The draft rules were filed with the Colorado Secretary of State on August 11, 2026. Formal public comments are being accepted through October 26, 2026, with a preference for submissions by October 5 so they can be considered in any proposed revisions presented at the rulemaking hearing.
Background on the Two Statutes
The Automated Decision-Making Technology Act (as updated by Senate Bill 26-189) establishes consumer protections against algorithmic discrimination in consequential decisions made by high-risk artificial intelligence systems. It defines automated decision-making technology (ADMT) and imposes requirements on both developers of ADMT used to materially influence consequential decisions and deployers that use such systems. Consumers are given the right to request and correct inaccurate personal data used by ADMT.
The Chatbot Safety Act (House Bill 26-1263), signed into law on July 1, 2026, adds protections for users of conversational AI services. Key requirements include estimating the age of users, disclosing that users are interacting with artificial intelligence rather than humans, safeguarding teen users against sexually explicit content and simulated emotional dependence, implementing privacy and account-management tools for minor users, creating suicide and self-harm response protocols, and prohibiting chatbot outputs from being represented as equivalent to licensed professional services. Operators must also submit an annual report to the Attorney General’s Office on the efficacy and reliability of their safeguards and response protocols.
Both laws become effective January 1, 2027. While the ADMT Act expressly requires the Attorney General to adopt implementing rules, the Chatbot Safety Act does not. The Office has chosen to include chatbot-related provisions in the same rulemaking package to provide clearer compliance expectations, including details on the content of the required annual reports.
Focus of the Draft Rules
According to the Attorney General’s Office, the proposed draft rules are intended to clarify and implement specific provisions of both statutes. Areas expected to receive particular attention include the practical application of ADMT definitions, human oversight requirements for automated decision-making systems, and design and operational obligations for chatbot services intended to reduce potentially harmful interactions.
The rules are designed to help organizations understand when a system qualifies as high-risk ADMT, what obligations attach to developers versus deployers, how consumer rights to access and correct data used in automated decisions should be operationalized, and what concrete design features and protocols chatbot operators must implement to meet the statutory safety requirements.
Comment Period and Stakeholder Input
The Colorado Department of Law has emphasized the value of diverse stakeholder input in producing effective rules. A pre-rulemaking phase collected informal comments through July 13, 2026, supported by a considerations paper that outlined background issues and questions. The formal comment period is now open.
Written comments may be submitted through the Office’s comment form between August 11 and October 26, 2026 (11:59 p.m. MST). Comments received by October 5 will be considered for any proposed revisions presented at the rulemaking hearing. All timely comments will become part of the official rulemaking record and will be posted online.
Interested parties may also request a cost-benefit analysis of the proposed rules within five days of their publication in the Colorado Register.
Practical Implications for Organizations
Organizations that develop or deploy automated decision-making systems affecting consequential decisions—such as those related to employment, credit, housing, education, insurance, or other significant opportunities—should review the draft rules carefully. Key questions will include how “material influence” is interpreted, what documentation and testing expectations apply, how human oversight must be structured, and how consumer correction rights will operate in practice.
Companies operating conversational AI services accessible to Colorado users face a separate set of design and operational requirements. Age estimation, clear disclosure of the AI nature of the interaction, content safeguards for minors, emotional-dependence protections, self-harm response protocols, and restrictions on professional-service representations will all require concrete product and process changes. The annual reporting obligation to the Attorney General will also necessitate systems for measuring and documenting the performance of these safeguards.
Because both laws take effect on the same date, organizations subject to either or both frameworks have a limited window to align product design, governance, documentation, and operational processes with the forthcoming final rules.
Next Steps in the Rulemaking Process
The Attorney General’s Office will consider comments received during the formal period and may present revised drafts at the rulemaking hearing. Final rules are expected to be adopted in time to provide guidance before the January 1, 2027 effective date of the underlying statutes.
Organizations with an interest in the practical interpretation of high-risk ADMT, human oversight standards, chatbot safety design features, or annual reporting metrics should submit comments early to maximize the opportunity to shape the final text. Tracking the rulemaking docket and reviewing posted comments from other stakeholders will also help organizations anticipate the direction of the final rules.
Colorado’s dual focus on automated decision-making discrimination protections and chatbot safety obligations places the state among the more active U.S. jurisdictions regulating specific AI use cases. The draft rules represent an important step toward translating those statutory requirements into operational compliance expectations for developers, deployers, and conversational AI operators serving Colorado residents.