Colorado AI Act

Colorado requires a deployer to use reasonable care against algorithmic discrimination in a consequential decision. It also expects the affected person to be told, and to get a route to correct data and appeal. A team facing that duty has to show what happens inside the request, not only in the policy binder.

Colorado writes its rule around the decision, not around the data center. The law speaks to deployers of systems that help decide employment, credit, housing, insurance or health care. Counsel who reaches for this starter usually needs to show what the runtime actually does.

Because the obligation follows the decision, this starter carries no routing restriction. Traffic goes wherever your provider settings send it. That is a deliberate difference from the transfer starters in this category, where the destination itself is the control.

On the request side, masking hides national identifier patterns before the prompt is sent. Bias monitoring reads the returned answer using the built-in signal at its shipped setting, and no threshold is named here. Output scoring then requires a combined 0.86, with relevance at 0.78 and accuracy at 0.80.

Impact assessments, consumer notices and the appeal path stay outside the gateway. Nobody should read a passing score as a finding of fair treatment. The review point ships as an empty block, so the human check in your process is one you still have to configure. Audit marking labels an evaluated request and provides no storage by itself.