Attorney General Phil Weiser’s formal rulemaking hearing on SB 26-189 opened at 10 a.m. MT this morning at 1300 Broadway in Denver, and the written comment window closes at 11:59 p.m. MT tonight. After that, the rules governing how Colorado deployers of automated decision-making technology disclose adverse outcomes and offer human review go from draft to near-final, with a statutory compliance date of January 1, 2027.

The statute itself is already a lighter instrument than the one firms spent 2025 preparing for. Signed May 14, 2026, SB 26-189 repealed and replaced SB 24-205, stripping the impact-assessment regime, the risk-management program, and the framework-based affirmative defense. What remains covers ADMT that “materially influences” consequential decisions in employment, housing, lending, insurance, and healthcare. “Consumer” expressly includes employees and Colorado-resident job applicants, which pulls any vendor HR platform, CRM scoring tool, or lending screener used on Colorado residents into scope.

The interim rules released October 6 create a rebuttable presumption that certain outputs materially influence those decisions. A regulatory analysis followed on October 21.

For a 5-to-30-person business, the operational contours are concrete. Deployers must give clear pre-use notice; deliver a plain-language adverse-outcome disclosure within 30 days naming the tool, developer, and data source; offer meaningful human review by a trained reviewer with authority to override; and keep compliance records for three years. The October 6 draft would require acknowledging review requests within 10 days and completing them within 45.

If the hearing continues past tonight, the comment window extends to the last hearing day. Once rules are finally adopted, xAI has 28 days to file its preliminary-injunction motion in xAI v. Weiser. January 1, 2027 remains the compliance date regardless. See earlier coverage of the hearing’s stakes and the six-day warning for small businesses.

Sources

Sources