March 16, 2026 · Technology Committee · 5,455 words · 9 speakers · 76 segments
Joint technology will come to order. Mr. Gravy, will you please call the roll?
Senators and Representatives Baisley.
President.
Pascal.
Here.
Rodriguez.
Here.
Weinberg. Absent. Vice Chair Titone. I am here. Madam Chair.
Here. Okay, I do see that we have Jeffrey Reister joining us. Let me just kind of set the table for what I believe is ahead of us for today. We've invited the Attorney General's office to come in and provide some input for us as we're looking through the R1 statewide AI compliance. We need to take action on that today. Um, we also can consider taking action on the judiciary case management system. And I believe that's a big part of what we wanted. Um, hello, Jeffrey Reister on the meeting for. So with that, um, I am going to pass to Mr. Reister. Thank you for joining us today.
Thank you, Madam Chair, members of the committee. My name is Jeffrey Reister. I apologize for not being there in person. I'm still a little under the weather, but I appreciate the opportunity to be able to speak with you all today. I want to talk a little bit about the Colorado Consumer Protection Act, which is what the AI law lives within in Part 17. To give you a little bit of an understanding of how this law operates, I think what's important to focus on first is what type of activity is ultimately covered by the Consumer Protection Act. And that is primarily and mainly commercial activity. And what we mean by that is essentially private businesses, corporations, individual persons, partnerships, and not public entities. So when our office receives complaints, we focus on, like I said, complaints related to commercial activity, which is unlikely and rarely to ever be government activity. It's not to say that it is impossible, but what it's important to note is that when a government is acting in a commercial capacity, that is where it could cross into the Consumer Protection Act. That would be things like, and these are not the only examples, of course, but when they are operating things like a baseball tournament at a local government level. Things that where they're actually competing with someone else in the marketplace in order to get customers, in order to get ticket sales, whatever that might be. But not when it's talking about non-consumer facing, non-commercial activity. So things that are government services, essential services would not count as a government activity. This is one of the reasons why we believe that the AI law would have a limited, if any, impact on our state agency clients. I think it's also important to note the risk that occurs when we talk about this enforcement. As many of you all know, we are also the attorneys for these state agencies, these clients. And so our attorneys are providing the advice in order to comply. but they're also separate attorneys. The attorneys in our office are also the ones enforcing this law. And so the ability to work together and to coordinate and to ensure there's compliance before any action occurs is going to be very high on our list. We also, and this is just a general principle for our office, especially with any new law, we focus on compliance, education, and ultimately partnership. And that would apply here for government actors or for commercial actors. And so, again, I think when we talk about the risk to government agencies, we would work very closely with their own attorneys in order to ensure that they're in compliance, that whatever systems they are using, seeking to implement, are in compliance with this law. when it does go into effect in order to, again, limit the liability of our own clients when it comes to a potential enforcement action. So I'd like to leave it there and open it up to any questions that you all may have.
Thank you. Thank you, Mr. Reister.
Senator Rodriguez. Thank you, Madam Chair. Thank you, Mr. Reister. It's nice to see you on the camera since you didn't want to get up early this morning and walk down here in the cold. I want to thank you for your testimony. So I don't know if you've paid attention or reviewed some of our hearings we've had. Obviously, we've had some larger ones with judicial, and obviously OIT was last week with some follow-ups. But I want to key off on some of the things you said and just get clarification. And if I could dialogue a little bit, just because we'll be raising my hand every few questions. That would be much easier. All right. at least with judicial and I haven't forwarded to you, but I just want to start with, you know, a lot of them said they haven't received guidance from the attorney general's office and, you know, they have money in my discussions with the departments individually. It's like when we go into their systems similar to judicial, which is their level of supervisory inventory, which is also used by department of corrections and everybody else across the state. It is basically a one zero checkbox interview that is done by the probation officer and then filled in and then the system calculates the score and doesn't really take into effect any learning machine learning or decision making other than it calculates it and gives it out which is excluded under senate bill 205 have they have their attorneys reached out to your enforcement team to have discussions whether this would be covered under the law
Thank you, Senator Rodriguez. And I know we're in discussion, so I'll remind that, keep that in mind. As far as I'm aware, they have not. I am certain that judicial and other agencies have talked to their specific lawyers. But as I mentioned, the consumer protection lawyers are under the attorney general directly. And as far as I'm aware, there have not been even robust conversations related to those impacts. But I think as rulemaking and other things get underway. I do hope those conversations increase. But as of right now, I'm not aware of anything specific. Thank you, Mr. Reister. And that takes me to another conversation which I've
had with them. Senate Bill 24-205 was passed a couple years ago. Obviously, we've extended it. And I've had these discussions with them on the side. And Senate Bill 205 has a rebuttable presumption of affirmative defense under it with compliance. So even if they were to implement this as they saw fit and were to come to you and say, this isn't in compliance with the law. If they fixed it there, you would proceed forward. Any enforcement actions would proceed after the opportunity of you telling them they did it. It would be egregious manipulation or refusal to comply with the law. Is that correct?
That is correct. And I think it's also important to note that under the law, in the circumstances that you described, they would be a deployer. But as I said earlier, I also think it is extremely unlikely if not likely or not going to apply at all because, again, they are offering a government service. Because, you know, yes, there might be a developer creating that system that they are using and how that system is developed could and would be subject to this law. But once it is sold to and used by a government actor, they then become that outside commercial activity. And so because, again, like what what is a risk assessment and what is the commercial value of that? What is the product there? It is it is a service. And so even once the government actor starts to use it, it would it would not trigger any enforcement actions anyway. But it would certainly lead us to do a lot of education or to reevaluate whether that system is appropriate for government to be using based on how it was ultimately developed.
Thank you for that, Mr. And I keyed off on some of your discussions about the limited amount of exposure to Senate Bill 205 that the government would have. I think of it more if they were using artificial intelligence commercially facing, like for employment, obviously education for acceptance into schools, if they were approved for coverage for Medicaid. Commercially front-facing, they applied for something, a government service, and they were denied. denied. And that's where I think I get lost with the departments. And that's why I just wanted to have this conversation with you, because I think many of us have asked them questions, and they keep saying, we haven't received guidance, but I haven't heard of any of them reaching out to you. But I wanted to clarify, that was what the intent with the government piece was, similar Medicaid and education processes. And I guess, obviously, if the government got into the place of housing, I guess we could be in that space, too. I just want to get that on record, because it's been a little frustrating I think for this committee to get those direct answers of broad considering AI generative AI versus it not actually making a decision It just interacting So and I don know if you as somebody who sat with me as we wrote this bill, I just wanted to get your clarification on that on record. Yeah, Senator,
thank you. And I have the same understanding as you that there, you know, there, there could be instances, but as of right now, there, there are not that we are seeing. Certainly we are not aware of every use of or potential use of AI, because I know there's also some debate within these agencies of what counts as artificial intelligence or not. But as far as I'm aware, again, we haven't had a chance with a client in a different context to go through those systems and understand what is and is not, how they're using it, and how they're intending it to interact with, I don't want to say customers, because again, I don't think someone is often a customer of the judicial department or of DOC, right? They are someone that is subject to it. And I think that's an important distinction when we again talk about commercial activity.
Very good. Thank you, Mr. Reister. Representative Paschal.
Thank you, Madam Chair. Thank you for being here, Mr. Reister. I am wondering about the status of Attorney General's office rulemaking. Has that started yet? If not,
when do you see that happening? Mr. Reister. Thank you, Senator Parchman. Sorry for the dry mouth. Rep. Paschal. Yeah, so we've talked about this extensively since the passage of Senate Bill 24-205. We have not undergone any formal rulemaking because the law unfortunately has been in flux since the day it was essentially signed. But what we have been doing in the meantime, and I'll talk a little bit more about what we hope to do next, but we have been doing in the meantime is having many informal meetings with impacted groups that ranges from labor to business associations to individual companies, interested national thought leaders to just get a sense of kind of what matters in this space to that. This is something we did related to the Data Privacy Act as well, where essentially we know what's important to us, or we think we need to have clarity through rules, but then these impacted groups say, actually, we care more about this. And so we're trying to get a kind of a focused approach. And so that has been very helpful over the last two years in order to kind of understand the priorities and potential impacts to these organizations. What we've talked about going forward is because of the delay in putting it towards the very close to the end of this administration, we've talked a lot about how do we set up either the next administration for success or to provide some clarity and maintain history for those who have participated either in the the bill discussion or in these informal rulemakings. And so no formal decisions yet, but we've really talked about two different options. And that may evolve because I know that the AI task force is getting to wrap up and potentially other bills and certainly bills already introduced in the General Assembly related to chatbots and psychotherapy and other things that have artificial intelligence impacts. But what we've talked about doing is one of two options. The first one being put out some type of policy document, again, to capture that history, to capture the conversations and kind of what is next or what is expected. So that way, the next administration has essentially some type of guidance to say, you know, we're not starting at zero, but we actually have some of this history and can use that to initiate a formal rulemaking in order to, you know, provide more clarity in the law as it becomes effective. The other option that we have talked about is putting out an actual draft rule and not be responsible for the public hearings part and those revisions that may come as a part of that, but allow the next administration to do that. So that way, this attorney general is not binding the hands of any next administration, but also avoiding additional confusion that may occur when, let's just say that we finalize the rules tomorrow, the next administration comes in, they go, actually, I don't like any of this. or half of this doesn't work for me, right? Whatever amount, we want to make sure that there's certainty in the marketplace because I know how critical that is in this space. One, because it's evolving, but two, because as we always hear, you have to do a lot of coding in order to get into compliance. And so that shifting sand can be very problematic. So we don't want to bind anything, but we want to make sure that everything is moving forward and it maintains the momentum that it has. So hopefully one of those two options will go forward. But as I said, as more certainty in the law is obtained, again, whether that's through bills passing or failing, that will give our office more certainty on the next best path forward. But regardless of what outcome is, there will be something that our office does in order to help support the rulemaking, whether it's us directly or that next administration.
Very good. Seeing no other questions. Thank you so much for joining us today and for the clarity that you've provided for us, Mr. Easter.
Of course. Thank you so much, Senator.
Hope you feel better.
Thank you.
Oh, I'll keep talking. I'll keep my mic on. That is my job. Okay, so we have heard from the AG's office. That was incredibly helpful, I would say. Before us, we have the OITR1 statewide AI compliance. You guys probably know this table as well as I do at this point. We've looked at it so much. I do believe that the JBC is going to be making, considering this tomorrow, which is why we convened this meeting today so that we could get something to them. We already did respond to the R7 request, but the R1 request, just to remind everyone, is for $5.2 million. 3.4 of that comes from general fund. 1.1 comes from reappropriated. The rest is cash and federal. so that's what we are going to look at. Senator Rodriguez?
Thank you. Thank you, Madam Chair and colleagues. You know, it's hard for me to nail this down. It's frustrating, as I've shared with you, the LSI from the Judicial Department, who hasn't received any feedback or any documentation with us that they have actually talked to the enforcement team of this policy that I don't know if discussions with you, I don't consider a calculator which is excluded in our bill as AI, you know, why we should be approving money that we can't, that they can't justify that the department that actually would have to enforce it and or defend it has not told them that this is needed. So I struggle with this fiscal note, and it also pushes down my concerns with the OIT requests is similar is like they haven't narrowed down or reached out to the to the enforcement department of the judicial branch to tell them is this something that we need to work on to be covered and to even to reiterate even if they didn't do it or did what they thought they needed to do even if they got it wrong and the ag told them they did they'd be able to fix it so i'm i'd love to get input from the rest of the members on this request just because it's been two years and it hasn't been flushed out. It's just a we're throwing money at a wall and they don't even haven't even reached the guidance from the enforcement department of whether they should be investing in as much as they're trying to do. I would have to agree Senator Rodriguez and
And, you know, we have a couple options ahead of us. We have the option to approve as presented. We have the option of not approving as presented, or we have the option of approving a percentage, perhaps, representative to tone.
Thank you, Madam Chair. I think my opinion on this has been pretty clear from the beginning. When the special session happened, this was the same number that was applied to how much it was going to cost to implement AI and was the reason that we had AI in the special session. But there was no justification for it. And then when we came here the first opportunity after the special session we asked what is the cost The answer was we don know And now there this list of things that add up to the same amount again so I feel like this is just confirmation bias to get to the number that was put together for the special session and I don't think that this is a real number that actually goes to anything real. I think that this is stretching the interpretation of the law, and I would be
inclined to say no to the whole entire request. Senator Rodriguez. Thank you, and thank you, colleagues. That's kind of been my frustration with this whole process, and as we reach in, and I've had these side conversations just never on record, and Representative Fatone and I have been on multiple task forces where these conversations have come up and never really get solid, clear answers. I think if we were going to go the route of rejecting this request, maybe we or the team or the committee should send a letter along with it to explain the results of our digging into this request of not really factual, especially as we keep sending back money. And I've talked to you a little bit about this judicial cash fund request. you know, it seems like they're just throwing money at a board and putting money in their coffers that we could be using for important policies that we have to deal with in a very important budget year.
Rep. Pascal. I am looking at the document that is the Gen AI use cases. And, I mean, this is another way to perhaps narrow it down, is we've got some cases listed in here, although I'm still not clear if GNI actually qualifies as a decision-making system. So you guys say no? I'm not sure what it means. But on the ones, there are only five cases on here that are likely use of AI, so that may be a way to target funding rather than just throw it against the wall.
Rep. Pascal, how much is that total funding for those five projects? Are you able to tell?
Well, I'm not quite sure exactly what they are. So the first three are HICPF and CBMS. So they have a total of 233,962. And then the next few down, I'm a little uncertain. Well, we have CDPS, so that's public safety. They have 128,438 in this document. CDPHE has some kind of a chat bot, or is that one of the, that's one of the unlikelies? I fell off into the, oh, no, wait a minute. CDA using Copilot. I'm not sure what that is.
Ag?
CDA?
Ag?
And I think, could I double check, we could confer. I think chat bots are excluded from Centipel 205.
Yeah, sorry.
Short of the, you have to tell us you're interacting with AI. Yeah, I dipped down too many. So it was the one above it, CDA using Microsoft Copilot, although I don't know exactly what Microsoft Copilot does. It says likely education FERPA data. So is that Department of Education?
Yes, that would be, FERPA is Department of Education.
Okay, so that one is 178,672.
Okay, that is an interesting strategy, and it's one that is trusting the process because those numbers match the line items, right, of the departments. so what we talked about added up to like $380,000.
So I would entertain a motion if, yeah, Rep. Haskell? I think you could also argue it's worthwhile to give OIT one person to work on this. Other people can make an argument one way or the other on that one, but just drawing that possibility out.
Versus 33.8? I think OIT has three and a half. Oh, I see. You're looking here at this thing. Yeah, I'm looking at their chart. I don't know how that maths out, honestly.
Rep Titone. Thank you, Madam Chair. I think that also I think we should consider in lieu of the fact that there's going to be a major restructuring within OIT. There's going to be a lot of savings happening with different positions being cut, as we've seen in that memo. So why should we be giving them any money to do anything when they have resources that they will be peeling off and they can absorb into those cuts?
Okay. Senator Baisley.
Thank you, Madam Chair. Also, you know, we very well may change the whole landscape with legislation this year as well. So it would be putting money into something that's probably going to change anyway. So I'm real hesitant to put any dimes in there, frankly, to commit with the knowledge that we kind of don't have at this point.
Okay. I think we can put forth a motion and see where everyone lands. Representative Titone, do you feel comfortable putting forth?
I don't want a motion. I want to just give him that.
And so what we should do is we can take a motion that we will not approve this funding or recommend this funding toward the JBC. And then we'll also include a letter that talks about what we heard from the AGO, what we, and I think needs to also touch the judiciary part. So let's talk about judiciary after this. Rep to tone.
I move we do not approve the funding for the R1 request and accompany our recommendation with a letter explaining the detail of why we think it's not worthy of funding.
Mr. Gravel, will you please poll the committee? Senators and Representatives. Baisley.
Aye. Paschal.
Pass. Rodriguez.
Aye. Weinberg is absent. Vice Chair Titone.
Yes. Representative Paschal.
I'm going to say no Madam Chair
Aye That passes 4 to 1 Passes 4 to 1 I'm sorry it took me a minute With 1 absent Okay So we will move forward with a letter
Rep. Pascal If you would like to put together a comment that you would like to have included, I'm fine with that.
Are you sure?
Senator Rodriguez. I'm happy to assist or review the letter we send over.
Okay. Appreciate that. Ms. Velko, is that okay?
Samantha Velko, legislative council staff. Yeah, I'll draft what I think the committee's intention was for the letter, and then I can send that via email and bring it around, too, before we send it off this afternoon.
I appreciate it. The timing of getting the Attorney General's office here was really wonderful. So thank you for your work on that. And, committee, I just appreciate you being here today. I would like us to take up the next section that we've talked about and kind of put off, which is the judicial. Mr Gravey would you mind updating us on and I don mean to put you on the spot with what we have completed in the judicial in the judiciary request and what is left for us to decide
Sure thing. Dan Gravy, legislative council staff. The committee voted to approve the judicial operating request. The committee also voted to, the motion was to recommend funding for the cash-funded IT capital case management system, and that failed to pass on the vote taken by committee. we as that was not a any type of final action we're welcome to read you know to hold that you know to entertain that motion again if you'd like to discuss that that same question of the it capital system thank you so much so to clarify we have not taken final action nor do we have to
on the judiciary case management as it is, it is not recommended. So I'll let you chew on that for a second. Seeing no major objection, I might come back to that. I wanted to let you know that I said yes to something that is really early in the morning one day. And I said yes on my behalf, but I would also invite you. This is the Legislative Audit Committee with the Head Auditor and OIT will take us into executive session and go through a pretty thick confidential OIT audit that we will be doing with the Legislative Audit Committee. But I think it starts at like 7 or something really obnoxious. 7-15, yeah, on March 25th. So it's... Okay, great. So there is an invite. I wanted to make sure to explain why that exists. I had the auditor in my office, and she went through trying to explain it all, and it was a lot. And then I felt like it's really important that we all make sure we get our eyes on it. And Senator Frizzell leads the legislative audit committee and mentioned to me this might be a really good use of our time. So we will gear up for that on March 25th. Seeing no other business, do we want to talk about the questions? I think we're good on the AI questions we're sending to the department. Where did we leave it? We had a discussion, and then we had some additional feedback. Ms. Falco, please.
Samantha Falco, legislative council staff. I had sent this out to the committee. Rev Tatone came back with some feedback as well, so I'm happy to incorporate more of that. But essentially we just changed it so that it would be presented in more of a table format, where we ask for a brief description of the system and the purpose it serves. We ask them to designate which systems make consequential decisions and to find what consequential decision is being made and who's overseeing it. Provide the name of the AI developer and deployer in charge of the system. Designate which systems use biometric identifiers and personal characteristic data and which systems input that sensitive data. and then designate any systems that use AI-powered surveillance. That sounds really good.
It sounds like we've been through all of these revisions. Let's move with that. I think that sounds good. Senator Rodriguez.
I have a question, and maybe this is something for us because I hadn't dug into that form, but based on today's conversation, do we want to include in there public commercially facing systems? because that was a big flag for the AGs. That's what they'd look at. That's a really great point. When we picture a flow chart, that could be right at the top. Is it consumer-facing, yes or no?
And if no, elsewhere. So, yeah, okay, that would be great.
Yeah, Brett Pascal. I'm a little confused about the terminology of being commercial because what does that mean? do we as the government do any commercial activity? I mean, why does it need to be commercial? If we're making a life-impacting decision, isn't that sufficient to qualify?
Senator Rodriguez. Thank you. That's a good conversation to have, which, you know, it's what would be, you know, I would think between me, it's like any decision now that they make without AI that they could be sued for discrimination, which is more complicated. That's where it gets, but under the premise of 205 that we're looking at, unless we're trying to dig deeper, like I said earlier with my discussion with the AG, employment is probably a big one if they're using AI to do it. Healthcare coverage, Medicaid, any kind of government insurance type coverage, like maybe family or benefit. and those are the kinds of things I think was the intent of what 205 is trying to do, that we're trying to dig into their systems. We could do a lot more into that, but if it's not what we'd even consider AI, and it's not consumer-facing, because sometimes those are tools that are used to assist somebody else in making a decision, and is that our discussion? It's similar to the LSI, that you are in probation, you're getting assessed for a treatment plan, you have all these measurement tools that are used, are those discriminatory because those are generally designed for the type of risks that they're having to deal with and this maybe this is an offline discussion for you and me that was just feedback I got from the discussion from the AG is like we're mostly looking at consumer public facing something that's internally being used something else is making the decision or it's used by a human to assist them in making a decision that's a much broader conversation I think and that's just the enforcement mechanism. That's how 205. So that's why it's, that's why it matters
because that's the enforcement mechanism. Okay. That sounds good. Let's move those out and give them like two weeks or so to answer. And then we'll wait and see what they come back with. I don't think we need to meet next week. Well, we are being met. Oh, God. Oh, God. That's different. Yes, Rep. Pascoe.
So we still have some lingering items that we haven't hit. Like, for instance, OIT hasn't come and told us about their structure. Yes.
Yes. That is still to come. I told them we probably wouldn't have time to do it today, which is accurate, I would say. So we can certainly, yeah, bring them in on Thursday if we wanted to do a meeting this Thursday and have OIT come in. And then next week is maybe the 25th, and we won't have our JTC meeting. We'll do that instead. And then we'll be early April and maybe close to getting information back from folks. And then we'll start talking department-specific AI stuff. okay all right this sounds like a good plan so we will go ahead and meet on thursday since all we're covering is oit reorg we'll start at 8 15 because that seems to be a really
appropriate time for me um oh smith falco smith falco legislative council staff 8 15 is fine we do We have some proposed legislation from CDLE. They came and talked to us in December and had mentioned this. I'll send out the information again to the committee members so that they're prepared for what that legislation might be. It would just be to vote to draft it so that a conversation can continue, but something that we might need to take up. And then we have a few more presentations we will have to do at some point, but we can take next week off. Okay.
I so appreciate it and we'll put our heads together and figure out an agenda. Very good. So I will see you guys Thursday at 8.15. We'll do OIT Reorg. With that, JTC is adjourned.