Colorado’s Proposed ADMT Rules: What Businesses Need To Know Now

On August 11, 2026, the Colorado Attorney General published proposed rules (the “Proposed Rules,” 4 C.C.R. 904-6) implementing the state’s Automated Decision-Making Technology (“ADMT”) Act (the “ADMT Act,” as enacted by SB26-189). If adopted as proposed, the Proposed Rules will impose significant burdens on covered businesses that use ADMT that “materially influences consequential decisions” in specified covered domains, while leaving key questions unanswered, including concerns about when exactly ADMT materially influences a decision.

Why this matters now. Colorado’s formal rulemaking hearing is scheduled for October 26, 2026, and the comment period is set to close that day at 11:59 p.m. Mountain Time, unless extended. The ADMT Act is scheduled to take effect January 1, 2027, if not enjoined by the xAI litigation in its lawsuit pending in the U.S. District Court for the District of Colorado (Case No. 1:26-cv-01515-DDD-CYC).

The timing also puts Colorado’s initiative in a broader national debate over AI governance. On September 29, 2026, six frontier-model companies signed the voluntary White House Accord on Super Intelligence: Joint Commitment on Frontier Responsibilities (the "Accord"). The Accord calls for internal model-safety controls, dedicated safety teams, independent external evaluation, and board-level oversight. Its self-regulatory approach contrasts with Colorado’s legally enforceable, decision-specific framework, but both reflect increasing pressure for documented controls and meaningful oversight of advanced automated systems.

The ADMT Act’s Narrower, Decision-Focused Framework

The ADMT Act (SB 26-189) replaced Colorado’s broader Senate Bill 24-205, signed by Governor Polis on May 17, 2024 (the “AI Act”), with a more targeted regime governing automated tools that process personal data and generate outputs used to make, guide, or assist decisions about individuals. The law applies only when ADMT “materially influences” a “consequential decision” in a “covered domain.”

ADMT is defined as “technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other results, that is used to make, guide, or assist a decision, judgment, or determination concerning an individual,” with some exclusions for security measures (e.g., firewalls) and basic technology.

A Consequential Decision is a “decision that has a material legal or similarly significant effect on a consumer’s access to, or the terms of, opportunities in a Covered Domain.” The statute contains exclusions for routine operational decisions, marketing, cybersecurity measures, sanctions compliance, and fraud prevention, among others.

Covered Domains include education, employment, residential real estate, financial and lending services, insurance, healthcare services, and essential government services or public benefits, but HIPAA-covered entities are generally exempt from the Act, except in certain discrete circumstances. Whether ADMT “materially influences” a consequential decision depends on a two-part trigger: the ADMT output must be both (1) a non-de minimis factor used in the decision and (2) an influence on the outcome, including through ranking, scoring, recommending, classifying, constraining, or otherwise meaningfully altering the decision. Incidental, trivial, or clerical uses are excluded.

CoveredIndividuals include Colorado consumers, Colorado employees and applicants, and certain individuals whose access to an opportunity in Colorado is evaluated by a business operating in the state. Thus, although the Colorado Privacy Act’s (C.R.S. §§ 6-1-1301 et seq.) requirements regarding “profiling”—a concept similar to ADMT—do not apply to employees, the ADMT Act’s requirements do apply in the employment context.

Who Must Comply and What Must They Do?

• Developers create, offer, license, or substantially modify covered ADMT or covered components. Their principal duties involve documentation, update notices, monitoring instructions, and records.
• Deployers use covered ADMT to materially influence consequential decisions. Their principal duties involve notices, adverse-outcome disclosures, records, correction rights, and meaningful human review.
• Midstream Developers, a role introduced by the Proposed Rules, integrate third-party covered ADMT into their own covered products. They would be expected to obtain upstream documentation and pass it to downstream developers and deployers.

Both developers and deployers will have new obligations, but deployers are likely to face the most immediate operational burden because under the Proposed Rules, they must operationalize the covered individual’s ability to understand, challenge, and seek review of ADMT-influenced decisions.

What the Proposed Rules Would Add

The Proposed Rules translate the statute’s general duties into specific operational requirements. The most important provisions are summarized below.

Key Response Deadlines Under Proposed Rule 7

The Proposed Rules include the following key timeframes related to the exercise of rights by covered individuals:

• Instructions for submitting a rights request: within 24 hours when requested through the designated toll-free number or address.
• Response to a personal-data or correction request: within 45 days after receipt.
• Acknowledgment of a meaningful-human-review request: within 10 days after receipt.
• Completion of meaningful human review and response: within 45 days after receipt.

Human Review Is More Than a Human Signature

The Proposed Rules envision an independent reviewer who did not make the original decision and, where feasible, is outside that decision-maker’s reporting chain. The reviewer must have appropriate subject-matter knowledge, relevant training, authority to approve, modify, or override the decision, and protection from steering or retaliation. The rules also state that ADMT may not assist in the human review itself.

Whether review is “commercially reasonable” would depend on the type of review, magnitude and reversibility of harm, value of primary evidence, deployer resources, cost and technical feasibility, and availability of qualified reviewers. Review would be presumed commercially reasonable for a severe and irreversible denial of a basic human need, subject to a demanding rebuttal.

Enforcement and Litigation Context

The Colorado Attorney General has exclusive authority to enforce the ADMT Act, and violations are treated as deceptive trade practices. Through December 31, 2029, the Attorney General generally must provide a 60-day opportunity to cure when a cure is possible, although that opportunity may be withheld for knowing or repeated violations. The Act, however, does not create a new private right of action.

The Act also allocates liability between developers and deployers according to relative fault in discrimination actions and rejects joint and several liability except as allowed under existing law. Contract provisions purporting to indemnify a party for its own violations of Colorado anti-discrimination law are void. At the same time, the Act preserves trade secret protections, clarifying that developersDevelopers and deployersDeployers need not disclose proprietary algorithms, models, or other protected intellectual property.

Enforcement remains entangled with the pending xAI litigation. On April 9, 2026, xAI (now part of SpaceX) filed suit in the U.S. District Court for the District of Colorado (No. 1:26-cv-01515-DDD-CYC), seeking to enjoin the ADMT Act’s predecessor, the Colorado AI Act. The complaint asserted four constitutional claims: (1) First Amendment violations based on protected-speech and compelled-speech theories; (2) Commerce Clause violations based on alleged regulation of interstate commerce and extraterritorial effects; (3) unconstitutional vagueness under the Due Process Clause; and (4) Equal Protection violations.violations On April 24, 2026, the U.S. Department of Justice intervened in the case, citing President Trump’s Executive Order 14365, which specifically highlighted SB 24-205 as an example of problematic state AI regulation and directed federal agencies to discourage state-level AI laws that could hamper American competitiveness.

On April 27, 2026, the court granted a joint motion filed by xAI and the Colorado Attorney General suspending enforcement of the AI Act. Under the stipulated order, Attorney General Weiser agreed not to enforce or investigate alleged violations of SB 24-205 during the pendency of the challenge, with a protective buffer of fourteen days after any court ruling on xAI’s motion for preliminary injunction. Any motion for preliminary injunction must be filed within 28 days after final adoption of rulemaking implementing SB 24-205 or any legislation that may replace or amend SB 24-205. Developers and deployers should not treat that uncertainty as a reason to defer preparation, particularly given the January 1, 2027 statutory effective date and the operational work required by the Proposed Rules. If the Proposed Rules are adopted, and xAI does not move to enjoin the ADMT Act, compliance deadlines will follow quickly.

Important Questions Remain

• Material Influence. Influence The Proposed Rules do not supply the presumptions, safe harbors, or objective indicators many stakeholders requested. Common screening, ranking, and workflow tools may therefore require fact-specific analysis.
• Overlap with Other Notice Regimes.Regimes TheProposed Rules address some coordination with federal adverse-action notices, but questions remain about overlap with Colorado Privacy Act profiling notices and sector-specific obligations.
• Developer Awareness.Awareness TheProposed Rules do not define when a developer “becomes aware” that its tool is being used in consequential decisions.
• Commercial Reasonableness.Reasonableness Outside the presumption for severe and irreversible denials of basic human needs, the human-review standard remains highly contextual.
• Protected EvaluationsEvaluation. The ADMT Act provides that “protected evaluations” are among the items that do not require correction upon request, but that term remains undefined.

Five Steps Companies Should Take Now

Because Colorado’s rulemaking is moving forward and similar ADMT-related requirements are emerging inAct in the near term other states, deployers of automated decision-making systems should consider basic compliance steps now.

1. Inventory and classify ADMT systems. Identify automated tools used in covered domains, map inputs and outputs, and document whether each tool meets the two-part material-influence test.
2. Map roles and information flows. Determine whether the organization is acting as a developer, deployer, Midstream Developer, or more than one role. Identify where required documentation must originate and where it must go.
3. Build notice and rights workflows. Prepare point-of-interaction and adverse-outcome notices, accessible request channels, authentication procedures, correction processes, and deadline tracking.
4. Design genuine human review. Select and train qualified reviewers, protect their independence, give them authority and primary evidence, prohibit reliance on ADMT during review, and document each determination.
5. Revisit vendor contracts. Begin requiring upstream documentation, update notices, monitoring information, and cooperation with consumer requests. Review indemnification language and allocate operational responsibilities without attempting to shift liability for a party’s own discrimination violations.