You identified your AI vendors. You sent formal Colorado AI Act documentation requests to each one, citing SB 24-205 by name and setting a 30-day response deadline. The deadline passed. One or more of your vendors did not respond.
This situation is more common than most Colorado businesses expect. And it is less legally damaging than it might appear — provided you handle the non-response correctly and continue to document your compliance efforts.
Why Vendors Don't Respond
The major AI platforms — Indeed, LinkedIn, Workday, Checkr, Salesforce — are receiving compliance documentation requests under multiple regulatory frameworks simultaneously: GDPR from European customers, CCPA from California customers, TRAIGA from Texas customers, and now Colorado AI Act requests. Their legal teams are stretched, their response protocols are inconsistent, and many have not yet developed standardized responses to Colorado-specific requests.
Some vendors have made deliberate decisions to manage their Colorado AI Act compliance posture at the company policy level rather than responding to individual customer requests. Others are genuinely slow. None of this changes your obligation as a deployer. But it does explain why non-response is common and why the law's reasonable care standard was built with this reality in mind.
What Vendor Non-Response Means for Your Colorado Compliance
Colorado's AI Act evaluates your compliance based on the steps you took — not the steps your vendors took. A vendor that ignores your formal request has made a choice outside your control. The law does not hold you responsible for your vendor's choices. It holds you responsible for your own documented actions.
A Colorado business that can show the AG a dated formal request, a documented response deadline, a logged non-response, a follow-up request, and continued human oversight of the vendor's AI output has demonstrated reasonable care. That business took every step available to it. The vendor's silence was the limiting factor.
How to Document Non-Response Correctly
Log the original request with the date sent, method of delivery, and recipient. Note the response deadline you set. On the day after the deadline, make a dated entry in your compliance file noting that no response was received. Within two weeks, send a follow-up request referencing the original by date. Log the outcome of the follow-up. Write a brief characterization of the vendor's posture in your impact assessment: vendor has not responded to two formal Colorado AI Act documentation requests; vendor's AI compliance posture is unknown; enhanced human oversight of vendor AI output is maintained.
The Mitigation: Enhanced Human Review
When a vendor will not provide documentation, the most important thing you can do is ensure that a human reviews every output from that vendor's AI system before you act on it. If Indeed will not tell you how their ranking algorithm works, make sure a hiring manager personally reviews the full applicant pool — not just the AI-ranked list — before making contact decisions. Document that review specifically as a response to the vendor's non-response.
Vendor non-response plus enhanced human review plus documented good faith efforts is a complete reasonable care defense under the Colorado AI Act. You cannot control what your vendors do. You can control what you document.
This article is for informational purposes and does not constitute legal advice. For legal advice specific to your situation, consult a licensed Colorado attorney.