The Colorado Attorney General filed proposed draft rules on August 11, 2026 to implement the state's Automated Decision-Making Technology (ADMT) Act and Chatbot Safety Act, and set a September 4, 2026 deadline for comments that will shape a revised draft circulated no later than September 23. The rulemaking, detailed on the Colorado Department of Law's AI rulemaking page, clarifies developer and deployer obligations under SB 26-189 and chatbot operator duties under HB 26-1263, both of which take effect January 1, 2027.
The updated timeline narrows the window for stakeholders who want to influence the revised text. Comments received by September 4 feed the revised proposed draft; comments by October 5 are considered for revisions presented at the formal rulemaking hearing; and the comment period closes October 26, 2026 at 11:59 P.M. MST, or the last day of the hearing if it runs longer.
What do the proposed Colorado rules require?
The draft ADMT and Chatbot Safety Rules implement two 2026 statutes. SB 26-189, signed in May 2026, repeals and reenacts the 2024 Colorado AI Act (SB 24-205) and defines "automated decision-making technology" used to materially influence a consequential decision. It imposes requirements on developers whose ADMT is used in such decisions and on deployers who use it, and gives consumers the right to request and correct inaccurate personal data processed by ADMT. HB 26-1263, the Chatbot Safety Act signed July 1, 2026, amends Colorado law to add protections for users of conversational AI: operators must estimate user age, disclose that users are interacting with AI rather than a human, safeguard teens from sexually explicit content and simulated emotional dependence, and provide privacy and account-management tools for minors. Operators must also implement suicide and self-harm response protocols and are barred from representing chatbot outputs as equivalent to licensed professional services.
The rulemaking translates these statutory mandates into binding regulatory detail, including the content of the annual chatbot safety report that HB 26-1263 requires operators to file with the Office of the Attorney General.
Who has to comply, and when does the law take effect?
The obligations reach any company that develops or deploys high-risk ADMT for consequential decisions affecting Colorado consumers, and any operator of a conversational AI service that reaches Colorado users. The ADMT Act is enforced as a deceptive trade practice under the Colorado Consumer Protection Act, so the Attorney General can pursue enforcement directly rather than through a standalone AI regime. Both statutes carry a single effective date: January 1, 2027, which is also the deadline by which the AG must adopt the implementing rules.
What are the comment deadlines in the Colorado rulemaking?
Stakeholders should treat the deadlines as a ladder, not a single filing date. The earlier a comment lands, the more influence it has on the text the AG formally proposes at the hearing.
| Submit by | What it shapes |
|---|---|
| September 4, 2026 | The revised proposed draft, circulated by September 23 |
| October 5, 2026 | Proposed revisions presented at the rulemaking hearing |
| October 26, 2026, 11:59 P.M. MST | The final rulemaking record, or the last day of the hearing |
Under section 24-4-103(2.5), C.R.S., any person may request a cost-benefit analysis of the proposed rules within five days of their publication in the Colorado Register, through the dedicated CBA request form or by emailing COPRRR directly. The AG encourages early submission so comments are posted and shared with all stakeholders promptly.
How should affected companies prepare for January 1, 2027?
Companies in scope should not wait for the final rules. Practical steps now include inventorying ADMT used in consequential decisions, mapping conversational AI services against the chatbot safety duties, and submitting written comments by September 4 to influence the revised draft. Compliance teams should also track the rulemaking hearing schedule and watch for Colorado Register publication to trigger the five-day CBA window.
The statute's effective date is fixed: regardless of when the final rules land, the underlying ADMT and chatbot safety obligations apply from January 1, 2027.
Take advantage of this real-time watch
Next, confirm whether your AI systems meet Colorado's definitions of ADMT and conversational AI services, calendar the September 4 and October 26 comment deadlines, and brief the teams responsible for AI governance, product, and consumer protection. Continuous, per-jurisdiction real-time monitoring surfaces rulemaking updates like this Colorado timeline the moment they publish.
