Colorado ADMT rules took a decisive step forward on October 6, 2026, when the Colorado Department of Law released a revised draft of its Automated Decision-Making Technology and Conversational AI Service Rules. The draft fills in the operating detail for two state laws that take effect on January 1, 2027. When a company's algorithm helps decide hiring, lending or insurance outcomes, the person turned down will have the right to know the specific reasons, correct their data, and have a human being review the decision again.
The framework is not new. In May 2026, Governor Jared Polis signed SB 26-189, the Automated Decision-Making Technology in Consequential Decisions Act, and HB 26-1263, the Conversational Artificial Intelligence Services Act, also known as the Chatbot Safety Act. The broader 2024 Colorado AI Act, SB 24-205, was repealed at the same time. The Department of Law published the first draft rules, numbered 4 CCR 904-6, on August 11; the October 6 revision is the latest text before a public hearing in Denver on the morning of October 26, 2026, which is also the deadline for written comments.
Drawing the line: what counts as materially influencing a decision
The law does not cover every automated tool. It covers technology that processes personal data and produces predictions, recommendations, classifications, rankings or scores used to make or assist a decision about an individual. Obligations trigger only when two tests are both met: the output is a non-de minimis factor in the decision, and it actually influenced the outcome. Incidental, trivial or purely clerical uses are excluded. The August draft asked the public to choose between two standards for this threshold; the revised draft gives a provisional answer, adopting an approach close to California's CCPA regulations but adding a rebuttable presumption. A business that believes its tool falls below the threshold will have to produce evidence, rather than leaving the burden on the consumer.
Covered domains include education, employment, residential real estate, financial and lending services, insurance, healthcare services, and essential government services and public benefits. Protected individuals include Colorado employees and job applicants, not just consumers. California's SB 947 already bars employers from letting an automated system decide discipline or termination alone; Colorado's draft goes further by writing the full explanation-and-review process into rules.
After a rejection: notice, reasons and a genuine human review
Deployers, the organisations that actually use these tools, carry the heaviest load. After an adverse outcome they must generally send a written notice by two methods, one of them online, explaining the decision, the role the technology played, how much human involvement there was, the principal reasons for the outcome, any relevant scores or inferences, and how to exercise one's rights. Individuals can request the personal data used and must receive an answer within 45 days; they can demand correction of inaccurate data; and, where commercially reasonable, they can request meaningful human review, which the deployer must acknowledge within 10 days and complete within 45 days.
The standard for review is stricter than many expect. The reviewer must be independent of the original decision-maker, properly trained, and empowered to approve, modify or overturn the decision, and the automated technology may not assist in the review itself. Adding a human signature under an algorithmic conclusion does not count as review.
Developers and chatbots: documentation flows down, reports flow up
Developers must hand deployers technical documentation covering intended and inappropriate uses, known risks and limitations, categories of training and operational data, monitoring methods, and the information needed to understand outputs; anything withheld needs an identified legal basis. The revised draft also introduces midstream developers, parties that integrate someone else's covered technology into their own products, who must obtain documentation upstream and pass it downstream so the chain of information does not break.
Chatbot operators, meanwhile, must use commercially reasonable methods to estimate a user's age, repeatedly disclose to minors that they are talking to an AI, avoid rewards that incentivise minors to keep engaging, guard against sexually explicit content and simulated emotional dependence for minors, and provide privacy and account-management tools. For all users they must run a crisis-referral protocol for suicidal or self-harm prompts and report on it to the Department of Law every year starting July 1, 2027, and they may not present chatbot output as equivalent to licensed professional services. Violations of either law are treated as deceptive trade practices under the Colorado Consumer Protection Act, enforced by the Attorney General.
What to do now, and where the risks sit
The timetable is tight. Organisations that want to shape the final text must comment by the October 26 hearing and deadline, the last formal window before the rules are finalised. Businesses using algorithms in consequential decisions affecting Colorado should, before year-end, inventory their systems and test each against the material-influence threshold, request the required documentation from vendors and write the gaps into contracts, and build the adverse-notice, correction and human-review workflows with deadline tracking. Both laws take effect on January 1, 2027, leaving under three months.
Two risks deserve attention. First, xAI's lawsuit against Colorado (U.S. District Court case No. 1:26-cv-01515) is still pending; it targeted the repealed predecessor law, and whether anyone will seek to enjoin the new framework is unresolved, so treating the litigation as a reason to delay preparation is unsafe. Second, in a letter released with the revised draft, the Department of Law said early enforcement would exercise appropriate discretion and focus on egregious and intentional violations. That is a statement of enforcement policy, not a statutory grace period, and notice templates and trained reviewers cannot be built overnight. These rules apply to decisions and users in Colorado only, but together with California's regime they are raising the practical bar for automated-decision compliance across the United States.
