Colorado: AG Issues Interim Redline of ADMT, Chatbot Safety Rules

On October 6, 2026, the Colorado Department of Law released an interim redline draft of 4 CCR 904-6, the implementing rules for the Automated Decision-Making Technology Act (SB 26-189) and the Chatbot Safety Act (HB 26-1263). The redline precedes the public hearing the Colorado Attorney General scheduled for October 26, 2026 at 1300 Broadway, Room 1D, Denver; the formal written-comment period closes the same day at 11:59 p.m. MST.

Colorado employers using automated decision-making technology in hiring, promotion and other consequential employment decisions, developers of covered ADMT systems sold into the state, deployers of ADMT in education, housing, credit and insurance, and operators of consumer-facing conversational AI offered to Colorado residents must compare their current disclosures, consumer-rights procedures and chatbot-safety controls with the interim redline and file written comments by October 26, 2026, or, once the rules take effect on January 1, 2027, a failure to meet the ADMT Act or Chatbot Safety Act duties is a deceptive trade practice under the Colorado Consumer Protection Act, enforced by the Attorney General.

What does the interim redline change for covered ADMT and chatbot operators?

The redline revises the rules first proposed in August 2026 ahead of the hearing. The draft removes the prior September 4, 2026 cutoff for comments to be reflected in the revised proposal, keeps comments open through October 26, 2026, and adds a hearing-registration section for in-person and Zoom attendance.

The redline refines the definitions that gate coverage, including "Accessible to the General Public" for chatbot operators, the "Midstream Developer" who integrates existing ADMT into its own product, and the "De Minimis Factor" test for rebutting the presumption of material influence. It tightens multiparty arrangements: a midstream developer must pass through the developer documentation created under C.R.S. section 6-1-1702, and a deployer that contracts a third party to run covered ADMT keeps all deployer duties. Consumer communications must be understandable, disability-accessible under WCAG 2.2, and available in the languages the deployer or operator ordinarily uses; a developer may withhold information only where it is a trade secret under C.R.S. section 7-74-102(4) or otherwise protected by law, and must then give a categorical description for the downstream actor.

Who is covered by Colorado's ADMT and Chatbot Safety rules?

The ADMT Act reaches developers and deployers of covered ADMT used to materially influence a consequential decision affecting a Colorado resident, across hiring, education, housing, finance, insurance, healthcare, legal services and government benefits. The Chatbot Safety Act reaches operators of consumer-facing conversational AI made publicly available to Colorado residents, with heightened duties around crisis indicators and continuous interactions.

Sector carve-outs shape exposure: insurers and banks are deemed compliant where they follow their existing DORA or federal algorithmic oversight, HIPAA and GLBA data sit outside the Colorado Privacy Act, and a diagnostic company running ADMT for a HIPAA-covered physician does not bear deployer duties. An affirmative defense is available to a developer or deployer that adheres to a recognized AI risk framework, such as the NIST AI Risk Management Framework, designated by the Attorney General. There is no private right of action under either statute; enforcement rests with the Attorney General.

What should covered actors do before October 26, 2026?

• Read the interim redline against your ADMT developer documentation, consumer-rights procedures and chatbot-safety controls.
• Map where your ADMT output sets a threshold, ranks or scores individuals, or constrains an option set, since those outputs carry the rebuttable presumption of material influence.
• Check multiparty contracts: confirm upstream developer documentation flows to downstream deployers and that third-party ADMT arrangements allocate deployer duties correctly.
• Audit consumer and user communications for plain language, disability accessibility (WCAG 2.2) and language coverage.
• Prepare and file written comments through the Colorado Attorney General's rulemaking page before 11:59 p.m. MST on October 26, 2026, and register for the hearing if you intend to testify.

What happens after the rules take effect on January 1, 2027?

From January 1, 2027, a failure to meet the developer documentation, adverse-outcome disclosure, consumer-rights or chatbot-safety duties the rules implement is a deceptive trade practice under the Colorado Consumer Protection Act (C.R.S. section 6-1-108), enforced by the Attorney General. Because the duties attach when the ADMT Act and Chatbot Safety Act enter into force, the comments filed before October 26, 2026 are the formal input to the binding text the Attorney General must adopt before January 1, 2027. Continuous, per-jurisdiction real-time monitoring surfaces this kind of rulemaking change the moment it publishes.

Verify whether your ADMT and chatbot deployments fall inside the consequential-decision and public-availability tests, brief your legal, HR and product-safety teams on the October 26, 2026 comment deadline, and track the Attorney General's final rulemaking expected before January 1, 2027.