Colorado's Draft AI Rules, Explained — and How to Comment

One rule package, two laws

Colorado is regulating both of its 2026 AI laws through a single proposed rule set. That's a deliberate choice with a practical consequence: if you run a customer-facing chat widget and use automated tools anywhere in hiring, lending, housing, or similar decisions, you are looking at one compliance workstream, not two.

Notably, the Chatbot Safety Act never required rulemaking at all. The Attorney General's office folded it in on the reasoning that operators need clearer obligations — and called out one duty in particular: the content of the annual report covered operators must file with the AG. That's the thinnest part of the statute, so it's the part most worth reading closely.

What the draft rules would require of deployers

"Deployer" is the role most small businesses land in — you're using someone else's tool to help make a decision. Under the proposed rules, before a covered ADMT is used to materially influence a consequential decision, you would have to tell the consumer three things:

• That a covered automated decision-making technology is being used, or will be used;
• That it will render a consequential decision;
• That they may request additional information — and how to do that.

If the outcome is adverse, a separate adverse decision notice is required. The statute itself already sets a three-year record-retention floor from the date of the consequential decision, and a 60-day right to cure before enforcement.

What they would require of developers

If you build an ADMT and hand it to someone else to use, the draft rules would have you document and pass along: intended use; known harmful uses, risks, and limitations; the categories of personal data used to train the system; instructions for the deployer to implement meaningful human oversight; and notice when you materially update the system. Those records would be retained for a minimum of three years.

Read that list from the deployer's side and it's really a procurement checklist. If your vendor can't produce those five things, you will have a hard time meeting your own obligations on January 1, 2027 — and that's a question worth asking a vendor now, while you still have leverage.

How to comment (and why a small business should)

Written comments run from August 11 through October 26, 2026, submitted through the Attorney General's online portal, where you can note your affiliation and pick the topics you're addressing. An earlier cutoff applies for comments to be weighed in the AG's proposed revisions — published sources currently disagree on that earlier date, so confirm it on the AG's rulemaking page rather than trusting a secondhand summary, including this one. Comments are posted publicly and may enter the rulemaking record.

The honest case for commenting: the operator-versus-customer boundary in the chatbot law is still fuzzy, and it decides whether an ordinary business embedding a third-party support widget is regulated as an operator or not. That boundary gets settled largely by whoever shows up. Comment volume in this proceeding has skewed toward larger and better-resourced filers; a short, specific comment describing how you actually use a chat widget is worth more here than it usually would be.

What to do now

• Inventory where automation touches a consequential decision — hiring, lending, housing, insurance, education.
• Ask vendors for the five developer disclosures above, in writing.
• Draft the pre-use notice and the adverse decision notice now; they're short, and they're the visible part.
• Add a plain AI disclosure to any chat widget — that one is cheap and helps under both laws.
• Diary the comment deadline, and re-check the rules when they're finalized before January 1, 2027.

How to check where you stand

ComplianceBeacon scans your site, detects the AI and chatbot tools you're actually running, and tells you which Colorado disclosures apply — with copy-paste language you can add today. Run a free scan.