What did Colorado release in October 2026?
On October 6, 2026 the Colorado Department of Law released an interim draft of rules for its Automated Decision-Making Technology Act and Chatbot Safety Act, then held the formal hearing on October 26, 2026. Both laws take effect January 1, 2027.
From signed laws to final rules
The rules are called the Automated Decision-Making Technology & Conversational Artificial Intelligence Service Rules, 4 CCR 904-6. The dates below come from the Colorado Attorney General's rulemaking page, the interim draft's cover letter dated October 6, 2026, and the notice of rulemaking, all read October 30, 2026:
- August 11, 2026: proposed rules filed with the Secretary of State, with a notice of hearing.
- September 4, 2026: the cut-off for the first round of input; the Department says it received "over sixty rulemaking comments" between August 11 and September 4.
- October 6, 2026: the interim draft (redline PDF) and a cover letter with follow-up questions.
- October 21, 2026: a regulatory analysis, prepared at the Department's discretion after a late request.
- October 26, 2026: the public formal rulemaking hearing in Denver and online; written comments closed at 11:59 p.m. MST that day.
- Before January 1, 2027: final rules, which the ADMT Act requires the Attorney General to adopt by that date.
The interim draft is not final. In the cover letter's words: "the interim rules are not final and the DOL will continue to contemplate all input received". If you use AI chat or voice agents, or AI that helps make decisions about people, and you serve Colorado residents, these drafts show where the final rules are heading. Our AI consulting team checks this kind of rule against each system in a client's roadmap.
Which Colorado laws do these rules implement?
Two 2026 laws. SB 26-189, signed May 14, 2026, replaced the 2024 Colorado AI Act with rules for automated decision technology in consequential decisions. HB 26-1263, the Chatbot Safety Act, sets duties for operators of conversational AI services.
| SB 26-189 (ADMT Act) | HB 26-1263 (Chatbot Safety Act) | |
|---|---|---|
| Covers | Developers and deployers of technology that processes personal data and helps make consequential decisions about education, employment, housing, financial or lending services, insurance, health care or essential government services | Operators of conversational AI services, with exemptions |
| Main duties | Notice at the point of interaction; plain-language explanation within 30 days after an adverse decision; human review on request; records for 3 years | Disclose that users are talking to AI; estimate user age; protect minors; self-harm response protocol; no claims of licensed professional advice; annual report to the Attorney General |
| Duties start | January 1, 2027 | January 1, 2027 |
| Enforcement | Attorney General, as a deceptive trade practice; 60-day cure notice before January 1, 2030; no new private right of action | Attorney General |
Sources: SB 26-189 and HB 26-1263 on the Colorado General Assembly site and the Attorney General's summary, read October 30, 2026. For how these laws sit next to Texas, California and New York City rules, see our guide to US state AI laws for businesses.
What do the draft rules say about chatbots?
The interim draft says a bot limited to a bounded task, such as "scheduling an appointment" or "answering a billing question", can fall under the narrow-topic exemption. In-scope chatbots must tell adults they are AI each day and at least every three hours.
Is your chatbot likely in scope?
From Rules 9 and 11 of the October 6 interim draft:
- Narrow and discrete topic exemption. The Department "will consider whether the output was generated from completion of a bounded task", such as the three examples above. Menu or button chatbots and rule-based chatbots also qualify "as long as these chatbots cannot generate outputs related to sexually explicit conduct" or engage in conversation about suicidal ideation or self-harm.
- Business-use exemption. For a service "primarily designed and marketed for commercial use by business entities", the Department looks at whether the interface is open to any consumer, whether it is marketed mainly to businesses, and whether its design follows specific business functions.
- Disclosure to adults. An in-scope service must disclose that it is AI at the beginning of a user's first interaction each calendar day, at least once every three hours in a continuous interaction (or as a persistent notice), and whenever the user asks whether it is human.
- Disclosure to minors. On a screen, a disclaimer that stays visible throughout the conversation without scrolling or clicking. Without a screen, an audio disclaimer repeated at reasonable intervals and whenever the user asks.
- Annual report. Operators report their size by monthly active users, in five tiers from more than 10,000,000 down to fewer than 500,000, plus crisis-referral figures.
Rule 3 adds a standard for every notice under both laws: plain language, accessible to people with disabilities (citing the Web Content Accessibility Guidelines 2.2), in the languages the business normally uses with customers, readable on phones, and not misleading.
What do the draft rules say about automated decisions?
The main open question is "material influence": when an AI output counts as shaping a consequential decision. The draft offers a test built on whether a human reviewed the output, whether the decision matched it, and whether the decision maker saw the underlying evidence.
The notice of rulemaking sets out the statutory test: an output materially influences a decision when it "is a non-de minimis factor" and "affects the outcome", including by "constraining, ranking, scoring, recommending, classifying". The Department proposed defining a de minimis factor as one with "only a trifling, trivial, or incidental impact", and listed factors such as whether the decision maker reviewed the output before deciding and whether their judgement was independent of it. The October 6 cover letter says several commenters objected to a rebuttable presumption of material influence, and the Department asked for alternatives.
Other points from the cover letter: the Department reads the ADMT Act as not applying to governments, it is open to a different definition of "financial or lending service", and it answered requests for a grace period with the enforcement statement below.
Will Colorado enforce the AI laws from January 1, 2027?
The laws take effect January 1, 2027, and the interim draft contains no grace period. The Attorney General's office says its policy is to focus on "egregious and intentional violations" and that it "will exercise appropriate discretion" while businesses come into compliance.
That is from the October 6 cover letter, which answers stakeholders who asked for a grace period. For the ADMT Act, the statute itself adds a 60-day notice and cure period before January 1, 2030, where a cure is possible. A softer start is a stated policy, not a rule, so we would not plan around it.
What this means for your business
If your AI only answers questions and books appointments, the Chatbot Safety Act may not apply, though disclosing AI is still cheap and expected elsewhere. If AI screens people for jobs, loans, housing or care, plan for notice, explanation and human review now.
- List your Colorado-facing AI. Chat agents, voice agents, lead scoring, hiring tools. Note what each one decides.
- Keep booking agents narrow. An AI receptionist or chat agent that sticks to bookings, order status and billing questions fits the draft's examples of a narrow topic. Agents that chat about anything are more likely to be in scope.
- Turn on AI disclosure anyway. A first-message disclosure plus an answer when asked "are you human?" covers most of the draft's adult rule, Texas's health care rule and the EU AI Act's Article 50 (see whether the EU AI Act applies to US companies).
- Separate decisions from conversations. If AI output feeds a decision about eligibility, document who reviews it, keep records for at least three years, and prepare the 30-day explanation letter.
- Test before launch and keep the log. Our guide on testing an AI agent before it goes live covers disclosure and handover checks.
- Watch for the final rules on the Attorney General's page before January 1, 2027.
We build these settings into the AI agents and workflows we deliver on our clients' own accounts, and our AI policy guide lists the matching policy sections. The strategy call and first audit are free; book one if you want us to sort your AI uses against these rules. This page is news, not legal advice.
More questions about Colorado's AI and chatbot rules
Are Colorado's AI rules final?
No. As of October 30, 2026 the Department of Law has published an August 11 proposal and an October 6 interim draft, held the formal hearing on October 26 and closed written comments that night. The ADMT Act requires final rules before January 1, 2027. The Department says it will consider all input received during the rulemaking when writing the final set.
Does the Chatbot Safety Act apply to an appointment booking bot?
Possibly not. The interim draft lists "scheduling an appointment" and "answering a billing question" as examples of a narrow and discrete topic for the exemption, as long as the bot cannot produce sexual content or engage in conversation about self-harm. The final rules could change this, so check the adopted text before relying on it.
How often must a chatbot say it is an AI in Colorado?
Under the interim draft, for adults: at the beginning of the first interaction each calendar day, at least once every three hours in a continuous conversation (or as a persistent notice), and every time a user asks whether it is human. For minors, a persistent on-screen disclaimer, or repeated audio disclaimers for products with no screen.
What happened to the original Colorado AI Act?
SB 24-205, passed in 2024, was repealed and replaced by SB 26-189, which the Governor signed on May 14, 2026, before the old law's duties applied. xAI had sued over the old law on April 9, 2026, and the US Justice Department moved to intervene on April 24, 2026. The new law moves to rules on automated decision technology.
Can consumers sue under Colorado's ADMT Act?
The ADMT Act creates no new private right of action. The Attorney General enforces it under the Colorado Consumer Protection Act, where a violation is treated as a deceptive trade practice. The act does set how fault is split between developers and deployers in discrimination claims brought under existing law.
Does this affect businesses outside Colorado?
It can, if your AI interacts with Colorado residents or makes consequential decisions about them. Many US businesses serve customers in several states, so the practical approach is one set of controls (disclosure, human review, records) that meets the strictest state you serve.
Sources and further reading
- Colorado Attorney General, Automated Decision-Making Technology and Chatbot Safety rulemaking (read October 30, 2026)
- Colorado Department of Law, interim draft rules 4 CCR 904-6, October 6, 2026 (PDF)
- Colorado Department of Law, interim draft cover letter, October 6, 2026 (DOCX)
- Colorado Department of Law, notice of proposed rulemaking, hearing October 26, 2026 (DOCX)
- Colorado General Assembly, SB 26-189
- Colorado General Assembly, HB 26-1263
- US Department of Justice, April 24, 2026 release
