The Statute Was The Threat. The Rule Is The Invoice.

What Colorado’s proposed AI rules demand of the model behind your loan and the bot in front of your customer

Two systems you run now report to the Colorado Attorney General: the model that decides who gets your loan, and the chatbot that consoles the applicants you turned down. On August 11, 2026, the Attorney General filed proposed rules that put operating detail behind both the Automated Decision-Making Technology Act and the brand-new Chatbot Safety Act.¹ Comments close October 26, 2026. Both statutes take effect January 1, 2027. If you extend credit, collect debt, or run a support bot that greets Colorado residents, the draft sitting on the Attorney General’s desk is the draft you will answer.

I wrote previously that Colorado’s grand 2024 AI law had shrunk from “do not let your model discriminate” into “please explain, in plain language, how your model decided.” The rules are where “plain language” stops being a slogan and starts being a checklist. A statute tells you that you owe something. A rule tells you exactly how much, by when, and in what font.

The model behind the loan

Start with the decisioning side, because lenders have been here before and keep hoping it will go away. The proposed ADMT rules do not ask whether your underwriting or pricing model is clever. They ask whether you can explain it to the person it rejected, and they are unsentimental about what “explain” means.

A covered deployer has to give consumers notices that a human being can actually read, not notices that a litigator can defend. When the decision goes against someone, you owe the principal reasons for it, delivered through more than one channel, backed by an information source available around the clock. Consumers can ask to see and correct the personal data that fed the decision, and you have forty-five days to answer. If a consumer is entitled to human review, the review has to be real: an independent, trained person who can reverse the machine, and the machine itself may not help grade its own homework. You keep the documentation for three years.²

Notice what is missing: a small-business exemption. There isn’t one. The only concession to size is a “commercially reasonable” standard, which is the kind of phrase that sounds generous until an Assistant Attorney General decides what it meant. A community lender and a national bank read the same rulebook. Only one of them has a compliance department.

The bot in front of the customer

Now the part that is genuinely new, and that a lot of financial-services, telecom, and SaaS executives have not yet connected to themselves: the Chatbot Safety Act. If you deploy a conversational system that talks to the public and imitates a human, Colorado has opinions about how it behaves.

Three of those opinions matter most to regulated businesses. First, disclosure. Your bot has to tell people they are talking to software, and keep reminding them during longer conversations, which quietly ends the industry tradition of naming the bot “Sarah from the support team” and hoping no one asks. Second, and this one should make every collections and servicing shop sit up, your chatbot may not present its output as provided by, endorsed by, or equivalent to a licensed professional. A bot that drifts into sounding like your lawyer, your financial counselor, or your compliance officer becomes a liability with a statute attached. Third, the Act adds age-estimation duties, protections for minors, and documented crisis-response protocols, and it makes you file an annual report with the Attorney General describing how you handle all of it, starting July 1, 2027.³

The drafters plainly had companion apps and teen-facing products in mind. The text does not care about their intentions. A mortgage servicer’s “virtual assistant” and a buy-now-pay-later lender’s around-the-clock support bot both qualify as conversational AI that imitates a human for the general public, which places them squarely inside the definition, whatever the marketing deck calls them.

Who actually holds the whistle

Enforcement runs through the Colorado Attorney General, not a private plaintiffs’ bar, and violations are handled as deceptive trade practices under the Colorado Consumer Protection Act, carrying penalties that reach $20,000 per violation with a cure period for many missteps.⁴ “Per violation” is the phrase to sit with. Multiply it across an automated portfolio that touches thousands of consumers a day, and you are doing arithmetic no one wants to recite in a deposition.

Colorado is not performing this alone. State attorneys general have spent 2026 enforcing AI through the consumer-protection statutes they already had, without waiting for Washington to pass anything, from first-of-their-kind actions against chatbots that posed as licensed clinicians to a widening set of AI advertising and privacy cases.⁵ The federal referee wandered off the field. The state officials picked up the whistle, and several of them face reelection.

The good news, and what to do before October 26

Here is the part worth holding onto. None of this demands clairvoyance, because the obligations track things a serious operator should already produce. If you can explain why your model declined an applicant, you are most of the way to the ADMT notice rules. If you know which of your customer-facing bots talk to the public and what they claim to be, you are most of the way to the Chatbot Safety Act. The firms that can answer those two questions on a Tuesday are the firms that actually understand their own technology, and that understanding was always the real asset.

So do three things now. Inventory every automated system that makes a consequential decision and every conversational bot that faces a Colorado consumer, because you cannot govern what you never counted. Draft the plain-language explanations and the adverse-decision disclosures while the deadline is a calendar entry rather than a subpoena. And read the proposed rules before October 26, 2026, because the comment window is open, the Attorney General is taking suggestions, and the cheapest time to fix a bad rule is before it becomes one.

The pendulum will swing again; it always does. Companies that build honest model governance and straight-talking bots this year will stand ready no matter which way it goes, and they will spend the next decade watching competitors who treated this as optional explain themselves to a regulator instead.

If your institution is sorting out which of your models and bots fall inside Colorado’s new rules, or how to comment before the window closes, I welcome the conversation. Reach out, and we can map your exposure and a practical path through it before January 2027 arrives with its usual lack of ceremony.

Footnotes

1. “Automated Decision-Making Technology and Chatbot Safety Rulemaking.” Colorado Attorney General, coag.gov/ai/. Accessed September 10, 2026.

2. “Colorado’s Proposed ADMT & Chatbot Safety Rules: What Small Businesses Should Know (and Say) Before October 26.” Available Law, August 2026, availablelaw.com/blog/colorado-admt-chatbot-rules-proposed-2026.

3.  “Colorado’s New AI Chatbot Law: What HB 26-1263 Means for Businesses.” Available Law, 2026, availablelaw.com/blog/colorado-chatbot-law-hb26-1263.

4. “Colorado Repeals and Replaces Its AI Act.” Skadden, Arps, Slate, Meagher & Flom LLP, June 2026, skadden.com/insights/publications/2026/06/colorado-repeals-and-replaces-its-ai-act. Accessed September 10, 2026.

5. “2026 State AG Enforcement: Key Focus Areas for the Remainder of the Year.” Troutman Pepper Locke, 2026, troutman.com/insights/2026-state-ag-enforcement-key-focus-areas-for-the-remainder-of-the-year/. Accessed September 10, 2026.