Colorado’s Interim Draft ADMT Rules: What Businesses Need To Know Now

This alert updates and expands upon our previous analysis of Colorado's proposed ADMT rules to reflect the Colorado Department of Law's October 6, 2026 Interim Draft Rules and developments leading up to the October 26, 2026, rulemaking hearing.

On October 6, 2026, the Colorado Department of Law issued interim draft rules (the “Interim Draft Rules,” 4 C.C.R. 904-6) implementing the state’s Automated Decision-Making Technology (“ADMT”) Act. After reviewing more than sixty stakeholder comments submitted through September 4, the Department revised its August 2026 rule proposal to clarify the Act’s scope and make its operational requirements more workable. The Interim Draft Rules add a framework for determining when ADMT “materially influences” a consequential decision, clarify multiparty arrangements and third-party ADMT, and refine disclosure and human-review obligations. They remain subject to further comment and are not final.

Why this matters now. Colorado’s formal rulemaking hearing is scheduled for October 26, 2026. Comments on both the August proposal and the October 6 interim draft are due by 11:59 p.m. Mountain Time that day, or by 11:59 p.m. on the final hearing day if the hearing continues. The ADMT Act is scheduled to take effect January 1, 2027, although enforcement remains subject to the pending xAI litigation.

The ADMT Act’s Narrower, Automated Decision-Focused Framework

The ADMT Act (SB 26-189) replaced Colorado’s broader Senate Bill 24-205 with a more targeted regime governing automated tools that process personal data and generate outputs used to make, guide, or assist decisions about individuals. The law applies only when ADMT materially influences a consequential decision in a covered domain.

ADMT is technology that processes personal data and uses computation to generate an output, such as a prediction, recommendation, classification, ranking, or score, that is used to make, guide, or assist a decision about an individual. The statute excludes specified security measures, basic technologies, and tools used solely for administrative functions such as summarizing, organizing, translating, drafting, routing, or presenting information for human review.

A Consequential Decision has a material legal or similarly significant effect on a consumer’s access to, or the terms of, an opportunity in a covered domain. Routine operational decisions, marketing, cybersecurity, sanctions compliance, and fraud prevention are among the statutory exclusions.

Covered Domains include education, employment, residential real estate, financial and lending services, insurance, healthcare services, and essential government services or public benefits. HIPAA-covered entities are generally exempt. The Department’s October 6 cover letter also states that the Act does not apply to state and local governments, although it encourages voluntary compliance when they provide essential services.

Consumers (as defined in the Interim Draft Rules) include Colorado residents acting in an individual or household context, employees, job applicants who are Colorado residents, and any individual whose access to, eligibility for, or opportunity in Colorado is evaluated in a consequential decision by a person doing business in Colorado.

Who Must Comply and What Must They Do?

• Developers create, offer, license, or substantially modify covered ADMT or covered components. Their principal duties involve documentation, update notices, monitoring instructions, and records.
• Deployers use covered ADMT, run directly or through a third party, to make consequential decisions. Their principal duties involve notices, adverse-outcome disclosures, records, correction rights, and meaningful human review.
• Integrating developers and third-party providers support the information chain, but the entity making the consequential decision retains its deployer obligations.

The interim draft further clarifies that configuring purchased ADMT according to developer instructions does not itself make a deployer a developer. A party whose technology is integrated into another party’s covered ADMT without its knowledge, and without having designed, marketed, intended, documented, advertised, configured, or contracted for that integration, is not treated as a developer on that basis.

What the Interim Draft Rules Would Require

The Interim Draft Rules translate the statute’s general duties into specific operational requirements. The chart below provides a high-level framework, followed by additional detail and context.

A deployer may rebut the material-influence presumption by showing that the output was a de minimis factor. Relevant evidence includes whether the decision-maker consulted the output; independently analyzed substantial primary evidence; had the expertise and authority to reach or change the decision; applied a consistent threshold; or reached an outcome inconsistent with the output. The analysis also considers whether internal materials direct personnel to treat the output as authoritative and whether the ADMT processes data the decision-maker could not reasonably review or replicate independently. Certain sector-specific examples of material influence are provided for additional guidance.

In multiparty arrangements, an integrating developer must retain and pass along upstream documentation and create documentation for its own covered product. Downstream developers may rely on upstream information absent actual knowledge that it is materially inaccurate or incomplete. If a third party, such as a staffing company, runs ADMT for another entity, the entity making the consequential decision remains the deployer, although it may contract for compliance support.

Following an adverse outcome, the deployer must identify the consequential decision, describe the covered ADMT’s role specifically and accurately, explain the consumer’s rights, and provide a simple process for requesting additional information. The description must address any human reviewers or other systems and state whether the consumer was automatically denied or the ADMT reviewed insufficient or incomplete information. Where applicable, the disclosure must give the outcome’s effective date. The interim draft removes the prior proposal’s express, standalone requirement to disclose the “principal reasons” for an adverse outcome, although that terminology remains in several illustrative examples.

Key Response Deadlines Under Rules 7 and 8

The Interim Draft Rules establish the following key timeframes:

• Adverse-outcome disclosure: within 30 days after the decision.
• Response to a request for additional ADMT information: within 15 days.
• Personal data or correction response: within 45 days; third-party instructions when the deployer lacks control of the data: within 15 days.
• Acknowledgment of a meaningful-human-review request: within 10 days.
• Completion of meaningful human review and response: within 45 days.

Human Review Is More Than a Human Signature

The Interim Draft Rules require a reviewer, internal or external, with actual authority to approve, modify, or override the consequential decision. The interim draft contemplates that an external reviewer may qualify where the deployer remains accountable, the contract insulates individual review decisions from the deployer’s influence, and vendor oversight addresses administration and performance rather than particular outcomes. The reviewer must have appropriate subject-matter understanding and training, consider relevant primary evidence and the consumer’s individual circumstances, and be protected from steering or retaliation. ADMT may not perform the review, although non-ADMT tools used solely to summarize, organize, translate, draft, route, or present information may assist.

Whether review is commercially reasonable depends on the type of review; magnitude of harm, including whether the outcome deprives a consumer of a basic human need such as food, shelter, or required medical care; reversibility; value of available primary evidence; the deployer’s size and capacity; marginal cost and technical feasibility; and availability of reviewers. No single factor is dispositive. Meaningful human review is presumed commercially reasonable when an adverse outcome causes a severe and irreversible denial of a basic human need, although the presumption may be rebutted by evidence that review is technically or financially impossible or could not change the outcome. The deployer bears the burden of showing with specific evidence that review is not commercially reasonable. Separately, if the deployer declines meaningful human review as not commercially reasonable, it must explain that determination.

Human-review responses must state the reviewer’s decision, the type of review, the factors considered, and evidence-specific reasons, rather than merely reciting the ADMT’s general logic. If a corrected-data decision is not re-performed, the deployer must explain why.

Deployers must retain contemporaneous records of the reviewer’s identity, authority, and training; timestamps; the evidence considered; and a written justification.

Enforcement and Litigation Context

The Colorado Attorney General has exclusive authority to enforce the ADMT Act, and violations are treated as deceptive trade practices. Through December 31, 2029, the Attorney General generally must provide a 60-day opportunity to cure when a cure is possible, although that opportunity may be withheld for knowing or repeated violations. The Act, however, does not create a new private right of action.

The Act also allocates liability between developers and deployers according to relative fault in discrimination actions and rejects joint and several liability except as allowed under existing law. Contract provisions purporting to indemnify a party for its own violations of Colorado anti-discrimination law are void.

The Act preserves trade-secret protections; developers and deployers need not disclose proprietary algorithms, models, or other protected intellectual property. Under the Interim Draft Rules, a developer that withholds information must identify the legal authority for doing so and provide as much information as possible through summaries or categorical descriptions, and a deployer that withholds information must notify the consumer.

Enforcement also remains tied to pending litigation. On April 9, 2026, xAI filed suit in the U.S. District Court for the District of Colorado (No. 1:26-cv-01515), challenging SB 24-205 under the First Amendment, Commerce Clause, Due Process Clause, and Equal Protection Clause. The United States intervened on April 24, 2026. Although SB 26-189 later repealed and replaced SB 24-205’s framework, the litigation and stipulated non-enforcement arrangement expressly extend to legislation replacing or amending SB 24-205 during the 2026 legislative session.

On April 27, 2026, the court ordered the Colorado Attorney General not to initiate enforcement, including an investigation, for alleged violations of SB 24-205 or replacement or amending legislation occurring on or before fourteen days after the court rules on xAI’s forthcoming preliminary-injunction motion. xAI must file that motion and, if necessary, an amended complaint within 28 days after final adoption of implementing rules. Businesses should not treat that uncertainty as a reason to defer preparation, given the January 1, 2027, statutory effective date and the operational work the Interim Draft Rules would require.

Issues to Watch at the October 26 Hearing

• Material Influence. The rebuttable presumption supplies a clearer framework, but the Department is expressly seeking alternatives that distinguish a genuinely de minimis use from a deployer’s unsupported assertion. Businesses should expect continued debate over the evidence needed to rebut the presumption.
• Financial or Lending Services. The draft defines the term as the extension of credit or a loan, transmitting or exchanging funds, deposit or checking accounts, check cashing, or installment payment plans. The Department remains open to revising the draft definition and has invited alternative proposals.
• Overlap with Other Notice Regimes. The interim draft allows ECOA/FCRA adverse-action or risk-based pricing notices to satisfy the Colorado disclosure if they (or a contemporaneous supplement) include the required information-request and consumer-rights content and are sent within 30 days, and FERPA-covered deployers may use FERPA channels, but questions remain about overlap with Colorado Privacy Act profiling notices and sector-specific obligations.
• Enforcement Transition. The rules retain a January 1, 2027, effective date. The Attorney General has not announced a formal grace period, but the Department states that enforcement discretion will account for good-faith compliance efforts and will focus on egregious and intentional violations.
• Protected Evaluations. The Act provides that opinions, predictions, scores, and protected evaluations need not be corrected, but “protected evaluations” remains undefined.

Five Steps Companies Should Consider Taking Now

The Interim Draft Rules may change after the October 26 hearing, but their operational direction is sufficiently clear for businesses to begin preparing immediately.

1. Inventory and classify ADMT systems. Identify automated tools used in covered domains, map inputs and outputs, and document whether each tool is likely to trigger, or provide a basis to rebut, the material-influence presumption.
2. Map roles and information flows. Determine whether the organization is acting as a developer, a deployer, an integrating developer, or in more than one role. Identify upstream documentation, downstream recipients, and third parties that run ADMT or hold relevant personal data.
3. Build notice and rights workflows. Prepare adverse-outcome notices that accurately describe ADMT’s role, a unified online request path, authentication and correction procedures, and deadline tracking for 15-day and 45-day responses. Deployers may not require authentication for requests for additional ADMT information, require a new account, or charge an authentication fee; only one information request per adverse outcome must be answered even if submitted through multiple channels.
4. Design genuine human review. Select and train qualified reviewers, give them actual authority and primary evidence, limit assistance to non-ADMT administrative tools, and create contemporaneous records of independent judgment.
5. Revisit vendor contracts. Require upstream documentation, update notices, data-source information, and cooperation with disclosures, consumer requests, and human review. Allocate supporting functions expressly while recognizing that the deployer retains responsibility for its consequential decision. Where an external reviewer is used, ensure the contract insulates the reviewer’s individual decisions from the deployer’s influence and limits vendor oversight to administration and performance.