Colorado is about to switch on two AI laws. On January 1, 2027, the state's rewritten automated decision law takes effect and most duties in its new chatbot law begin, and the Colorado Attorney General's office is finishing the rules that explain how both work. The office held its formal rulemaking hearing on Monday, October 26, 2026, and business groups used it to ask for more time.
This explainer covers what the two laws require, what the draft rules add, what industry wants changed, and what happens next. It is a summary of public documents, not legal advice.
The short version
- Two laws. Senate Bill 26-189, the Automated Decision-Making Technology Act (ADMT Act), and House Bill 26-1263, which the Attorney General calls the Chatbot Safety Act.
- Start dates. SB 26-189 takes effect January 1, 2027, per its enacted text. HB 26-1263 took effect August 12, 2026, per its enacted text, and most of its duties start January 1, 2027, the date the Attorney General's rulemaking page lists. Rule 1.3 of the interim draft rules gives the rules January 1, 2027.
- One rulebook. The draft rules, numbered 4 CCR 904-6, cover both laws. The state eDocket entry lists the title "AUTOMATED DECISION-MAKING TECHNOLOGY & CONVERSATIONAL ARTIFICIAL INTELLIGENCE SERVICE RULES".
- The fight now. Business groups want a longer runway and narrower definitions. The Attorney General's office has not published final rules.
Where the original Colorado AI Act went
In 2024 Colorado passed Senate Bill 24-205. The Attorney General's page says it "created consumer protections from algorithmic discrimination in consequential decisions made by high-risk artificial intelligence systems." Many readers still know it as the Colorado AI Act.
That law is no longer the one that matters for 2027. The same page says SB 26-189 "was signed into law May 2026 and repeals and reenacts those provisions with new requirements regarding the use of automated decision-making technology in consequential decisions." The General Assembly's bill history shows the Governor signed it on May 14, 2026. Bloomberg Law describes the new law as a "transparency-focused rewrite of a sweeping algorithmic bias law that never took effect."
If you read guidance written in 2024 or 2025 about "high-risk AI systems" in Colorado, check it against SB 26-189 first.
What the ADMT Act covers
The legislature's bill summary gives the core definitions.
An "automated decision-making technology" is "a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual."
A "consequential decision" is one that relates to a person's access to, eligibility for, or compensation related to seven areas:
- education
- employment
- housing
- financial or lending services
- insurance
- health-care services
- essential government services and public benefits
The law applies when ADMT is used to "materially influence" one of those decisions. The summary calls that a "covered ADMT."
What developers must do
From January 1, 2027, a developer of a covered ADMT must give each deployer technical documentation. Per the summary, it describes the tool's "intended uses, categories of training data, known limitations, and instructions for appropriate use and human review." Developers must also tell deployers about material updates or modifications.
The EU AI Act draws a similar line between the companies that provide AI systems and the deployers that use them. Our EU AI Act explainer covers who carries which duties there.
What deployers must do
A deployer is the business that uses the tool. The summary says deployers must:
- give consumers "clear and conspicuous notice" at the point of interaction with a covered ADMT
- give a consumer a plain language description of the tool's role within 30 days after it makes a consequential decision that results in an adverse outcome for that consumer
- keep records that show compliance for at least 3 years (developers must do the same)
What consumers get
The summary lists three rights. Consumers can request their personal data and the correction of "factually incorrect personal data" used by a covered ADMT. After an adverse outcome, they can request "meaningful human review and reconsideration."
Enforcement
The Attorney General enforces the law through the Colorado Consumer Protection Act, and the summary says a violation "is deemed a deceptive trade practice." Before January 1, 2030, the Attorney General must give a developer or deployer a 60-day notice and a chance to cure, "if a cure is deemed possible." Under C.R.S. 6-1-1706(3)(c), the Attorney General is not required to provide a cure period before seeking penalties if the office finds and can demonstrate that a developer or deployer knowingly or repeatedly violated the law. The summary says the act "does not create a new private right of action." It also sets how fault is allocated between developers and deployers in civil actions alleging unlawful discrimination under existing law.
What the Chatbot Safety Act covers
House Bill 26-1263 applies to a "conversational artificial intelligence service," which the bill summary defines as "an artificial intelligence system that is accessible to the general public and that primarily simulates human conversation and interaction through adaptive textual, visual, or aural communications." The General Assembly's bill history shows the Governor signed it on May 29, 2026.
The law puts duties on the "operator," a person or business that "develops and makes publicly available" a conversational AI service or "offers" one "to a consumer," per the enacted text. App stores and search engines are not operators "solely because" they provide access to such a service. According to the bill summary, an operator must use "commercially reasonable methods or generally accepted methods" to estimate the age of account holders and other users.
HB 26-1263 took effect August 12, 2026, per the enacted text and the General Assembly's session law record. The Attorney General's rulemaking page lists January 1, 2027, the date most operator duties begin. The bill sets no separate start date for the age-estimation duty.
If an operator knows a user is a minor, the summary lists five duties:
- provide certain disclosures
- give no points or rewards to encourage engagement
- use technically feasible measures to stop the service from producing explicit sexual conduct, intimate digital depictions, or "statements that simulate emotional dependence"
- run a protocol to stop engaging in response to a prompt about sexual conduct with a minor
- give the minor, or a parent or guardian, tools to manage privacy and account settings
For all users, an operator must disclose that the service is artificial intelligence, run a protocol for prompts about suicidal ideation or self-harm, and, "on and after July 1, 2027," report each year to the Attorney General's office about that protocol. Operators may not say that output is provided by, endorsed by, or equivalent to the services of certain licensed or certified professionals.
The regulatory analysis says the chatbot law and rules apply to operators "regardless of their size or where they are located." The same analysis says "a violation of the ADMT Act or Chatbot Safety Act is considered an unfair trade practice under the CCPA," the Colorado Consumer Protection Act. The enacted text of SB 26-189 uses a different term: "A violation of this part 17 is a deceptive trade practice."
For a similar local proposal on customer service bots, see our explainer on NYC's proposed AI chatbot rule.
What the draft rules add
The Attorney General's office filed proposed rules with the Secretary of State on August 11, 2026, and released an interim draft on October 6, 2026. The office's regulatory analysis says the rules "do not create additional rights or compliance obligations beyond those provided in the ADMT and Chatbot Safety Acts" and instead "attempt to clarify both statutes."
Some parts are not optional for the office. The analysis says the ADMT Act requires rules on adverse outcome disclosures and on standards for meaningful human review. The chatbot law does not require rules, but the rulemaking page says the Attorney General "believes rulemaking would help ensure compliance obligations, including the content of the annual report, are clear."
Four parts of the interim draft stand out.
1. A presumption of "material influence." Draft Rule 6.1(A) says an ADMT output is presumed to materially influence a consequential decision if it "constrains an option set, sets a threshold, or produces a rank, score, classification, recommendation, prediction, or other inference" that pertains to the person, is reviewed by the decision maker (or screens data the decision maker sees), and "is consistent with the outcome of the Consequential Decision." Rule 6.1(B) lets a deployer rebut that with evidence, for example that it did not consult the output, applied a consistent hard cut-off, or that the decision maker reached a decision "not consistent with the ADMT output." Rule 6.1(D) notes that the law excludes tools used "solely to summarize, organize, translate, draft, route, or present information."
2. Sector examples. Rule 6.2 walks through examples by sector. In one, a private high school administrator uses ADMT to assess student essays and then denies a student a place in a program. The draft says the presumption applies, and that the administrator could rebut it with evidence that the decision rested on their own review of scores, recommendations and essays, "and that the ADMT output was a De Minimis factor in the decision."
3. Age assurance for chatbots. The draft lists factors the office will weigh when it judges an age estimation method. It says an operator must not use a method that requires government-issued identification as the sole method of age assurance. Another factor is whether the method does not rely solely on users' self-declarations of age. In judging whether a method is generally accepted, the office may consider conformance with ISO/IEC 27566-1:2025 and IEEE 2089.1. One listed method is a cryptographic technique "such as a zero-knowledge proof."
4. How often the AI disclosure appears. For users not covered by the separate minor disclosure rule, the interim draft says the AI disclosure must come at the start of the first interaction each calendar day and appear at least once every three hours in a continuous interaction, unless it is shown as a persistent disclosure. It must also be given when a user asks whether the service is human.
These are draft terms. The final rules may change them.
What business groups asked for at the hearing
Law360 reported that "Business groups across the tech, banking and other industries pushed Colorado's attorney general Monday to revisit his proposed rules." Bloomberg Law reported that the groups asked the office to "delay enforcement" and to adjust the definitions of "data sources," "material influence," and "meaningful human review."
The U.S. Chamber of Commerce published its hearing comments. Its main requests:
- Timeline. The Chamber says the Department's cover letter offers only a statement that the Attorney General will focus enforcement on "egregious and intentional violations." It asks that obligations attach "no earlier than twelve months after the final rules are published," or for a grace period or staged dates.
- Material influence. It asks the office to strike the "consistent with the outcome" trigger, which it says "conflates correlation with causation."
- Data sources. The Chamber says draft Rule 7.6(A)(5)-(6) requires deployers to identify the sources of personal data "by name." It wants disclosure of categories of data sources instead.
- Third-party data. It asks the office to narrow a 15-day duty to list third parties that hold a consumer's data, and to extend that window to 45 days.
- Human review. It asks for a process-based definition and an extension option for the 45-day review period in draft Rule 8.7(G).
The office's own analysis takes the other side on timing. It says waiting to issue rules until after the effective date "would increase uncertainty for industry while potentially decreasing the rights and protections given to consumers."
Why it matters outside Colorado
The regulatory analysis says the ADMT Act and rules "only apply to entities within certain Covered Domains that utilize Covered ADMT to make certain decisions, also regardless of size or where they are located." It also says some entities already have compliance programs for the Equal Credit Opportunity Act and the Fair Credit Reporting Act, says many have built programs for "the California ADMT Act," and expects lower costs for firms that can reuse those systems.
Teams that use covered ADMT in hiring, lending or housing decisions will need the notices, consumer rights process and human review that the law requires. For chatbot makers, Colorado adds age estimation, minor protections and an annual report on self-harm protocols. State scrutiny of chatbots is not new: eight states have already sued OpenAI over ChatGPT safety claims.
State laws like Colorado's are also part of the federal preemption debate. Anthropic's draft federal AI safety bill would override some state rules for AI developers, and the company now says it will narrow that preemption section.
What happens next
- Comments. The rulemaking page says the office will consider written comments received by October 26, 2026 at 11:59 P.M. MST, or through the last day of the hearing if it continued past that date. The page says written comments will be posted online at the office's rulemaking comment website.
- Final rules. The office has not published adopted rules. The adopted rule fields on the eDocket were empty when we checked.
- Start dates. The ADMT Act, most chatbot operator duties and the rules as drafted start January 1, 2027. HB 26-1263 itself took effect August 12, 2026.
- Cure period. Under SB 26-189, the 60-day notice and cure step applies to actions started before January 1, 2030.
Watch for the final rule text, any change to Rule 1.3's January 1, 2027 date, and whether the "consistent with the outcome" test survives.
Sources
- Colorado Attorney General: Automated Decision-Making Technology and Chatbot Safety Rulemaking
- Colorado General Assembly: SB26-189 Automated Decision-Making Technology
- Colorado General Assembly: HB26-1263 Conversational AI Service Operator Requirements
- Colorado Session Laws 2026, Chapter 131: SB 26-189 as enacted (PDF)
- Colorado Session Laws 2026, Chapter 208: HB 26-1263 as enacted (PDF)
- Colorado Department of Law: Interim draft rules, 4 CCR 904-6 (redline, October 6, 2026)
- Colorado Department of Law: Regulatory Analysis (October 21, 2026)
- Colorado Secretary of State: eDocket 2026-00360
- U.S. Chamber of Commerce: Comments on the Interim Draft Rules
- Bloomberg Law: Colorado AG Urged to Delay AI Hiring Disclosures, Tighten Terms
- Law360: Colo. AI Rules Face Calls For Longer Compliance Window
