Colorado’s ADMT and Chatbot Rules: Deployer Readiness

Key Takeaways

The Colorado Attorney General will hold a public rulemaking hearing on October 26, 2026, on draft rules implementing two statutes that both take effect January 1, 2027: the Automated Decision-Making Technology Act (SB 26-189) and the Chatbot Safety Act (HB 26-1263) [1][2][3]. The rules are still moving. An interim redline released on October 6 changed several ADMT provisions from the August 11 proposal, so organizations that built plans around the August text should re-check them [4].

Colorado’s reenacted ADMT law is narrower in scope than the 2024 Colorado AI Act it replaced. It drops the mandatory risk management program, impact assessments, and the duty of reasonable care against algorithmic discrimination, and it substitutes a notice, explanation, correction, and human-review framework that adds consumer-facing rights the earlier law did not contain [5]. The operational burden has shifted toward evidence: deployers will need to show, on request and after an adverse outcome, what an automated system did and who reviewed it.

The Chatbot Safety Act applies to operators of publicly accessible conversational AI regardless of industry. The draft rules add concrete expectations for age estimation, AI disclosure, protections for minors, and annual reporting to the Attorney General [6][7]. Organizations that run customer-facing assistants should treat the rules as a security and product engineering requirement, not only a legal one.

Teams have about nine and a half weeks between the hearing and the effective dates, and the written comment window closes in six days. We recommend inventorying covered systems now, building the logging and review workflows that the rules assume, and considering a written comment before the October 26 deadline.

Background

Colorado enacted the first comprehensive U.S. state AI statute, SB 24-205, in 2024. On May 14, 2026, Governor Polis signed SB 26-189, which repealed and reenacted that law as an ADMT statute with an effective date of January 1, 2027 [5]. The new law regulates “covered automated decision-making technology,” meaning computation or machine learning that processes personal data and materially influences a consequential decision. According to a law-firm analysis, the covered domains are employment, housing, credit, insurance, healthcare, education, and essential government services [5]. Routine functions such as scheduling, customer service triage, advertising, and content moderation are excluded, as are basic tools like calculators and spell-checkers [5].

The statute divides responsibilities between developers and deployers. Developers must give deployers documentation on intended uses, known risks and limitations, and categories of training data, along with instructions for appropriate use, and must retain records for three years [5]. Deployers must notify consumers before using covered ADMT, explain adverse outcomes, accept correction requests, and offer meaningful human review [5][8]. The Attorney General holds exclusive enforcement authority and treats violations as deceptive trade practices. A 60-day notice-and-cure period applies except for knowing or repeated violations, and the cure right is reported to expire on January 1, 2030 [5]. Several sectors, including HIPAA-covered healthcare, ECOA/FCRA-regulated financial services, and FERPA-governed education, receive tailored relief [5].

HB 26-1263 was signed on May 29, 2026, and also takes effect January 1, 2027 [3][6]. It requires operators of public conversational AI services to disclose that users are interacting with AI, estimate user age, withhold engagement rewards from minors, take reasonable measures against sexually explicit output and simulated emotional dependence for minors, and maintain suicide and self-harm response protocols. Operators may not imply that output equals services from a licensed professional, and they must file annual reports with the Attorney General [3][6]. CSA published an analysis of the statute in July, which also reports that violations fall under the Colorado Consumer Protection Act with civil penalties of up to $20,000 per violation [6].

The Department of Law filed proposed rules on August 11, 2026, and accepted early comments through September 4 [1][9]. The interim redline of October 6 incorporated changes ahead of the hearing, which will begin at 10 a.m. at the Department of Law in Denver, with remote participation by Zoom [2][4]. Written comments are accepted through October 26 [1][2]. The Attorney General’s office has been reported to be seeking adoption before January 1, 2027 [1].

Security Analysis

What the ADMT rules ask of deployers

The October redline changes several points that determine whether a given system is in scope. According to Orrick, it adds a presumption that a system “materially influences” a decision when human decision-makers review outputs such as scores or rankings that then align with the final outcome. A deployer can rebut the presumption by showing the output was only a “de minimis factor,” and tools limited to summarization fall outside the statute [4]. In our reading, this means “human in the loop” workflows no longer provide a clear exit from coverage, which matters for security and governance teams. A resume-ranking feature that recruiters consult before deciding is the paradigm case the presumption seems aimed at, though that application is our inference rather than the rule text.

The redline also reduced several consumer-facing obligations. Orrick reports that it removed the requirement to state “principal reason(s)” and disclose underlying inferences, requiring instead that deployers “describe the technology’s role with specificity.” It changed delivery from two channels to “every channel the deployer typically uses,” and added an exception for fraud prevention and sanctions compliance. Access and correction rights were recast as requests for instructions on obtaining and correcting personal data, excluding “opinions, predictions, scores, and protected evaluations,” and the requirement to suspend adverse outcomes during review was dropped. Human reviewers may be internal or external if they have actual override authority [4].

The sources disagree on response timelines, and we did not confirm any of the figures against the redline text. Secondary sources describing the August draft report a 30-day window for adverse-outcome disclosure [8] and 45 days for human review or correction [9], though we could verify only the 45-day figure in the sources we could read. Orrick’s summary of the redline refers to a 15-day period, but its text is ambiguous about which obligation that figure governs [4]. The statutory 30-day adverse-outcome explanation reported for SB 26-189 [5][11] means a 15-day period, if it applies to that obligation, would shorten the statutory period rather than match it. Deployers should confirm all timing requirements against the redline on the Attorney General’s rulemaking page [2] and, until they have done so, plan to the shortest reported figure of 15 days.

The developer-to-deployer information flow is the most security-relevant part of the draft. Wiley reports that the rules require developers to supply information on intended uses, known risks, limitations, testing, and monitoring, plus instructions on data types, monitoring methods, and identifying output factors, with trade secrets withholdable through a documented process [10]. One commentary also describes a “midstream developer” category for companies that modify a model before deployment [9]. The Attorney General has specifically invited input on responsibilities when employers use third-party AI vendors [2]. For deployers, this would likely read as a procurement requirement: contracts should secure the documentation the rules contemplate, and a vendor’s refusal to supply it could become the deployer’s compliance gap.

Finally, the draft assumes a record. Meaningful human review is described as independent, performed by someone with relevant expertise and real authority to override, with documentation of the review [8][9]. Developers must retain records for three years [5], and one law-firm guide says deployers should retain compliance records for the same period [11]. Without model version logs, input-feature records, and reviewer decision trails, a deployer cannot show that a review was meaningful or that an ADMT’s role was described accurately. These are engineering deliverables for security and platform teams, not only for counsel.

What the chatbot rules ask of operators

The draft chatbot rules turn the statute’s general duties into testable requirements. On age estimation, operators must use “commercially reasonable or generally accepted methods,” those methods may not rely solely on self-declaration, and operators must periodically reassess age and reasonably detect fraudulent claims [10]. Commentators list zero-knowledge proofs, facial analysis matched to government ID, and digital-footprint assessment as examples of acceptable approaches [8]. One summary says the draft restricts government ID as the sole verification method [9], which sits uneasily with the ID-matching example, and we did not resolve the difference against the rule text. Either way, age estimation creates a new sensitive data flow, and operators should assess the privacy and breach exposure it introduces.

Disclosure and minor-protection provisions are likewise specific. Disclosures must be comprehensible, available in relevant languages, and delivered within the normal interaction channel [10], and one summary describes refreshes during extended sessions [9]. The minors provisions restrict variable reward mechanisms, require technically feasible safeguards against prohibited content, and require measures against emotional dependence [10]. In our view these are behavioral guardrails that must be tested rather than asserted. A red-team program that probes for emotional-dependence language and sexual content with minor-profile personas is a natural way to generate that evidence. CSA’s June analysis of a Meta AI support bot authentication bypass shows how conversational surfaces can be abused in other ways, which supports treating these assistants as attack surface and not only as products [12].

Annual reporting is the provision with the clearest external visibility. Reports are reportedly due July 1, 2027, covering calendar 2027, and would include monthly active users by tier, crisis referral counts and accuracy metrics, age-estimation methodologies, and metrics on minors encountering prohibited content [8]. Operators should note that CSA’s July analysis reports that the self-harm protocol reports will be public [6]. Metrics of this kind must be instrumented from January 1, which means telemetry and classification pipelines need to be in place well before the first conversation of 2027. A narrow chatbot that addresses “only discrete topics” and cannot generate harmful content is reportedly exempt, and the summaries we reviewed identify no general small-business exemption [8][9].

Where the sources and the rules still conflict

Two uncertainties merit mention beyond the timing and age-verification points above. First, enforcement timing is unclear. One law-firm summary states that the Attorney General agreed to stay enforcement until regulations are final and courts address litigation challenging the 2024 law [8]. We could not confirm the scope of that commitment against a primary source, and it may refer to the repealed statute. Second, the interim redline is an intermediate draft, and the hearing may produce further revisions. Planning to the stricter reading of each provision, then relaxing if the final rules permit, is the lower-risk path.

Recommendations

Immediate Actions

Inventory every system that scores, ranks, screens, or recommends in the seven covered decision domains, and every customer-facing conversational AI service. For each ADMT, record whether a human reviews its output and whether that output tends to align with final decisions, given the new material-influence presumption [4]. Download the redline from the Attorney General’s page [2] and compare timing, channel, and review requirements against current processes. If any provision would be impractical to implement, consider filing a written comment by October 26 or registering to speak, since the hearing seeks input on vendor responsibilities and developer disclosures [2].

Short-Term Mitigations

Before January 1, add contract language requiring ADMT vendors to deliver the developer documentation the law and rules describe, including intended uses, limitations, training-data categories, monitoring guidance, and notification of material updates [5][10]. Stand up decision logging that captures model version, inputs used, output, reviewer identity, and the review outcome, retained for at least three years [5][11]. Draft adverse-outcome notice templates that describe the technology’s role specifically and route them through “every channel the deployer typically uses,” while noting the redline’s reported exception for fraud prevention and sanctions compliance [4]. For chatbots, select an age-estimation method, document the privacy assessment, implement AI disclosure and consider session-level re-disclosure in extended conversations, disable engagement rewards for estimated minors, and test self-harm protocols with referral to crisis services [3][6][9][10].

Strategic Considerations

In our view, Colorado is likely to be one of several states whose obligations differ in detail, so a common control baseline mapped to the strictest reading will probably be cheaper than state-specific builds. The shift from impact assessments to notice and review makes operational evidence the center of compliance, and organizations that already log and audit AI decisions will have an advantage. Organizations should also plan for the annual chatbot report as a recurring metrics deliverable owned jointly by security, trust and safety, and legal. We would not read the repeal of the impact-assessment requirement as a reduction in risk. The underlying discrimination and safety risks remain, and sector regulators and private litigants may still reach them.

CSA Resource Alignment

CSA’s research note Colorado’s Chatbot Safety Act: A New Compliance Floor is the most directly relevant prior work [6]. It analyzes HB 26-1263 and anticipates the companion ADMT framework. This note extends that analysis to the draft implementing rules, particularly the age-estimation, disclosure, and reporting mechanics that the statute left open.

For control mapping, the AI Controls Matrix (AICM) v1.1 provides a vendor-neutral baseline [13]. The developer documentation, decision logging, and human-review obligations discussed above align, in our mapping, with its governance, logging and monitoring, and model-lifecycle domains. A deployer that implements those controls will have much of the evidence that the Colorado rules assume. CSA’s Meta AI Support Bot Authentication Bypass analysis is relevant for the security testing of conversational services [12]. For vendor assurance on the third-party ADMT supply chain, the CSA STAR program offers a structured basis for due diligence questions, although it does not address the Colorado-specific developer documentation duties directly.

References

[1] Law Week Colorado. “Colorado AG issues notice of public hearing on AI, chatbots.” Law Week Colorado, 2026.

[2] Colorado Attorney General. “Colorado Anti-Discrimination in AI Law (ADAI) Rulemaking.” Colorado Department of Law, 2026.

[3] Colorado General Assembly. “HB26-1263: Conversational AI Service Operator Requirements.” Colorado General Assembly, 2026.

[4] Orrick. “Colorado releases revised proposed automated decision-making rules ahead of hearing.” Orrick InfoBytes, October 9, 2026.

[5] Crowell & Moring. “Colorado Hits Reset on AI Regulation: SB 26-189 Repeals and Reenacts the Colorado AI Act.” Crowell Client Alert, 2026.

[6] Cloud Security Alliance. “Colorado’s Chatbot Safety Act: A New Compliance Floor.” CSA AI Safety Initiative, July 11, 2026.

[7] Akin Gump. “Colorado Attorney General Releases Interim Draft Rules Implementing ADMT and Chatbot Safety Acts.” Akin AI Law and Regulation Tracker, October 2026.

[8] Ballard Spahr. “Colorado Proposes Rules for Automated Decision-Making Technology and Chatbot Safety.” Consumer Financial Services Law Monitor, August 2026.

[9] AvailableLaw. “Colorado’s Proposed ADMT & Chatbot Safety Rules: What Small Businesses Should Know (and Say) Before October 26.” AvailableLaw, 2026.

[10] Wiley. “Colorado Proposes Detailed Rules Implementing New ADMT and Chatbot Laws.” Wiley Alert, 2026.

[11] Hoog Law. “Colorado SB 26-189 (ADMT Act): A Practical Guide.” Hoog Law, 2026.

[12] Cloud Security Alliance. “Meta AI Support Bot Authentication Bypass.” CSA AI Safety Initiative, June 13, 2026.

[13] Cloud Security Alliance. “AI Controls Matrix v1.1.” Cloud Security Alliance, 2026.