Colorado just put a bright line under the softest word in AI compliance: influence. On October 6, 2026, the Colorado Department of Law released an interim redline of 4 CCR 904-6, the rules that will implement the Automated Decision-Making Technology Act and the Chatbot Safety Act before both take effect on January 1, 2027. The Attorney General’s rulemaking page keeps written comments open through October 26, 2026, the same day as the public hearing in Denver.
Our position is that Rule 6 is the piece that matters. It creates a rebuttable presumption that an ADMT output materially influenced a consequential decision when the model constrains options, sets a threshold, or produces a rank, score, classification, recommendation, prediction, or other inference that was reviewed in the process and is consistent with the outcome. That flips the usual posture. Deployers no longer get to wave at a human in the loop and call the machine a suggestion; they have to show the output was a de minimis factor, or they inherit the disclosure, documentation, and consumer-rights duties that attach to Covered ADMT.
What the ADMT Act already locked in
Senate Bill 26-189, signed May 14, 2026, repealed and reenacted Colorado’s earlier AI consumer-protection statute. It defines automated decision-making technology as computation that generates predictions, recommendations, classifications, rankings, scores, or other information used to make, guide, or assist a decision about an individual. A consequential decision covers access, eligibility, or compensation tied to education, employment, housing, lending, insurance, health care, or essential government services.
Starting January 1, 2027, developers of Covered ADMT must give deployers technical documentation on intended uses, training-data categories, known limitations, and instructions for appropriate use and human review. Deployers must give clear notice at the point of interaction, disclose an adverse outcome’s ADMT role within 30 days, and honor consumer rights to data access, correction, and meaningful human review. Violations are deceptive trade practices under the Colorado Consumer Protection Act, with a 60-day cure window before January 1, 2030. There is no new private right of action.
The interim rules turn influence into an evidentiary test
The statute already keyed duties to systems that “materially influence” a consequential decision. The interim draft’s Rule 6 tells deployers how that phrase will be read. An ADMT output is presumed to materially influence when it constrains the option set, sets a threshold, or produces a rank, score, classification, recommendation, prediction, or other inference that (a) pertains to the individual, (b) is reviewed by the decision-maker or used to screen what the decision-maker sees, and (c) is consistent with the outcome.
The presumption can be rebutted with evidence that the output was a de minimis factor. The draft lists the evidence that will count: the deployer did not consult the output; a consistently applied hard cutoff decided the case; an authorized reviewer with subject-matter understanding independently analyzed substantial other information and the adverse outcome tracked that other information; the human decided against the model; or other contemporaneous proof of independent judgment. “De minimis factor” means the output was not a substantial factor, because other independent factors played a significantly larger role.
That is Checkpoint-Based Governance in regulatory form. A checkpoint only works when the human can accept, modify, or reject the machine’s output and leave a record. Colorado’s draft makes the record the product. If the score and the denial line up, the burden shifts. A reviewer who rubber-stamps every flag will not rebut the presumption; a reviewer who can show independent evidence and authority might.
Chatbot Safety rules sharpen disclosure and the annual report
House Bill 26-1263, the Chatbot Safety Act, covers conversational AI services accessible to the general public that primarily simulate human conversation. Operators must estimate age, disclose that users are interacting with AI, protect minors from sexual content and simulated emotional dependence, run suicide and self-harm response protocols, and file an annual report with the Attorney General.
The interim rules fill in the blanks the statute left open. Persistent on-screen disclaimers for minors must stay visible without scrolling or hovering. Adult users get a disclosure at the start of each calendar day’s first interaction, again at least every three hours in a continuous session unless a persistent disclosure is already visible, and whenever they ask whether the system is human. The annual-report rule requires operator size tiers by monthly active users, crisis-referral counts with denominators and accuracy measures, and functional descriptions of how suicidal-ideation protocols are enforced—model behavior, classifiers, human review, or a mix. Operators can reuse a similar report filed for another jurisdiction if they attach an appendix for anything Colorado still requires.
What Responsible AI teams should build before January 2027
Three moves follow from the interim draft, whether or not every redline survives the hearing.
First, inventory every ADMT that ranks, scores, classifies, or screens people in a covered domain, and mark which outputs are reviewed before a decision. The measure is the share of consequential workflows with a written material-influence determination—covered or rebutted—before January 1, 2027.
Second, build the rebuttal file now. For each high-risk workflow, document what independent evidence a reviewer must examine, who has authority to override the model, and how a rejection is stored. The measure is the reviewer override or independent-basis rate. A rate of zero across hundreds of matching scores is evidence the presumption will stick.
Third, treat chatbot disclosures and crisis protocols as auditable controls, not footer copy. Log when disclosures fire, how often continuous sessions hit the three-hour refresh, and how crisis referrals are counted against a defined conversation denominator. Those numbers are what the annual report will demand.
The calendar is short. The Secretary of State eDocket lists the hearing for October 26, 2026, at 10:00 a.m. Mountain time in Denver, with written comments due the same night. The rules become effective January 1, 2027. Colorado is not asking whether AI was “in the room.” It is asking whether you can prove the algorithm was not the decision.
Sources
- Colorado Department of Law. (2026, October 6). Automated Decision-Making Technology & Conversational Artificial Intelligence Service Rules, 4 CCR 904-6 [Interim draft redline]. https://coag.gov/app/uploads/2026/10/2026.10.06-ADMT-Chatbot-Act-Rulemaking-Interim-Draft-Redline.pdf
- Colorado Attorney General. (2026). Colorado Automated Decision-Making Technology & Chatbot Safety Rulemaking [Rulemaking page]. https://coag.gov/ai/
- Colorado General Assembly. (2026). SB26-189: Automated Decision-Making Technology [Bill page; signed May 14, 2026]. https://www.leg.colorado.gov/bills/sb26-189
- Colorado General Assembly. (2026). HB26-1263: Conversational Artificial Intelligence Service Operator Requirements [Bill page; signed May 29, 2026]. https://leg.colorado.gov/bills/HB26-1263
- Colorado Secretary of State. (2026). CCR eDocket tracking number 2026-00360: 4 CCR 904-6 [Rulemaking docket; hearing October 26, 2026]. https://www.coloradosos.gov/CCR/eDocketDetails.do?trackingNum=2026-00360
FAQ
What did Colorado release on October 6, 2026?
The Department of Law released an interim redline draft of 4 CCR 904-6, the implementing rules for the ADMT Act (SB26-189) and the Chatbot Safety Act (HB26-1263). Written comments are open through October 26, 2026, and the rules are set to become effective January 1, 2027.
What is the material influence presumption?
Under interim Rule 6, an ADMT output is presumed to materially influence a consequential decision when it constrains options, sets a threshold, or produces a rank, score, classification, recommendation, prediction, or other inference that was reviewed in the decision process and is consistent with the outcome. Deployers can rebut that presumption by showing the output was a de minimis factor.
What does the Chatbot Safety Act require?
Operators of public conversational AI services must estimate user age, disclose that the system is AI, protect minors from sexual content and simulated emotional dependence, implement suicide and self-harm response protocols, and submit an annual report to the Attorney General. The interim rules specify disclosure timing and the metrics the annual report must include.
Is this Responsible AI or AI Governance?
It is AI Governance. Responsible AI is machine checking machine with no human review. Colorado’s ADMT framework requires human checkpoints, adverse-outcome disclosures, and a path for consumers to demand meaningful human review after an adverse decision.
What should deployers do before January 1, 2027?
Map which scoring or ranking tools sit in covered domains, write a material-influence determination for each, build the evidentiary file needed to rebut the presumption when the human truly decided independently, and instrument chatbot disclosures and crisis-referral metrics so the annual report can be produced from logs rather than memory.
AI disclosure: This column was researched and drafted with AI assistance by HAIA Agents (RAI by GrokBot), using primary sources verified at time of publication. #AIg
Leave a Reply