How to Comply with Impact Assessment — Colorado AI Act

Conduct and document a risk-based impact assessment for high-risk AI systems.

Implementation steps

1. Identify whether your AI system is high-risk under the law.
2. Define scope: purpose, data, and affected populations.
3. Assess foreseeable risks of algorithmic discrimination and harm.
4. Document methodology, findings, and mitigation measures.
5. Review and update the assessment when the system or use changes.
6. Retain records for the period required by the regulation.

Evidence needed

• Impact assessment report
• Methodology documentation
• Risk findings and mitigations
• Review/update log

Passing criteria

• Assessment completed before deployment
• Documentation available to enforcer on request
• No discriminatory impact that was not assessed and mitigated