Colorado's attorney general was set to take public testimony on Monday, October 26, on the rules that will decide how the state's rewritten AI law works in practice. The written comment window closed at 11:59 p.m. the same night unless the hearing ran on. That makes this the last chance for employers, lenders, AI vendors and consumer groups to shape automated decision-making rules that take effect on January 1, 2027.
The hearing covers two statutes signed by Governor Jared Polis in May: SB 26-189, the Automated Decision-Making Technology (ADMT) Act, and HB 26-1263, the Chatbot Safety Act. Colorado was the first US state to pass a broad AI accountability law. Together, these two statutes now make it the main test of whether a lighter, disclosure-based model of AI regulation can hold up at state level.
From Landmark Law to Narrower Rulebook
The ADMT Act repealed and replaced the state's 2024 AI law, SB 24-205. That law required detailed impact assessments, risk-management programmes and an affirmative duty to guard against algorithmic discrimination. Industry pushed back hard, and in April xAI sued in federal court in Colorado. The US Department of Justice filed its own complaint weeks later, arguing among other things that the disclosure rules compelled speech.
The replacement, introduced on May 1 and signed on May 14, takes a narrower notice-and-transparency approach. According to an analysis by McDermott Will & Schulte:
- Impact assessments and the affirmative algorithmic-discrimination obligation are gone.
- Consumers keep rights to notice when an AI system is used, an explanation after an adverse outcome, data correction and meaningful human review.
- Developers must still give deployers technical documentation and update notices.
- Liability is split between developers and deployers, joint and several liability is barred, and a 60-day notice-and-cure period applies before enforcement.
The law covers consequential decisions such as hiring, promotion and termination. The state attorney general enforces it under the Colorado Consumer Protection Act, and it creates no new private right of action.
The "Materially Influence" Fight
The biggest question at the hearing is when an AI tool's output counts as "materially influencing" a decision. The statute defines this as a "non-de minimis factor." Attorney General Phil Weiser's office has put forward two competing standards, as described in the National Law Review.
Under the lower threshold, a factor is de minimis only if its effect is trifling or incidental. The state would presume material influence whenever the output relates to the individual, is reviewed by the decision-maker and matches the final outcome. Under the higher threshold, a factor is de minimis if it is not a substantial factor, and a business could rebut coverage by showing independent human review of substantial other information.
The choice matters a great deal. The lower standard would likely bring many AI hiring tools, such as resume screeners and candidate rankers, within the law. The higher one would leave more room for companies that keep a human meaningfully in the loop.
Vendors, Training Data and Chatbots
The attorney general also asked for input on gaps the statute leaves open. The law does not say who is responsible when a third-party vendor runs the ADMT. That is a common setup in recruiting and staffing, where an agency runs the tool and the employer relies on its output. Options on the table include:
- Keeping deployers fully responsible regardless of vendor involvement
- Requiring vendors to help deployers handle consumer data and correction requests
- Modelling vendor duties on processor obligations under the Colorado Privacy Act
The office is also weighing how much developers must disclose about training data categories, testing methods and results, and known limitations.
The same rulemaking implements the Chatbot Safety Act. Operators of conversational AI services would have to meet user-protection requirements and file annual reports with the attorney general. That puts Colorado alongside California, whose companion-chatbot law SB 243 took effect in January.
Why It Matters
Colorado's rules will be one of the first working examples of how a US state regulates algorithmic decision-making in jobs, housing, lending and other high-stakes areas. There is still no comprehensive federal AI law, and the White House is pressing Congress for a single national standard that could preempt state rules. If Colorado's narrower model survives, other states may copy it.
The legal fight is not over either. Under a stipulated federal court order entered in April, xAI will file its full preliminary injunction motion 28 days after final implementing rules are adopted. That covers the replacement law too. The attorney general has agreed not to enforce or investigate until 14 days after the court rules on that motion. McDermott expects xAI and the Justice Department to challenge SB 26-189 as well.
For compliance teams, the timetable is fixed. The rules must be adopted by January 1, 2027, when both laws take effect. Companies using AI to screen applicants or make other consequential decisions about Colorado residents have about two months to map which tools fall in scope, review vendor contracts and set up notice and human-review workflows.
