Talk Around Town: Colorado's Draft AI Rules Aim to Corral Automated Decisions by 2027, but the Fence Ain't Built Yet

What the Rumor Mill Is Churning Out

Well, slap a saddle on a server rack, because Colorado's Department of Law is out here trying to wrangle the whole dang AI barnyard before New Year's Day. According to the Colorado Attorney General's official rulemaking page, the DOL dropped an interim draft of its proposed Automated Decision-Making Technology and Conversational Artificial Intelligence Service Rules—that's 4 CCR 904-6 for you regulation-lovin' folks—on October 6, 2026. That revised draft came after the DOL had received more than sixty public comments on its first attempt, which it filed back on August 11, 2026, according to Akin Gump and Orrick InfoBytes.

Now, the talk around town is that Colorado is fixin' to be one of the most aggressive states in the union when it comes to telling businesses how to behave when a robot is making calls that affect real people's lives. But—and this is a big ol' hog-fat but—these rules ain't final, friends. The formal rulemaking hearing closed October 26, 2026, and the Attorney General has until January 1, 2027 to put a bow on the whole thing. A lot can change between now and then, kind of like how a catfish can wiggle clean off the hook just when you think you've got dinner sorted.

What We Actually Know for Certain

Here's the stuff that's nailed down tighter than granddaddy's storm cellar. The Colorado DOL's interim draft implements two laws signed into existence in May 2026, confirmed by the Colorado AG's page and multiple independent legal sources including Akin Gump and Morrison Foerster. First is SB 26-189, signed May 14, 2026, which repealed and replaced the original 2024 Colorado AI Act—that earlier law, mind you, got itself blocked by a federal court following a legal challenge before it could ever set foot in the door. Second is HB 26-1263, signed May 29, 2026, known as the Chatbot Safety Act. Both laws, along with any finalized rules, are currently aimed at a January 1, 2027 effective date, according to multiple independent legal sources.

The Chatbot Safety Act, according to Akin Gump and Morrison Foerster, sets requirements for operators of conversational AI services, covering things like age estimation, mandatory disclosure that a user is talking to an AI, protections for minors, suicide and self-harm response protocols, and annual reporting obligations to the Attorney General. That's a whole grocery list of compliance homework for anyone running a chatbot that might end up chatting with a teenager.

The interim draft also introduces a legal presumption, confirmed by Orrick InfoBytes and Receivables Info, that when an automated system's output—think a credit score, ranking, recommendation, or risk threshold—lines up with the final decision a business makes, that output is presumed to have 'materially influenced' that consequential decision. Businesses would be able to push back on that presumption by showing the automated output played only a minimal role, but the burden lands in their lap first.

The financial-industry trade group SIFMA formally submitted its own public comment letter to the Colorado DOL on the proposed rules, confirming that the rulemaking process has drawn serious attention from the broader financial services world. The DOL, according to the Consumer Financial Services Law Monitor, declined to add a formal grace period for enforcement, though it stated that the Attorney General's policy will be to prioritize egregious and intentional violations while businesses work toward compliance—which is about as reassuring as being told the bull won't charge you unless you really tick him off.

What Nobody Has Quite Figured Out Yet

Now here's where the mud gets deep and the boots start suckin'. Legal analysts are genuinely split on whether Colorado's October revisions fixed enough of the problems that had industry folks hollering since August. The Consumer Financial Services Law Monitor assessed that some changes were improvements, but said plainly that many of the issues from the August 11 draft remain unresolved—their words, not ours. Morrison Foerster, meanwhile, described the resulting framework as two distinct and extensive compliance regimes without the same flavor of alarm, according to their October 2026 analysis.

The definition of 'Financial or Lending Service' is reportedly still up for grabs. The DOL has signaled it may revise that definitional boundary before the final rules land, according to the Consumer Financial Services Law Monitor, which means the exact scope of who gets roped into these requirements could still shift. That's a little like measuring your fence posts before you've decided where the property line is.

There's also the ghost of the old Colorado AI Act rattling around in the background. The predecessor law, SB 24-205, was blocked by a federal court following a constitutional challenge by xAI with Department of Justice support before it ever took effect. Whether SB 26-189's narrower framework might face similar legal fireworks is an open question that current rulemaking commentary hasn't touched, according to our review of available sources. Nobody is saying it will happen—just that nobody is saying it won't, either.

The Supply Chain Wrinkle: 'Midstream Developers'

One piece of the draft that's got the tech supply chain doing the nervous two-step involves what the rules call 'midstream developers.' According to the Consumer Financial Services Law Monitor's August 2026 analysis, these are companies that take somebody else's ADMT model, stitch it into their own product, and sell that product onward to others. Under the proposed rules, midstream developers would have to both obtain documentation from whoever supplied the original model upstream and then pass that documentation along to whoever deploys the product downstream. Think of it like a barbecue restaurant that buys pre-smoked brisket being required to keep the original pitmaster's notes and hand 'em to every catering client. The chain of accountability is supposed to stretch the whole length of the supply line.

Our Analysis: A Framework Still Finding Its Boots

This next part is analysis, not settled reporting, so hold your horses accordingly. Colorado is making a genuine swing at something most states haven't dared to touch: a comprehensive regulatory regime for automated decision-making that covers everything from credit scores to chatbots talking to teenagers. If these rules survive to January 1, 2027, in anything close to their current form, they would represent one of the more muscular state-level AI compliance frameworks in the country—which is either visionary or a bureaucratic kudzu vine, depending on who you ask.

The enforcement posture—focus on egregious and intentional violators while everyone else figures it out—sounds reasonable until you realize that 'egregious' is doing a whole lot of heavy lifting in that sentence without a legal definition to prop it up. And with the definition of 'Financial or Lending Service' still potentially in flux, financial institutions are essentially being asked to build a compliance barn before anyone's fully agreed on where the property line sits. The fact that SIFMA felt compelled to formally submit public comments tells you the industry is watching this particular corner of the regulatory range with both eyes open.

The prior Colorado AI law's courtroom fate is worth keeping in one eye's peripheral vision. If SB 26-189's narrower framing doesn't fully immunize it from constitutional challenge, the whole January 2027 compliance scramble could end up being a drill rather than the real thing. For now, though, businesses operating in Colorado that use automated tools in consequential decisions—or run chatbots that might talk to minors—probably want to be having serious conversations with their legal teams rather than waiting on the fence post to move.