Colorado's "bullish with guardrails" approach to AI in government
Colorado is moving fast on AI-without letting it make consequential decisions. As the state's chief information officer David Edinger put it, AI is barred from "anything that looks or smells or could possibly be thought of as a consequential decision." That line in the sand keeps innovation moving while protecting residents and programs.
This isn't theory. It's a directive from Gov. Jared Polis. Agencies are encouraged to adopt AI where it reduces workload, improves service, and keeps staff focused on higher-value work.
Why it matters for public sector teams
The state built its framework on the NIST AI Risk Management Framework, then tuned it to each agency's needs. That structure gives program leaders confidence to pilot, test, and scale the right use cases-without crossing ethical or legal lines.
Early impact is practical: faster office work, fewer repetitive tasks, and real gains for employees with disabilities who report becoming more productive with AI tools.
How Colorado set it up
- Clear scope: AI assists staff; it doesn't decide benefits, eligibility, enforcement, or other high-risk outcomes.
- Framework-first: Standardized risk management, aligned to NIST, applied across agencies.
- Pilots with purpose: Start small, measure outcomes, expand what works.
- Data discipline: Agreements that require sharing personally identifiable information get rejected. No exceptions.
By the numbers
- 50 approved AI use cases in production, out of just over 200 requested across state government.
- A Google Gemini pilot with 150 staff produced ~2,000 potential uses.
- Of 31,000 employees on Google products, about 12-15% now use Gemini, with more added each month.
What's in use today
- Policy reference chatbots that surface statutes, rules, and guidance faster for staff.
- AI tools to help job seekers navigate openings in state government.
- Virtual assistants to handle common unemployment questions.
- 911 training support to improve consistency and speed during practice scenarios.
Guardrails that actually hold
Colorado's team has walked away from vendor deals that exposed resident data. If the data-sharing terms could require PII going places it shouldn't, the answer is no. That stance sets the tone for procurement, privacy, and trust.
Compliance horizon: SB 205
Colorado agencies, like private companies, must comply with Senate Bill 205 as it comes online. The law will require developers of high-risk AI systems to use "reasonable care" to protect consumers, with implementation delayed to June 2026 after an effort to update the bill stalled.
Track the bill status here: Colorado SB 24-205.
What other agencies can copy
- Put "no consequential decisions" in writing. Define what counts-eligibility, enforcement, credit, hiring, discipline-and require human accountability.
- Adopt a common risk framework (NIST works). Standardize intake, review, and approval so pilots don't get stuck.
- Start with internal productivity. Document time saved, error reduction, and service improvements before scaling outward.
- Procure with privacy teeth. Reject contracts that force PII exposure or vague data-sharing terms.
- Track usage. Measure adoption, performance, gaps, and staff feedback monthly.
Getting your workforce ready
Policy plus training beats policy alone. Give staff practical guidance on prompts, verification steps, and where AI is off-limits. Pair that with simple audit trails so supervisors can review AI-assisted work when needed.
If you're building internal skills, see curated learning by role here: Complete AI Training: Courses by Job.
Bottom line: Colorado shows you can be pro-AI and pro-safety at the same time. Set clear guardrails, prove value with targeted use cases, protect data like it's mission-critical-because it is-and keep humans in charge of the decisions that matter most.
Your membership also unlocks:
