Colorado Proposes Detailed Rules Implementing New ADMT And Chatbot Laws

On August 11, 2026, Colorado released proposed rules (Proposed Rules) to govern the implementation of two recent artificial intelligence (AI) laws: the newly revised Colorado AI Act, known as the Automated Decision-Making Technology Act (ADMT Act), and the Chatbot Safety Act (Chatbot Act). Among other things, for the ADMT Act, the Proposed Rules intend to clarify obligations for developers and deployers, disclosure and reporting requirements, and consumer rights; and for the Chatbot Act, the Proposed Rules intend to clarify obligations for disclosures, age assurance, protections for minors, safeguards against certain prohibited content and interactions, and annual reporting. The rules, once finalized, will go into effect January 1, 2027.

Interested stakeholders can participate in the rulemaking process through written comments or participating in Colorado’s rulemaking hearing, which is scheduled for October 26, 2026. According to the Notice of Rulemaking Hearing—released in parallel with the Proposed Rules—comments must be submitted by September 4, 2026, to be considered for any proposed revisions presented at the October 26 hearing; otherwise, the Proposed Rules are open for comment through October 26, 2026.

Below, we provide a high-level overview of the Proposed Rules broken down between ADMT Act obligations and requirements under the Chatbot Act.

Proposed Rules for Implementation of the ADMT Act

The ADMT Act applies to developers and deployers of ADMT that materially influence covered consequential decisions about Colorado consumers. Proposed Rules 3-7 provide additional detail on the information developers must make available to deployers, multiparty arrangements and “midstream developers,” when adverse notice or adverse outcome disclosures are required, and what rights consumers have when adversely impacted by use of ADMT.

• Proposed Rule 3 establishes baseline requirements for disclosures, notices, responses, and other communications to consumers. Among other things, such communications must be understandable, accessible, available in relevant languages, readable across devices, provided through ordinary channels of interaction, and not unfair, deceptive, false, or misleading.
• Proposed Rule 4 addresses multiparty ADMT arrangements and details obligations for midstream developers, establishing requirements for relevant documentation and information to be collected from upstream developers and flow downstream to other developers and deployers.
• Proposed Rule 5 clarifies developer obligations to provide deployers with meaningful information about a covered ADMT’s intended uses, known risks, limitations, testing, and monitoring. The rule further requires developers to provide instructions to deployers relating to the types of data that the ADMT uses, the best methods of monitoring and reviewing ADMT outputs, how to determine the factors the ADMT relied on to produce an output, and how to control and instruct an ADMT to mitigate risk. It also specifies the circumstances under which developers may withhold information (i.e., if it is a trade secret or information protected by law), as well as the process developers must follow if they do so.
• Proposed Rule 6 governs adverse outcome disclosures. Such a disclosure is required when covered ADMT materially influences a consequential decision that results in an adverse outcome. The Proposed Rule identifies specific format, timing, and content for these disclosures and includes examples of appropriate implementation. It also outlines how deployers should respond to consumer requests for information about covered ADMT.
• Proposed Rule 7 explains how deployers must allow consumers to act upon their rights as identified in the ADMT Act. Specifically, the Proposed Rule notes that consumers must be able to easily exercise their rights to request and correct personal data used in the decision and their right to seek meaningful human review and reconsideration where commercially reasonable. The Proposed Rule also addresses how deployers should authenticate consumer identities and how to respond to consumer rights requests, including what is considered commercially reasonable, and it provides examples of proper responses to consumer rights requests.

In addition to the Proposed Rules, the Colorado Attorney General’s (AG) office is seeking feedback on specific issues related to implementation of the ADMT Act. As outlined in the Notice of Rulemaking Hearing, the AG’s office asks detailed questions about how it should clarify the “materially influence” standard; whether it would be helpful to clarify deployer and third-party vendor obligations when a deployer relies on a third-party vendor to operate a covered ADMT; and whether it should include additional clarifications regarding certain developer obligations. 

Proposed Rules for Implementation of the Chatbot Act

The Proposed Rules also address the Chatbot Act’s requirements for covered conversational AI services. Proposed Rules 3 and 8-13 clarify several exemptions to the statute, identify the disclosures needed, establish a standard for age verification methods, and break down annual reporting elements.

• Proposed Rule 3, discussed in more detail above, also applies to disclosures required by the Chatbot Act.
• Proposed Rule 8 clarifies exemptions from the definition of conversational AI service, including for narrow and discrete task-based outputs, certain business-focused tools, video game-related dialogue, and services not designed to simulate emotional companionship or encourage emotionally dependent interaction. The Proposed Rule identifies factors the Colorado Department of Law (Department) may consider when evaluating whether an exemption applies.
• Proposed Rule 9 requires operators to use commercially reasonable or generally accepted methods to estimate the age of account holders or users. The rule specifies that this method must, among other things, collect only necessary data, provide users options to verify age, consistently and effectively identify users under 18, periodically re-assess age estimates, not rely solely on self-declarations, and reasonably attempt to detect fraud. The Proposed Rule also identifies accepted methods to estimate age, how to determine if other methods are commercially reasonable, how to handle inconclusive age assurance, and how the Department will assess willful disregard of information that a user is a minor.
• Proposed Rule 10 clarifies required disclosures to users, including both for minor users or minor account holders, as well as for other users.
• Proposed Rule 11 clarifies protections for minor users and account holders, including restrictions on variable rewards designed to increase engagement, standards for technically feasible safeguards against prohibited content, reasonable measures to prevent emotional dependence or isolation from real-world supports, and privacy and account settings tools for minors and parents or guardians.
• Proposed Rule 12 addresses the prohibition on false representations that a conversational AI service’s outputs are provided by, endorsed by, or equivalent to services provided by licensed health care, legal, mental health, or dietitian professionals. The rule identifies practices the Department may consider in evaluating a violation of this provision, including profile naming controls, output controls, and advertising or promotional claims.
• Proposed Rule 13 sets out the content required in the annual report that operators of covered conversational AI services are required to submit.

Generally Applicable Rules

The three remaining rules provide additional background information.

• Proposed Rule 1 lays out the statutory authority for the rulemaking and identifies January 1, 2027, as the effective date for the rules.
• Proposed Rule 2 provides definitions beyond those included in the statutes for terms such as “Age Category,” “Continuous Conversational Artificial Intelligence Service Interaction,” and “Midstream Developer.”
• Proposed Rule 14 incorporates by reference the Web Content Accessibility Guidelines, version 2.2, for consumer communications requirements and ISO/IEC 27566-1:2025 for age assurance systems. The rule also explains how copies of those materials may be obtained and where they are available for inspection.

Although the proposed rules remain subject to the rulemaking process, they provide an important preview of how the Department may interpret and enforce the ADMT Act and Chatbot Act. Companies that develop, deploy, or operate covered AI systems should consider engaging in the rulemaking process and be prepared to follow any rule revisions to ensure their systems and operations are in compliance in advance of the January 1, 2027, effective date.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.