Comments on the Interim Draft Rules Implementing the Automated Decision-Making Technology Act (SB 26-189) and the Conversational Artificial Intelligence Services Act (HB 26-1263), 4 CCR 904-6

Dear Attorney General Weiser and Staff of the Colorado Department of Law:

The U.S. Chamber of Commerce (the "Chamber") respectfully submits these comments in connection with the October 26, 2026 public hearing on the Colorado Department of Law's (the "Department") October 6, 2026 interim draft rules implementing SB 26-189, the Automated Decision-Making Technology Act ("ADMT Act"), and HB 26-1263, the Conversational Artificial Intelligence Services Act ("Chatbot Safety Act") (4 CCR 904-6). The Chamber is the world's largest business federation, representing the interests of more than three million businesses of all sizes, sectors, and regions, as well as state and local chambers of commerce and industry associations. This submission builds on, and incorporates by reference, concerns addressed incomments the Chamber submitted on September 4, 2026¹.

The Chamber appreciates the Department's continued engagement with industry stakeholders and recognizes that the interim draft incorporates a number of constructive revisions responsive to the September 4 comment cycle.

As detailed below, several provisions of the interim draft continue to go beyond the statutory text, impose operationally infeasible requirements, or diverge unnecessarily from analogous federal and state frameworks. The Chamber urges the Department to revise these provisions to align more closely with the statutory standard, promote interoperability with existing compliance regimes, and provide practical guidance that enables businesses to comply efficiently while delivering meaningful protections to Colorado consumers.

Compliance Timeline — Codify a Defined Runway Rather Than Rely on Enforcement Discretion (Rule 1.3)

Rule 1.3 retains a January 1, 2027 effective date. In response to industry's request for a compliance runway, the Department's cover letter offers only a statement that the Attorney General will focus enforcement on "egregious and intentional violations" and "exercise appropriate discretion" while entities come into compliance. A policy statement of this kind does not bind future enforcement decisions, does not define or provide examples of “egregious and intentional violations” and gives businesses nothing concrete to plan against—particularly where final rules will not issue until shortly before the effective date. Nor has the Department provided any quantitative analysis² of the compliance costs these rules would impose on businesses, making it difficult to assess whether the proposed timeline is remotely possible.

The Chamber recommends that the Department:

• Provide that obligations under the rules attach no earlier than twelve months after the final rules are published, provide a grace period from enforcement, or, at minimum, adopt staged compliance dates that sequence the highest-impact obligations first i.e., the meaningful human review;
• If a binding compliance-date extension is not available under the Department's rulemaking authority, say so on the record and instead codify the enforcement-discretion policy directly within Rule 1, paired with a notice-and-cure mechanism clarifying that "knowing" and "repeated" violations refer to systemic or uncorrected noncompliance rather than isolated errors; and
• Conduct and publish a quantitative analysis of the rules' expected compliance costs to businesses, and use it to inform the compliance runway and final scope of obligations.

Material Influence Presumption — Narrow to the Statutory Standard (Rule 6.1; Rule 2.2 De Minimis Factor)

The Chamber supports the Department’s decision to adopt Standard 2 for its definition of “materially influence.: Rule 6.1(B) improves on earlier drafts by recognizing consistently applied hard cut-offs, independent review of substantial information, and other contemporaneous evidence as grounds for rebutting the Material Influence presumption. It nevertheless retains, at Rule 6.1(A), an overbroad trigger: an ADMT output is presumed to materially influence a decision whenever it pertains to the individual, was reviewed by the decision-maker, and is "consistent with the outcome" of the consequential decision. This standard conflates correlation with causation—a trained reviewer who reaches the same conclusion as an automated tool on independent grounds is captured by the presumption by design, so the trigger penalizes accuracy rather than measuring it. It also undermines human judgment, seemingly erasing the value of, and incentive to conduct, human review despite a statutory framework that treats human review as protective. That result is inconsistent with the statute's own two-part definition, which requires both that an output be a non-de minimis factor and that it "affect the outcome" of the decision. C.R.S. § 6-1-1701(13).

The Chamber recommends that the Department:

• Strike the "consistent with the outcome" trigger from Rule 6.1(A) and instead codify the factors already reflected in Rule 6.1(B) and the De Minimis Factor definition at Rule 2.2—decision-maker authority and subject-matter understanding, independent review of relevant information, and retained ability to approve, modify, or reject the result—as the operative standard;
• Anchor Rule 6.1 to the "significantly larger role" test already used in the Rule 2.2 De Minimis Factor definition, rather than the output-consistency trigger it currently relies on; and
• Confirm that tools operating on deterministic, pre-set human criteria—such as threshold-based eligibility checks or "if-then" cutoff rules—do not constitute "covered ADMT" in the first instance, since such tools exercise no discretion of their own, and remove or revise illustrative examples in Rule 6.2 that are inconsistent with the Rule 6.1(B) rebuttal factors.

Third-Party Data Source Disclosure — Permit Category-Level Reporting (Rule 7.6(A)(5)–(6))

Rule 7.6(A)(5)–(6) requires deployers to identify the sources of personal data "by name"—including specific data brokers, databases, courts, social media companies, schools, and employers—and presumes that a deployer knows the source of any information a vendor utilizes on its behalf, as well as any upstream or intermediary source used by a third-party data broker or aggregator. The ADMT Act does not require this particular granularity in identifying sources.³ In, fact it merely requires disclosure of “[t]he types, categories, and sources of personal data used…” Requiring categories would be unnecessary if an entity were required to name all sources. The proposed interim rule is operationally infeasible for deployers with complex vendor and developer relationships, and particularly burdensome for high-volume deployers where source-by-source tracing may be impossible without creating fraud, security, or trade-secret exposure.

The Chamber recommends that the Department:

• Require disclosure of the categories of data sources (e.g., consumer reporting agencies, public records, application data) rather than specific vendor, broker, or developer names, consistent with the Colorado Privacy Act's category-based framework; and
• At minimum, eliminate the presumption that a deployer possesses knowledge of a vendor's, developer's, or data broker's own upstream sourcing practices, and limit a deployer's disclosure obligation to the source that supplied information directly to it.

Access and Correction Rights — Preserve the Statutory Distinction and Limit Third-Party Tracing (Rules 8.3(B)(2)–(C) and 8.4(C), (E))

The Chamber appreciates that the interim draft already confirms, at Rules 8.3(B)(3) and 8.4(E), that the correction right does not extend to "opinions, predictions, scores, or protected evaluations." Rule 8.3(B)(2), however, continues to classify a covered ADMT's "final rank, score, classification, recommendation, prediction, profiles, or other inferences" as "specific pieces of Personal Data" that must be produced in full upon an access request. These outputs frequently reflect proprietary risk, credit, or fraud-scoring models, and broad disclosure of the outputs themselves—as opposed to the underlying input data—creates competitive harm and fraud risk, particularly where a disclosed score could be used to reverse-engineer a model's logic.

Separately, Rules 8.3(C) and 8.4(C) require that, where relevant personal data is not within the deployer's own possession or control, the deployer must provide the consumer, within fifteen days, a list of every third party that possesses or controls that data, the categories each holds, and instructions for exercising rights with each. This exceeds what a deployer can reasonably track across every upstream vendor within such a compressed timeframe.

The Chamber recommends that the Department:

• Narrow Rule 8.3(B)(2) to require disclosure of the underlying personal data categories used to generate a score, rank, or inference, rather than the final output value itself; and
• Narrow Rules 8.3(C) and 8.4(C) to require identification only of the third party from which the deployer directly obtained the data, and extend the fifteen-day response window to match the forty-five-day timeframe already provided elsewhere in Rule 8.

Meaningful Human Review — Conform to the Statutory, Process-Based Standard (Rule 8.7)

The statute requires only that review be conducted by a trained individual with the authority to override the decision. The interim draft's Rule 8.7 remains more prescriptive than that standard requires.

The Chamber recommends that the Department:

• Define Meaningful Human Review in Rule 8.7(C) by process—reviewer authority and consideration of relevant information—rather than by outcome, and expressly state that a reviewer's affirmance of the original decision does not, by itself, indicate the review was not meaningful;
• Recognize existing review, dispute, complaint, servicing, and regulatory processes already maintained by many businesses as sufficient to satisfy the requirement, rather than mandating a parallel, ADMT-specific review system—an approach the Department has already extended to FERPA-covered deployers under Rule 8.8(B) and should make available more broadly;
• Expressly permit reviewers to use supporting tools, including ADMT, to assist their independent judgment. The term"meaningful" should not mean "exclusively unassisted human evaluation," particularly in sectors where AI-assisted review is standard practice; and
• Add an extension mechanism to the forty-five-day review period in Rule 8.7(G) for complex cases, consistent with the Colorado Privacy Act's own extension provision, C.R.S. § 6-1-1306(2)(a), and limit the Rule 8.7(H) documentation requirement to what is necessary to demonstrate that a qualified reviewer conducted the review.

Notice Delivery — Permit a Single Reasonable Channel (Rule 7.2(A)(1))

Rule 7.2(A)(1) continues to require that adverse-outcome disclosures be delivered through all channels a deployer typically uses to communicate with a consumer, functioning as a multi-method delivery mandate the statute itself does not impose. For businesses communicating across email, text, mail, and in-app messaging, this risks overwhelming rather than informing consumers while creating substantial, undifferentiated operational burden for high-volume deployers.

The Chamber recommends that the rule instead permit delivery through a single reasonable method customarily used to communicate with the consumer.

Conclusion

The Chamber appreciates the Department's openness to adopt a thoughtful, principle-guided approach to this rulemaking and its stated goals of protecting Colorado consumers while promoting consistent, workable implementation. The Chamber stands ready to work constructively with the Department and welcomes the opportunity to provide additional information or participate in further stakeholder engagement in advance of finalization.

Respectfully submitted,

Jordan Crenshaw
Senior Vice President
Chamber Technology Engagement Center
U.S. Chamber of Commerce

1. Comments of the U.S. Chamber of Commerce on Proposed Rules Implementing the Colorado Automated Decision-Making Technology Act (SB 26-189) and the Colorado Conversational Artificial Intelligence Services Act (HB 26-1263), 4 CCR 904-6 (Sept. 4, 2026), https://coag.my.salesforce.com/sfc/p/#t00000004XX8/a/cs000012JyOb/GMltR9wSgxI4E1BA.RO07EOBr_WmvpXSJyan8Va.Cjk.
2. Colorado Department of Law, Final Regulatory Analysis, Colorado Automated Decision-Making Technology Act (SB 26-189) and Colorado Conversational Artificial Intelligence Services Act (HB 26-1263) Rulemaking, 4 CCR 904-6 (Oct. 21, 2026), https://coag.gov/app/uploads/2026/10/2026.10.21-Final-Regulatory-Analysis.pdf
3. C.R.S. § 6-1-1704

1. ↑

    

2. ↑

    

3. ↑

    

About the author

Jordan Crenshaw

Crenshaw is Senior Vice President of the Chamber Technology Engagement Center (C_TEC).

Read more