CO SB113: Artificial Intelligence Facial Recognition

In one paragraph

Colorado's SB 22-113 sets rules for facial recognition used by state agencies, local governments and state colleges: a notice of intent and public accountability report before use, vendor bias disclosures, testing and meaningful human review for decisions with legal or similarly significant effects, training and records. Police need a warrant or another listed basis for ongoing surveillance, real-time identification or tracking. It barred schools from new facial recognition contracts until July 1, 2025; SB 25-143 (2025) removed that end date. Its task force became the AI Impact Task Force (HB 24-1468), ending September 1, 2027. Signed June 8, 2022 (Chapter 463); effective August 10, 2022.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

Facial recognition vendors to Colorado agencies must disclose bias complaints and, unless in NIST's ongoing vendor test, allow independent testing and, if it finds material unfair performance gaps, develop and implement a mitigation plan within 90 days. Schools: only SB 25-143's exceptions.

Key provisions

1. 1Agencies (state and local government agencies and state institutions of higher education) that use or plan to use a facial recognition service must file a notice of intent stating its purpose with their reporting authority (the local governing body, or the Office of Information Technology for state agencies) (C.R.S. 24-18-302)
2. 2Before use, the agency must produce an accountability report (vendor and version, capabilities and limits, data use and management policy, testing, false-match rates, civil liberties impacts, feedback procedures) after public comment and at least three public meetings, post it at least 90 days before operational use, and update it at least every two years; consumer devices certified as not used for governmental purposes are exempt
3. 3Agencies must require vendors to disclose complaints or reports of bias; decisions with legal or similarly significant effects need meaningful human review and prior testing in operational conditions; agencies must require providers to offer an API or other means for independent accuracy and bias testing, and if independent testing finds material unfair performance differences, the provider must develop and implement a mitigation plan within 90 days after receiving the results (the operational-testing, API and mitigation duties do not apply if the provider takes part in NIST's ongoing Face Recognition Vendor Test)
4. 4Agencies must train operators periodically, keep records sufficient for audits, and disclose facial recognition use to a criminal defendant before trial; judges and agencies report facial recognition warrant data each January
5. 5Law enforcement may not use facial recognition for ongoing surveillance, real-time or near-real-time identification or persistent tracking unless it has a warrant, the use is necessary to develop leads in an investigation, it has established probable cause, or a court order to find or identify a missing or deceased person; no use based on protected characteristics or views, no records of First Amendment activity, and a match cannot be the sole basis for probable cause
6. 6Exempt: agencies required by federal regulation or order to use a specific service, or using one with a federal agency to meet a congressional mandate, aviation security directives or federal law, or to verify travelers' identity at airports; physical access control for secure areas; state agency research that does not affect decisions about individuals; and utilities
7. 7School districts, their schools and charter schools, and institute charter schools may not execute facial recognition contracts (contracts executed before August 10, 2022, their renewals and consumer devices were excepted); the ban was to repeal July 1, 2025, but SB 25-143 (signed April 18, 2025) removed the end date, replaced the existing-contract exception with one for contracts in effect April 18, 2025, and added educational and safety exceptions. The 15-member task force created here was replaced in 2024 by the AI Impact Task Force (HB 24-1468); C.R.S. 2-3-1707 is scheduled for repeal September 1, 2027
8. 8Signed by the Governor June 8, 2022 (Chapter 463, Session Laws of Colorado 2022); effective August 10, 2022

Latest legislative action

Jun 8, 2022. Governor Signed

Sponsors (showing 5 of 18)

Amendments (12)

• Senate Business, Labor, & Technology Amendment L.001 Adopted 2022-02-23
• Senate Business, Labor, & Technology Amendment L.002 Adopted 2022-02-23
• Senate Business, Labor, & Technology Amendment L.003 Adopted 2022-02-23
• Senate Business, Labor, & Technology Amendment L.005 Adopted 2022-02-23
• Senate Business, Labor, & Technology Amendment L.006 Adopted 2022-02-23
• Senate Appropriations Amendment J.001 Adopted 2022-03-04
• Senate Appropriations Amendment L.008 Adopted 2022-03-04
• Second Reading Amendment L.015 Adopted 2022-05-03
• Second Reading Amendment L.021 Adopted 2022-05-03
• Second Reading Amendment L.023 Adopted 2022-05-03
• Second Reading Amendment L.019 Adopted 2022-05-03
• Second Reading Amendment L.014 Adopted 2022-05-03