Colorado’s Attorney General will convene a formal rulemaking hearing on October 26, 2026 at 10:00 a.m. on the twin regimes, the Automated Decision-Making Technology Act (SB26-189, signed May 14) and the Chatbot Safety Act (HB26-1263, signed July 1), that take effect January 1, 2027. Written comments close the same day at 11:59 p.m. MT. There’s no small-business exemption.

The proposed rules, filed as 4 C.C.R. 904-6 on August 11 and revised October 6, convert the statute’s abstractions into operational clocks. Any deployer whose AI output “materially influences” a consequential decision in employment, lending, insurance, housing, healthcare, education, or essential benefits owes an adverse-outcome notice within 30 days through two communication methods where feasible. Consumers get a 10-day acknowledgment, a 24-hour window for rights-request instructions, and a 45-day deadline for meaningful human review. That reviewer must be independent, trained, empowered to override, and barred from using the same ADMT to assist the review. Records are kept at least three years.

Moore & Van Allen notes a new “Midstream Developer” role for firms embedding third-party ADMT, and voids contract clauses that try to indemnify a party for its own anti-discrimination violations. Enforcement sits exclusively with the AG under the Colorado Consumer Protection Act as deceptive trade practices, with a 60-day cure period available through December 31, 2029.

The litigation backdrop matters. xAI’s April 9 suit against predecessor SB 24-205 (No. 1:26-cv-01515-DDD-CYC), joined by the Department of Justice on April 24, produced an April 27 stipulated order: AG Phil Weiser won’t enforce the old act during the challenge, and any preliminary injunction after final rulemaking must be filed within 28 days.

Six days to comment. The clocks won’t move after that.

Sources

Sources