TL;DR
Colorado now has two enacted AI statutes, both applying from 1 January 2027: the ADMT Act (SB26-189), governing automated decision-making technology used in consequential decisions, and the Chatbot Safety Act (HB26-1263), governing publicly available conversational AI. On 11 August 2026 the Department of Law filed proposed rules to clarify and implement both. The statutes are law; the rules are draft. A deployer’s preparation should be driven by the statutes now, refined by the rules when they are final.
Two statutes, one rulemaking
The filing covers both acts, but their footing is different — and the Attorney General’s page says so directly:
- For the ADMT Act, rulemaking is mandatory. The Act requires the Attorney General to adopt implementing rules before 1 January 2027, and specifically directs rules clarifying the post-adverse-outcome disclosure requirements.
- For the Chatbot Safety Act, rulemaking is voluntary. The Act does not require it; the Attorney General is undertaking it because rules “would help ensure compliance obligations… are clear.”
One lineage point that changes how existing work is reused: SB26-189 repeals and reenacts the framework created by SB24-205 — Colorado’s 2024 AI Act — replacing the “high-risk AI system” regime with the ADMT regime. Anything built against the 2024 Act’s vocabulary needs remapping to the new definitions, not a find-and-replace.
What the ADMT Act requires
From the enacted bill record — this is statute, not draft:
| Obligation | Who carries it |
|---|---|
| Technical documentation: intended uses, categories of training data, known limitations, instructions for appropriate use and human review | Developer, to the deployer |
| Clear and conspicuous notice at the point of interaction with a covered ADMT | Deployer |
| Plain-language description of the ADMT’s role within 30 days after a consequential decision resulting in an adverse outcome | Deployer |
| Consumer right to request personal data and correction of factually incorrect data used by the ADMT | Deployer |
| Consumer right to meaningful human review and reconsideration after an adverse consequential decision | Deployer |
| Records demonstrating compliance, retained at least 3 years | Developer and deployer |
Enforcement design. The Act is enforced by the Attorney General under the Colorado Consumer Protection Act; a violation is a deceptive trade practice. There is no new private right of action. Before initiating an action prior to 1 January 2030, the Attorney General must give a 60-day notice and opportunity to cure — a grace mechanism with an expiry date.
What the Chatbot Safety Act requires
For operators of publicly available conversational AI services, from the enacted record:
- Minor-safety controls. Where the operator knows a user is a minor: technically feasible measures preventing the service from producing explicit sexual conduct, intimate digital depictions, or statements simulating emotional dependence; age estimation; no engagement rewards for minors; and privacy and account tools for parents and guardians.
- A self-harm protocol. Every operator must implement a protocol for user prompts regarding suicidal ideation or self-harm — with annual reporting to the Attorney General on that protocol.
- A stop-engagement protocol for prompts regarding sexual conduct with a minor.
- No professional impersonation. Operators must not represent chatbot output as provided by, endorsed by, or equivalent to services provided by certain licensed or certified professionals.
That last item connects directly to the human-in-the-loop design guide: where a regulated professional is meant to be in the loop, Colorado now prohibits implying one is when none is.
The proposed rules — and the limit of what can be said about them
The rules were filed with the Colorado Secretary of State on 11 August 2026. The Attorney General’s page states their purpose: to clarify and implement the two statutes.
What this page deliberately does not do is describe individual clauses of the proposal. The filed documents — the rules, the notice of rulemaking hearing, and the statement of basis, authority and purpose — are served only as DOCX files, and their clause-level content could not be verified against the page at the time of writing. Statutory obligations above are cited to the enacted records; nothing here should be read as a claim about what the draft rules say beyond the Attorney General’s published description. When the rules are final, this page will be updated against the adopted text.
Comment mechanics, for anyone participating:
- Comments submitted by 5 October 2026 will be considered for proposed revisions presented at the rulemaking hearing — the deadline that matters if you want to influence the text.
- The formal period runs to 26 October 2026, 11:59 p.m. MST, and extends automatically if the hearing runs past that date.
- Comments are posted publicly. A cost-benefit analysis can be requested within five days of publication in the Colorado Register.
What a deployer should be building now
The statutes give the requirements; none of them can be stood up in the final week of December.
- A consequential-decision inventory. Which systems touch decisions with adverse-outcome potential for Colorado consumers, and which qualify as covered ADMT.
- Developer documentation collection. The statute names what the developer owes you — intended uses, training-data categories, known limitations, appropriate-use and human-review instructions. Request it now and record what comes back; the supplier-evidence step applies directly.
- Notice design. Point-of-interaction notice, and the 30-day adverse-outcome description in plain language.
- A correction route. Consumers can demand correction of factually incorrect personal data used by the ADMT — which presumes you can trace what data a given decision used.
- Meaningful human review that survives scrutiny. Reconsideration after an adverse outcome needs a reviewer with the information, competence, authority and time to change the decision — the four conditions in the human-in-the-loop guide. A click-through review process is precisely what “meaningful” is there to exclude.
- Three-year evidence retention, designed rather than assumed — decision records, notices issued, reviews conducted, corrections made.
- For chatbot operators: age-handling, the self-harm protocol and its annual report, the stop-engagement protocol, and marketing review against the professional-impersonation prohibition.
What this does not do
- The filing does not make the draft rules final, and this page makes no claim about their individual clauses.
- The Acts apply from 1 January 2027 — there is no obligation in force today, and also no reason to believe the timeline moves.
- Statutory exemptions exist and are not eliminated by the rulemaking.
- Nothing here is legal advice; the enacted records and the Attorney General’s rulemaking page are the primary sources, and Colorado counsel is the right reader of both for any specific deployment.