Colorado Hears Competing Demands on Its AI Rules

Colorado’s attorney general held a formal public hearing on October 26 on the rules that will put the state’s rewritten AI law into practice, and the testimony split along familiar lines. Business groups asked for more time and narrower definitions. Consumer advocates asked the office not to weaken the draft any further.

The rules, 4 CCR 904-6, implement Senate Bill 26-189, the Automated Decision-Making Technology Act, and House Bill 26-1263, the Chatbot Safety Act, according to the Secretary of State’s rulemaking docket. The hearing was held at the attorney general’s Denver office and by Zoom. Both laws take effect January 1, 2027, and the attorney general’s rulemaking page says the ADMT Act requires the office to adopt rules before that date.

What Happened at the Hearing

The Sum and Substance, a Colorado business news outlet, reported that lenders, healthcare providers and business groups raised concerns in letters and at the hearing. Michael Blanco, tech policy director for the U.S. Chamber of Commerce, said the draft’s definition of “material influence” presumes AI had a material influence on a decision if it reaches the same outcome as the human who makes the final call, and that several provisions appear to go beyond the statute’s text.

The outlet also reported a request from several speakers that the office either delay enforcement for a year or treat good-faith efforts as compliance during the first year. Bloomberg Government reported that business groups asked the office to delay enforcement and adjust the definitions of “data sources,” “material influence” and “meaningful human review.” Law360 reported that groups from tech, banking and other industries raised possible conflicts with existing laws and the short window for implementation.

Consumer advocates pushed the other way. Kara Williams, an attorney for the Electronic Privacy Information Center, said the repeated use of “commercially reasonable” and “technically feasible” in the rules will limit transparency and the number of human reviews, according to The Sum and Substance. Advocates also objected to changes made between the August and October drafts, including the removal of mandatory stays of decisions while reviews are under way.

“I think the department is under real pressure to weaken these rules, and I’m asking you to hold the line,” said Vincent Le, vice president of policy for TechEquity, as quoted by The Sum and Substance. “The most recent draft should be the floor.”

Brittany Morris Saunders, president and CEO of the Colorado Technology Association, framed the business position.

“Colorado should not have to choose between protecting consumers and leading in innovation,” she said, according to the same report.

What the Law Requires

SB 26-189 replaced Colorado’s original 2024 AI Act before it took effect. A Finnegan overview explains that it covers automated decision-making technology that “materially influences” a consequential decision in seven domains: education, employment, residential real estate, financial or lending services, insurance, health care and essential government services. Deployers must give notice before use, explain an adverse outcome within 30 days, and offer data correction and meaningful human review where commercially reasonable. The attorney general has sole enforcement authority, and there is no private right of action.

The Chatbot Safety Act adds rules for conversational AI services. According to the attorney general’s page, it requires operators to disclose that users are talking to AI, adds protections for minors, and prohibits chatbot outputs from being represented as equivalent to licensed professional services.

What It Means for Legal Professionals

The most direct point for the legal market is what the new law dropped. Finnegan notes that legal services were a covered domain under the original law but are not one under SB 26-189. Decisions about a consumer’s access to legal services are no longer their own category under the new law, though the chatbot law’s limit on presenting outputs as equivalent to licensed professional services is worth reading for any consumer-facing legal chatbot.

Law firms and legal departments are still covered in other roles. Employment is a covered domain, and Finnegan says the definition of consumer includes Colorado resident employees and job applicants, so a firm that uses AI screening tools in hiring would be a deployer. The Sum and Substance reported that speakers raised questions about remote roles and out-of-state employers considering Colorado applicants, which the final rules may or may not settle.

Most of the work, though, will land on lawyers advising clients. In-house counsel at lenders, insurers, healthcare providers, schools and employers will need notice templates, adverse outcome letters and human review procedures by January 1. The law excludes tools used solely to summarize or organize information for human review, a carve-out that matters for the drafting and summarization tools common in legal work.

There is also a federal wrinkle. As we noted in our state AI laws overview, xAI is suing the attorney general over the law. Jones Walker reports that under a court order, the state will not begin enforcement until 14 days after the court rules on xAI’s preliminary injunction motion, which xAI must file within 28 days after the rules are finally adopted. January 1 remains the statutory compliance date.

Common Questions

Does Colorado’s new AI law apply to legal services?

Not as a covered domain. Legal services were dropped when SB 26-189 replaced the 2024 law, according to Finnegan. Firms can still be covered as employers if they use AI that materially influences hiring decisions.

When will the final rules come out?

The attorney general’s rulemaking page does not give a date. It says the office will consider written comments received through October 26, and the statute calls for rules before January 1, 2027.

Can individuals sue under the law?

No. Enforcement rests solely with the attorney general, and Finnegan notes a 60-day cure period before enforcement that sunsets January 1, 2030.

What to Watch

Watch whether the final rules narrow the “material influence” definition, whether the office grants any enforcement delay or good-faith period, and how the xAI case moves once the rules are adopted. Firms with Colorado hiring or Colorado-facing clients should track the final text rather than the drafts.