Does NIST AI Risk Management Framework (AI RMF 1.0) cover Colorado Artificial Intelligence Act (proposed SB 24-205)?

63% of Colorado Artificial Intelligence Act (proposed SB 24-205) you already have

NIST AI Risk Management Framework (AI RMF 1.0) already covers about 63% of Colorado Artificial Intelligence Act (proposed SB 24-205), leaving 7 of 19 controls as genuinely new work.

Already covered 6 Likely covered 6 New work 7

What is genuinely new work

Nothing in NIST AI Risk Management Framework (AI RMF 1.0) reaches these. This is the list to scope.

CO-AIA-1701-DISCRIM

Algorithmic Discrimination Definition

CO-AIA-1701-HIGHRISK

High-Risk AI System and Consequential Decision Scope

CO-AIA-1702-3

Impact-Assessment Support Artifacts

CO-AIA-1703-5

Adverse Decision Explanation, Correction and Appeal

CO-AIA-1703-8

Small Deployer Exemption

CO-AIA-1706

Enforcement by the Attorney General

CO-AIA-1707

Attorney General Rulemaking

Show the 12 you already have

CO-AIA-1702-1

Developer Duty of Reasonable Care

CO-AIA-1702-2

Developer Documentation and Disclosures to Deployers

CO-AIA-1703-1

Deployer Duty of Reasonable Care

CO-AIA-1703-2

Risk Management Policy and Program

CO-AIA-1703-3

Impact Assessment

CO-AIA-1705

Affirmative Defense and Recognised Frameworks

CO-AIA-1702-4

Developer Public Statement

CO-AIA-1702-5

Developer Disclosure of Algorithmic Discrimination

CO-AIA-1703-4

Consumer Pre-Decision Notice

CO-AIA-1703-6

Deployer Public Statement

CO-AIA-1703-7

Deployer Disclosure of Algorithmic Discrimination to AG

CO-AIA-1704

Disclosure of AI System to Consumers

How this is calculated

Already covered means a mapping runs from a control in NIST AI Risk Management Framework (AI RMF 1.0) to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair · Today's edition