On October 6, the Colorado attorney general (AG) released an interim redline of its proposed rules implementing the state’s Automated Decision-Making Technology Act (SB 26-189) and Chatbot Safety Act (HB 26-1263), ahead of an October 26 rulemaking hearing. The AG first filed the proposed rules on August 11 and will accept written comments through the hearing date. The rulemaking has been undertaken with the apparent goal of having rules adopted ahead of the January 1, 2027, effective dates for these laws.

The interim draft adds a new rule establishing when a system’s output is presumed to “Materially Influence” a consequential decision. The presumption applies when the decision-maker reviews an output about the individual, such as a score, ranking, recommendation, or threshold, or uses it to screen data, and the output is consistent with the final outcome. A deployer may rebut the presumption by showing the output was only a “De Minimis Factor.” By contrast, tools used solely to summarize, organize or present information for human review fall outside the statute’s definition of the technology. In one of the draft’s examples, a credit union’s denial of loans to applicants scoring below a risk-score threshold counts as materially influenced. The draft also clarifies that a deployer remains responsible when a third party runs the technology on its behalf and the deployer uses the output to make the decision.

The redline also revises adverse outcome disclosure requirements. It removes the August version’s requirement that deployers state the “principal reason(s)” for an adverse outcome and disclose any inferences or scores behind it. Deployers would instead describe the technology’s role with specificity. Disclosures would go through every channel the deployer typically uses with the consumer, replacing the prior two-method requirement, and deployers would have 15 days to respond to information requests made by hyperlink or phone instead of providing the information immediately. A deployer required to send an adverse action or risk-based pricing notice under the ECOA or the FCRA, or an ECOA notice of incompleteness, could include the state-required content in a supplemental disclosure sent with the federal notice. The draft also adds an exception for disclosures that would compromise legally required cybersecurity, fraud prevention, anti-money laundering or sanctions compliance programs.

On consumer rights, the draft recasts the access and correction rights as rights to request instructions for obtaining and correcting personal data, excludes opinions, predictions, scores, and protected evaluations from the correction right, and deletes the requirement to stay adverse outcomes pending correction or human review. Human reviewers may be internal or external if they have actual authority to override the decision. The draft also removes the presumption that human review is commercially reasonable when an outcome severely and irreversibly denies a basic human need.