Colorado ADMT AI rules: comments due Oct 26, vendors don't cover you

Colorado's Attorney General takes public comments on its Colorado ADMT rules through October 26, 2026, the same day as the rulemaking hearing. The rules apply to automated decision-making technology and AI chatbots, and the target start date is January 1, 2027. The revised draft has one line every small business that buys AI software should read: if a vendor runs the model and you act on its output, the decision is still yours.

What actually happened

In 2026 Colorado replaced its 2024 AI Act with two narrower laws: the ADMT Act (SB 26-189) for AI used in consequential decisions, and the Chatbot Safety Act (HB 26-1263). Per Ropes & Gray, the new law dropped the old duty of care and the impact-assessment requirements. The Department of Law published draft rules on August 11 and a revised redline on October 6.

Orrick's summary of the October draft lists the changes that matter:

• A presumption of influence. If a person reviews a score, ranking, recommendation or threshold about an individual, and the final outcome matches it, the output is presumed to "materially influence" the decision. You can rebut that only by showing it was a de minimis factor.
• Vendor AI is your AI. A deployer stays responsible when a third party runs the technology and the deployer uses the output.
• Summaries are out of scope. Tools used only to summarize, organize or present information for human review do not count.
• Softer adverse-outcome notices. The August requirement to state "principal reasons" is gone. You must now describe the technology's role with specificity, through the channels you normally use with that customer. You get 15 days to answer follow-up requests.

Morrison Foerster confirms the October 26 comment deadline and the January 1, 2027 effective date for both laws.

Why the Colorado ADMT rules matter for your business

Most small businesses do not build AI models. They buy tools with AI inside: tenant screening, applicant scoring, credit checks, fraud flags. Under this draft, "the software decided" is not a defense.

List every score you act on. Tenant scores, hiring rankings, risk thresholds. If staff follow the number most of the time, assume the presumption applies.

Ask each vendor how the score works. You will need to describe the technology's role to a customer who gets a no. If the vendor cannot explain it to you, you cannot explain it to them.

Keep AI summaries as summaries. A tool that organizes an application for a human reviewer sits outside the definition. A tool that ranks applicants does not. Design for the first when you can.

Comment if this hits you. Written comments are open through October 26 at coag.gov/ai.

Sources: Orrick, Morrison Foerster, Ropes & Gray, Colorado Department of Law.