OIT asks for 3.5 FTE to meet SB 24-205 obligations; committee seeks Attorney General guidance

The Office of Information Technology told the Joint Technology Committee it is requesting staff and budget resources to comply with Senate Bill 24-205 and asked the Attorney General’s office for rulemaking or interpretive guidance before some determinations are finalized.

David Edinger, OIT executive director and chief information officer, said OIT believes parts of SB 24-205 are “overly broad” and that the agency lacks definitive interpretation from the Attorney General’s office. Sarah Thunberg, OIT’s deputy director for digital and delivery, explained the fiscal-note math: OIT has processed roughly 150 GenAI evaluation requests to date, projects about 500 annual submissions, and used a weighted average of 7.5 hours per evaluation (75% at six hours, 25% at 12) to reach a 2.5 FTE estimate for evaluations, plus an additional 1 FTE for annual high-risk determinations, notifications, appeals and AG-related disclosures.

Thunberg gave two use-case examples. First, Microsoft CoPilot Code Assist—while the tool itself may be low risk—can become high risk when operating on FERPA-protected student data, triggering annual evaluation and mitigation steps. Second, OIT runs a production, Colorado-facing generative-AI virtual assistant in a contact center that the agency does not currently flag as high risk but still plans to disclose to users and conduct user-research on the disclosure approach.

Committee members asked how long routine reviews take and whether some technologies fall under existing exclusions (for example, developer assistance or non-customer-facing tools). Thunberg and Edinger said OIT is using internal working definitions while awaiting AG guidance and that automations may be explored to speed routine evaluations (human-in-the-loop with tooling for screening).

The committee scheduled a follow-up meeting to invite the Attorney General’s office to provide interpretive guidance and asked OIT to include compliance reporting in future OIT updates. No budget was enacted by the committee at this meeting; the presentation explained OIT’s fiscal-note assumptions and operational impacts.