, cardiac events) - AI-driven drug interaction checkers that override physician decisions **Probably exempt:** - AI used purely for operational efficiency (scheduling, inventory) - Clinical research tools not used in patient care decisions - Administrative automation with no patient-facing impact The key question: **Does the AI output influence a decision about a patient's healthcare access, treatment, or cost?** If yes, it is almost certainly a consequential decision under SB 24-205.

**Bias monitoring:** - FDA requires clinical validation across representative populations, but does not mandate ongoing bias audits after clearance. - Colorado requires continuous monitoring for algorithmic discrimination, with regular bias audits against protected classes (race, sex, disability, age). **Disclosure:** - FDA requires device labeling and Instructions for Use (IFU). - Colorado requires consumer-facing disclosure that AI is being used in the decision, plus a mechanism for human review of the AI's recommendation. **Incident reporting:** - FDA requires Medical Device Reports (MDRs) for device malfunctions causing harm. - Colorado requires notification to the Attorney General within 90 days of discovering algorithmic discrimination, regardless of whether physical harm occurred. **The gap that catches companies:** A diagnostic AI could be performing perfectly by FDA safety standards while systematically producing lower accuracy rates for specific demographic groups. FDA does not flag this. Colorado does — and the penalty is up to $20,000 per violation.

The companies that will survive enforcement under both regimes are the ones building a unified evidence architecture now. **What this looks like in practice:** 1. **AI System Registry** — Document every AI-enabled device or algorithm with deployer-type classification (manufacturer vs. healthcare provider), FDA clearance status, and Colorado risk classification side by side. 2. **Bias Audit Trail** — Monthly automated audits that test for disparate impact across protected classes. This satisfies Colorado's continuous monitoring requirement while also supporting FDA post-market surveillance commitments. 3. **NIST AI RMF Mapping** — The only codified legal defense under Colorado law. Map your risk controls to NIST AI RMF 1.0 and maintain timestamped evidence. This framework was explicitly endorsed by FDA in their 2024 guidance on AI/ML transparency. 4. **Consumer Disclosure Records** — Document every instance where patients were notified of AI involvement in their care decisions. Maintain the notification templates, delivery records, and opt-out/human-review requests. 5. **Incident Response Protocol** — A single workflow that satisfies both FDA MDR reporting timelines and Colorado AG 90-day notification requirements. These are different obligations with different triggers — your incident protocol needs to catch both. The organizations building this evidence infrastructure now are not doing it because enforcement is imminent. They are doing it because retroactively constructing a compliance defense after receiving a cure letter is functionally impossible for medical device AI.

When the Colorado AG issues a cure letter for a medical device AI violation, the 60-day clock creates a uniquely difficult problem: **Days 1-7:** Identify which statute applies (SB 24-205, not FDA — the AG has no jurisdiction over federal device regulation). Determine whether the violation is bias-related (disparate impact) or disclosure-related (failure to notify patients). **Days 8-30:** Produce evidence of "reasonable care." For medical devices, this means demonstrating NIST AI RMF alignment with clinical context — including how bias monitoring accounts for the specific patient populations the device serves. **Days 31-55:** Demonstrate the violation is cured. For a biased diagnostic algorithm, this might mean retraining the model, validating across affected populations, and re-deploying — which in a regulated medical device context may also require FDA notification of a device change. **The catch:** If your cure requires a device modification significant enough to trigger a new 510(k) submission, you may not be able to complete the cure within 60 days. The Colorado statute does not account for federal regulatory timelines. This is why pre-existing compliance documentation is not optional for medical device AI in Colorado. The cure window is for presenting your defense, not building it.