Colorado’s AI Act: How It Defines Algorithmic Discrimination

“Algorithmic discrimination” sounds like a new category of wrong invented for AI systems. In Colorado’s statute it is not. It is a pointer to discrimination law that already existed, applied to a decision an AI system was substantially involved in, and reading it that way explains almost everything about how narrow the Act is.

What the definition says

Senate Bill 24-205 defines the term in the definitions section of the new Part 17 of Article 1 of Title 6 of the Colorado Revised Statutes. In substance: algorithmic discrimination means any condition in which the use of an artificial intelligence system results in an unlawful differential treatment or impact that disfavours an individual or group of individuals on the basis of a listed protected characteristic, or on the basis of any other classification protected under the laws of Colorado or federal law. The enacted text is at the Colorado General Assembly.

Three components, then: a condition resulting from the use of an AI system, unlawful differential treatment or impact, and a protected basis. The disjunctive in the middle is deliberate and it is the part most worth noticing. Differential treatment is the intent-adjacent concept — the system treats people differently because of the characteristic. Differential impact is the outcome concept — the system treats everyone the same way and the results fall unevenly. Both are inside the definition.

The word that limits everything: unlawful

The definition does not say “differential treatment or impact”. It says unlawful differential treatment or impact. That single adjective means the Act does not itself decide what counts as discrimination. It incorporates by reference the body of law that already does — Title VII of the Civil Rights Act of 1964 for employment, the Fair Housing Act for housing, the Equal Credit Opportunity Act for credit, the Americans with Disabilities Act, the Colorado Anti-Discrimination Act, and the rest.

Two consequences follow, and they point in opposite directions. The Act is narrower than its name suggests: a measured disparity that would not be unlawful under any of those regimes — because it is justified by business necessity, because the disfavoured group is not protected in that context, or because the underlying conduct is simply not regulated — is not algorithmic discrimination, however uncomfortable it looks in a dashboard. But the Act is also anchored to a moving body of law: as courts and agencies develop the application of Title VII or the ECOA to automated decisions, the content of “algorithmic discrimination” in Colorado moves with them without a word of the statute changing. The EEOC’s position on Title VII and selection procedures is therefore directly load-bearing in Colorado.

The protected classes, including two unusual ones

The enumerated list runs to age, colour, disability, ethnicity, genetic information, limited proficiency in the English language, national origin, race, religion, reproductive health, sex, and veteran status, followed by the catch-all for any other classification protected under Colorado or federal law. The catch-all means the enumeration is illustrative rather than exhaustive, which is why arguing about whether a characteristic is on the list is usually the wrong argument.

Two entries deserve attention because they are not standard in federal employment discrimination law. Limited proficiency in the English language is a live risk in any system operating on free text: a model scoring written responses, a speech system with uneven accent performance, a chatbot triage flow. Fluency is not uniformly a protected characteristic federally, though it is often reachable through national origin, and naming it directly removes that step. Reproductive health is likewise unusual and matters for insurance, health and employee-benefit systems. If your subgroup testing plan was assembled from a federal template, these two are the ones most likely to be missing from it.

What is carved out

The definition excludes several things from being algorithmic discrimination, and the exclusions are as informative as the inclusions.

• Expanding the applicant pool. The offer, licence or use of an AI system for the purpose of a developer or deployer increasing diversity or redressing historical discrimination is outside the definition. Sourcing tools that widen a candidate pool are not caught by the fact that they treat groups differently in doing so.
• Self-testing. An act by a developer or deployer to expand an applicant pool or to conduct self-testing to identify, mitigate or prevent discrimination is excluded. This is the same incentive structure as the affirmative defence: the Act tries hard not to punish looking.
• Private clubs and other establishments not in fact open to the public are excluded, tracking a familiar carve-out from public-accommodation law.

The self-testing exclusion is the one that changes behaviour. Without it, a company running subgroup analyses would be generating evidence of differential impact that could be used against it. With it, the act of testing is not itself the condition the definition describes. This matters because the impact assessment the Act requires from deployers asks for exactly that analysis — see what an impact assessment must contain.

How it sits next to disparate impact

Federal disparate-impact doctrine under Title VII is a three-stage burden-shifting framework: the claimant shows that a facially neutral practice causes a significant adverse impact on a protected group; the employer shows the practice is job-related and consistent with business necessity; the claimant may still prevail by showing a less discriminatory alternative that serves the same interest. The Colorado definition does not restate that framework and does not replace it. Because of the word “unlawful”, the framework is what decides whether an observed impact is inside the definition at all.

The practical difference the Act makes is therefore not to the substantive test but to the duty. Title VII gives an individual a claim after the fact. The Colorado Act gives the Attorney General a way to ask, before any individual has sued, whether you took reasonable care against a foreseeable risk — and requires you to have documentation that answers. The standard is the same; the moment of accountability is much earlier. That is the point of the duty of care.

One more limit is worth stating plainly because it is unresolved everywhere, not only in Colorado. There is no statutory metric. Nothing in the Act says which disparity measure to use, at what threshold, on which population. The four-fifths rule from the federal Uniform Guidelines on Employee Selection Procedures is a rule of thumb in one sector, not a general legal test, and treating it as though the Colorado Act adopted it would be reading in something that is not there. What the Act requires is that whatever you did was reasonable and that you can say why.