If Colorado has already rewritten its AI law once and a federal lawsuit is still hanging over it, why should your team do any work before January 1? Because the version that survived is narrower but far more operational, and the Attorney General's draft rules show exactly what a deployer will have to produce on the first day a consumer receives an adverse decision. The Colorado ADMT Act is less about policy documents than about notices, records, and human review that actually work.
Colorado's original AI Act, SB 24-205, never took effect. Governor Polis signed SB 26-189, the Automated Decision-Making Technology Act, on May 14, 2026, repealing and reenacting the law with a January 1, 2027 effective date, according to the Colorado General Assembly's bill summary. The Attorney General's rules implementing it were still being finalized in late October 2026.
The rulemaking timeline is public. The Colorado Department of Law's AI rulemaking page shows proposed rules filed on August 11, 2026, with written comments accepted through October 26, 2026, the date of the formal rulemaking hearing. The Department released an interim revised draft on October 6, after receiving more than 60 written comments, and the statute requires the rules to be adopted before the law takes effect. Treat any draft language discussed below as directional until you have checked it against the final adopted text.
We walked through why Colorado abandoned its original risk-management model in our September breakdown of TRAIGA and the Colorado rewrite, so this article stays on what comes next: what the new law and its rules will ask a deployer to do.
No. The litigation creates real uncertainty about when enforcement starts, but it does not change what the law requires, and the Attorney General has said there will be no formal grace period once the law takes effect.
The background matters. xAI sued Colorado in April 2026, and the Justice Department moved to intervene on April 24, arguing that the original law's algorithmic discrimination provisions violated equal protection, as Jenner and Block's client alert details. Days later, the court entered an agreed order under which, per Davis Wright Tremaine's analysis, the Attorney General will not initiate enforcement of SB 24-205 or legislation replacing it until 14 days after the court rules on xAI's forthcoming preliminary injunction motion. Epstein Becker Green reported in September that the case remains pending and that xAI may seek that injunction after the final rules are adopted.
Here is the view we would push back on: that a stayed lawsuit equals a free year. The law's obligations attach to decisions made from January 1, 2027, and the core duties, telling people AI was involved, explaining adverse outcomes, and offering correction and human review, are the kinds of obligations already appearing in Illinois, California, and other states, as we covered in our multi-state AI hiring law checklist. An enforcement pause in Colorado does not pause those, and it does not stop a consumer complaint from reaching your desk.
Deployers must notify consumers before covered automated decision-making technology materially influences a consequential decision, explain any adverse outcome and the technology's role in it, and let affected consumers correct inaccurate personal data and request meaningful human review. Consequential decisions cover education, employment, housing, financial or lending services, insurance, health care, and essential government services.
Davis Wright Tremaine's summary of the statute adds the operational detail. The pre-use notice can be a clear and conspicuous public notice at the point of interaction, but it must explain how the consumer can get more information and request human review after an adverse outcome. The adverse-outcome notice is due within 30 days. Human review must be performed by a trained person with authority to approve, modify, or override the decision, who considers relevant primary evidence rather than simply deferring to the automated output.
The statute also changed who carries what. Developers must hand deployers technical documentation on intended uses, training data categories, and known limitations, and both developers and deployers must keep records for at least three years. Enforcement belongs exclusively to the Attorney General, with a notice-and-cure period that sunsets on January 1, 2030.
Regulated organizations should read the accommodations before building anything new. JD Supra's summary of SB 189 notes provisions for HIPAA-covered entities, certain insurers and creditors, and FDA-regulated medical devices, and it explains that liability under state antidiscrimination law is allocated by relative responsibility between developer and deployer. Contract terms that indemnify a party for its own discriminatory acts are void, which is worth knowing before your next vendor renewal, because the indemnity clause many teams rely on may not hold.
The draft rules define when an AI output "materially influences" a decision, and that definition is where most covered businesses will land. According to Stauss Law's review of the October 6 interim draft, an output is presumed to materially influence a decision when it constrains options, sets a threshold, or produces a score, rank, classification, or recommendation about the person that the decision-maker reviews and that matches the outcome. A deployer can rebut the presumption only by showing the output was a "de minimis factor," with evidence such as whether the reviewer examined independent information and had the authority and understanding to decide differently.
That presumption reverses the instinct many teams have. The usual assumption is that a human signing off on the final decision takes a tool out of scope. Under the draft, a reviewer who glances at a score and agrees with it is evidence that the score materially influenced the decision. If your human review step exists mostly on paper, the risk we describe in our analysis of rubber-stamp human-in-the-loop controls becomes a documented compliance problem in Colorado.
The interim draft also made vendor relationships explicit. New Rule 4.3 keeps the deployer responsible for all obligations when a third party runs covered ADMT on its behalf, though the deployer may contract for help performing them. For lenders, the Consumer Financial Services Law Monitor's review notes that the interim draft dropped a requirement to disclose principal reasons and underlying scores, lets the Colorado information ride along with existing ECOA and FCRA notices, and gives deployers 15 days to answer requests for more information about the technology. The earlier August proposal, as Moore and Van Allen summarized, would have required human-review requests to be acknowledged within 10 days and completed within 45, so confirm the timelines in the final rules before you design the workflow.
From a regulated-industry perspective, the work that survives every version of these rules is the same, and most of it is process rather than technology:
Records are the piece teams underestimate. A notice workflow is easy to stand up, but reconstructing what a scoring tool showed a reviewer eight months ago is not, unless someone designed for it. The data discipline we describe in our data governance deep dive is what makes a human review defensible after the fact.
Colorado also sits inside a wider pattern. California's privacy regulator has automated decision-making obligations arriving on the same January 1, 2027 date, as Epstein Becker Green's 2026 workplace AI overview notes, and a company operating in both states gains little by building two separate notice programs. Build one process anchored to the decision, then adjust the disclosure language per state, the approach outlined in AI without governance is risk, and what to do instead.
Securafy approaches Colorado readiness the way we approach any regulated control: find where the obligation actually applies, then make the evidence automatic. We start by discovering where scoring and recommendation features live in your environment, including the ones vendors enabled without a project, and we map each one to a consequential decision type and a named owner.
From there, we help your compliance and operations leads configure retention for decision records, document the human review procedure, and set up the vendor documentation requests the law expects. For organizations already juggling HIPAA, GLBA, or state privacy obligations, we fold the ADMT controls into that existing program so it adds to your current cybersecurity and compliance work instead of becoming a parallel one.
Colorado's law will either take effect on January 1 or be enforced shortly after the court rules, and in both cases the notices, records, and human review process have to exist before the first adverse decision. Start the inventory now, and finalize the details once the Attorney General's adopted rules are published.
If your team is moving faster with AI than your guardrails are, start with structured training rather than another tool. AI University gives your people role-based AI training with security built into the material, not bolted on afterward.
If you would rather talk through your specific environment first, book a strategy call with Securafy and we will walk your current AI usage, exposure, and the fastest path to safe adoption.