Pre-Rulemaking Informal Input — Automated Decision-Making Technology Act (SB 26-189) and Chatbot Safety Act (HB 26-1263)

The U.S. Chamber of Commerce (the "Chamber") respectfully submits these comments in response to the Colorado Department of Law's (the "Department") Pre-Rulemaking Considerations request for implementation of SB 26-189, the “Automated Decision-Making Technology Act” ("ADMT Act") and HB26-1263, the “Chatbot Safety Act” ("Chatbot Safety Act"). The Chamber is the world's largest business federation, representing the interests of more than three million businesses of all sizes, sectors, and regions, as well as state and local chambers of commerce and industry associations.

The Chamber strongly supports the responsible development and deployment of artificial intelligence and automated decision-making technologies. We believe that well-designed regulations can protect consumers while enabling businesses to innovate and compete. However, we are concerned that, as currently written, the ADMT Act could be interpreted more broadly than any ADMT law in the United States or globally, and that without careful regulatory clarification, it risks imposing significant compliance burdens that do not proportionately advance consumer protection goals. The Chamber urges the Department to use its rulemaking authority to tailor and clarify the law's scope, promote interoperability with existing federal and state frameworks, and provide practical, sector-specific guidance that enables efficient compliance.

The Chamber's comments are organized to address the Department's overarching questions and targeted questions in turn. As the current implementation stage is a pre-rulemaking proceeding—not a formal notice-and-comment rulemaking—the Chamber's input is intentionally directional. We expressly reserve the right to provide more detailed, substantive comments once proposed rules are published.

I. Overarching Questions

A. Tailoring the Rules to Prevent Overbreadth

Regulatory guidance can play a critical role in preventing overbreadth. The ADMT Act, as currently written, could be interpreted to cover a very broad range of ordinary business activity. The definitions of "ADMT," "Materially Influence," and "Consequential Decision" are broader than analogous definitions in the California Consumer Privacy Act ("CCPA") ADMT Regulations, the Connecticut ADMT Law, the EU General Data Protection Regulation ("GDPR"), and the automated profiling and decision-making provisions of dozens of other state consumer privacy laws. Without clarifying regulations, businesses of all sizes will be left to interpret the plain statutory text in widely varying ways, creating inconsistency for consumers and unnecessary compliance costs for businesses.

The Chamber recommends that the Department issue regulations that:

• Establish clear, objective indicators and presumptions for when an ADMT output materially influences a decision and is not incidental, trivial, or clerical;
• Confirm that general-purpose AI tools used for summarization, translation, drafting, or organizing information—where a human retains full decision authority—do not trigger the Act even if the output is referenced in the decision process;
• Clarify that routine risk-based pricing, fraud detection, credit underwriting, and compliance screening tools that are already subject to comprehensive federal regulatory oversight (e.g., FCRA, ECOA, GLBA) are not "consequential decisions" under the Act, or are otherwise excluded from its scope; and
• Provide safe harbors or presumptions of compliance for businesses that comply with analogous requirements under the CCPA ADMT Regulations, GDPR Article 22, or other recognized frameworks such as the NIST AI Risk Management Framework.

B. Unintended Consequences

The Chamber is concerned that, without clarifying regulations, the ADMT Act could produce several significant unintended consequences:

• Chilling innovation: Overbroad obligations may deter businesses from deploying beneficial AI tools, particularly in healthcare, financial services, and employment, where AI can improve outcomes and reduce human bias.
• Disproportionate impact on small businesses. Large enterprises may be better positioned to absorb compliance costs, while small businesses may be forced to abandon AI tools entirely or exit the Colorado market.
• Multi-state compliance fragmentation: Colorado's unique and broader-than-average definitions create a patchwork compliance environment that increases costs for businesses operating in multiple states and reduces the likelihood of consistent consumer protections.
• Disruption of routine employment operations: Ordinary workforce management tools—scheduling, performance tracking, attendance monitoring—could be swept into the Act's scope, creating significant operational disruption for employers.
• Duplicative burdens on regulated industries: Businesses in financial services and healthcare are already subject to comprehensive federal and state regulatory frameworks governing automated decision-making. Layering additional, potentially inconsistent obligations on top of these frameworks creates compliance complexity without commensurate consumer benefit.

C. Structure of Rules: Generally Applicable vs. Sector-Specific

The Chamber recommends that the Department adopt a two-tier regulatory structure: (1) generally applicable rules addressing scope, definitions, and the developer/deployer framework; and (2) sector-specific guidance addressing disclosure content, human review procedures, and notice requirements for specific industries (e.g., financial services, healthcare, employment). This approach would allow the Department to tailor obligations to the specific risks and existing regulatory frameworks in each sector, reducing duplicative burdens while ensuring meaningful consumer protections.

II. Targeted Questions — ADMT Act

A. Definitions

1. "Materially Influence"

The Chamber recommends that the Department define "materially influence" in a manner this is flexible and interoperable with other state and federal laws. This approach would exclude tools that merely inform, assist, or provide one input among many to a human decision-maker who retains full authority and exercises independent judgment.

Rules should also clarify the role of human involvement in the decision-making process. Specifically, rules should confirm that:

• A human decision-maker who reviews an ADMT output and exercises independent judgment—even if they frequently agree with the ADMT's recommendation—does not trigger the Act's obligations;
• The relevant inquiry is whether the human has the practical ability and authority to override the ADMT output, not whether they routinely do so; and

• Businesses may demonstrate meaningful human involvement through documented review processes, override capabilities, and training programs.

  2. "Consequential Decision"

The Chamber recommends that the Department clarify that "consequential decision" does not include routine risk-based pricing, fraud detection, or compliance screening decisions that are already subject to comprehensive federal regulatory oversight. Rules should also clarify that decisions affecting large numbers of individuals in a uniform, non-individualized way (e.g., general product pricing, broad eligibility criteria) are not "consequential decisions" unless they involve individualized assessment of a specific person.

3. Developer vs. Deployer

The Chamber recommends that the Department issue clear guidance on the allocation of obligations between developers and deployers, including:

• A developer that provides a general-purpose ADMT to a deployer should not be responsible for the deployer's use of that ADMT in a consequential-decision context, provided the developer has disclosed the ADMT's capabilities and limitations and has not specifically designed or marketed the ADMT for that consequential-decision use; and
• Contractual allocation of responsibilities between developers and deployers should be permitted and encouraged, subject to the Act's indemnification restrictions.

B. Post-Adverse Outcome Disclosures

1. Content of Disclosures

Disclosure requirements should be practical in order to be useful to consumers. The Chamber recommends that at a minimum disclosures should:

• Identify the general type of ADMT used (e.g., credit scoring model, resume screening tool) without requiring disclosure of proprietary algorithms or trade secrets;
• Describe the categories of data used in the decision at a general level (e.g., "credit history," "employment history") without requiring disclosure of specific data sources or vendor names; and

• Explain the general basis for the adverse outcome in plain language accessible to a non-technical consumer.

  2. "Sources" of Data

The Chamber recommends that "sources" of data, for purposes of post-adverse outcome disclosures, be defined to mean categories of data sources (e.g., "consumer reporting agencies," "public records," "application data") rather than specific vendor names or proprietary data providers. Requiring disclosure of specific vendor names would expose trade secrets, create competitive harm, and provide little additional benefit to consumers seeking to understand the basis for an adverse decision.

3. Interoperability with ECOA and FCRA

The Chamber strongly recommends that the Department deems compliance for companies complies with the adverse action notice requirements of the Equal Credit Opportunity Act ("ECOA") and the Fair Credit Reporting Act ("FCRA") for the Act's post-adverse outcome disclosure requirements for covered credit decisions. This would eliminate duplicative and potentially inconsistent disclosure obligations for financial services businesses and ensure that consumers receive consistent, familiar disclosures.

C. Consumer Rights — Meaningful Human Review

The Chamber recommends that the Department adopt a flexible, principles-based approach to human review that:

• Defines "meaningful" human review by reference to objective factors, including: (i) the reviewer's authority to override the ADMT output; (ii) the reviewer's access to the relevant information; (iii) the reviewer's training and qualifications; and (iv) the reviewer's documented consideration of the consumer's specific circumstances;
• Permits businesses to define "commercially reasonable" human review procedures based on the nature of the decision, the scale of operations, and the availability of qualified reviewers;
• Adopts response timelines that are flexible and interoperable with other laws like ECOA and FCRA; and

D. Pre-Use Consumer Notice Requirements

1. Timing and Delivery

The Chamber recommends that the Department align pre-use notice requirements with the CCPA's flexible approach, which permits notice at or before the point of collection or use. Requiring notice before any possible use of an ADMT—including uses the business has not yet contemplated—would be impractical and could require businesses to provide speculative or inaccurate disclosures. Rules should permit notice at or before the point at which the ADMT is first used in connection with the consumer's specific interaction or transaction.

2. Consolidated Notice

The regulations should adopt the CCPA's approach to consolidation of multiple disclosures for multiple purposes into a single ADMT notice. A business may use a single ADMT for multiple purposes, multiple ADMTs for a single purpose, or multiple ADMTs for multiple purposes. Permitting a consolidated notice would create flexibility, build interoperability with the CCPA framework, facilitate efficient compliance, and promote transparency to consumers.

3. Accessibility and Language

Rules should align with existing accessibility obligations under the Americans with Disabilities Act and Section 508 standards, rather than creating novel, potentially inconsistent requirements. Digital notices should comply with WCAG 2.1 AA standards. The Chamber recommends that the Attorney General require businesses to provide required notices and disclosures in English and in those languages in which the business regularly engages and provides the products or services related to ADMT decision-making in the ordinary course of business, without mandating a specific list of languages.

III. Targeted Questions — Chatbot Safety Act

A. Definitions and Scope

The Chamber recommends that the Department provide additional guidance and examples to clarify the definitions of "conversational artificial intelligence service" and "operator," ensuring these definitions are not interpreted too broadly or too narrowly. In particular, guidance should clarify what constitutes making a conversational AI service "publicly available," as this determination is central to the scope of the Act's obligations.

The Chamber also recommends that the Department clarify the conversational AI exclusion in the ADMT Act. The exclusion imposes a two-part conjunctive test, and the breadth of the first prong—particularly the inclusion of "configured" and "intended by a person"—creates substantial uncertainty for general-purpose conversational AI providers whose technology may be independently deployed by customers in consequential-decision domains. Rules should clarify that: (i) the acceptable use policy requirement is satisfied by a general prohibition in terms of service or acceptable use documentation without requiring active monitoring; and (ii) a deployer's independent configuration or intent does not retroactively defeat the developer's exclusion if the developer did not share that intent.

B. Age Determination

The Chamber recommends that the Department provide guidance on what factors should be considered in determining whether an age-estimation method is "commercially reasonable," and how regulations should account for changes in technology, industry practices, or the availability of age-estimation tools over time. Rules should also clarify what evidence is relevant in determining whether operators "willfully disregard clear and convincing information" regarding the age of users and account holders, to ensure that this standard is applied consistently and does not impose strict liability on operators acting in good faith.

C. Minor Protections

The Chamber recommends that the Department provide guidance on what factors regulators should consider when evaluating whether measures are "reasonable" or "technically feasible," and what evidence operators should maintain to demonstrate compliance. Rules should also provide objective indicators for evaluating whether a service is encouraging emotional dependence, and should distinguish between permissible categories of interaction (such as roleplay, companionship, and emotional support) and prohibited emotional dependence. Clear categories would help operators design compliant services and avoid over-restriction of beneficial uses.

IV. Additional Topics

A. Aggregate-Level ADMT Outputs

Rules should address whether ADMT outputs that operate at an aggregate level—without identifying or evaluating any specific individual—can "materially influence" an individual's consequential decision. For example, a labor-forecasting system that predicts "40 workers are needed for this shift" (without determining which individuals fill those slots) arguably "constrains" downstream assignment decisions about specific individuals. Rules should confirm that aggregate planning and forecasting tools that do not process individual-level personal data and do not identify, rank, or evaluate specific individuals are excluded, even if their outputs indirectly constrain the universe of individual decisions made by a human downstream.

B. Definition of "Data"

The Act requires developers to disclose "a description of the categories of data, including personal data, used to train the covered ADMT, to the extent known." However, "data" is not defined, and the Act does not specify the level of detail required for these categories. Additional guidance on the expected specificity of this disclosure would be helpful, including whether developers may disclose data categories at a general level or must provide more granular descriptions. Clarification would help developers and deployers understand the scope of expected disclosures and support consistent implementation.

V. Conclusion

The Chamber appreciates the Department's commitment to a thoughtful, principle-guided rulemaking process and its stated goals of promoting consumer rights, clarifying ambiguities, facilitating efficient compliance, harmonizing with other frameworks, and allowing for innovation. We believe the recommendations set forth in these comments are consistent with and advance each of those principles.

The Chamber stands ready to work constructively with the Department throughout the rulemaking process and welcomes the opportunity to provide additional information or participate in any stakeholder engagement activities. We urge the Department to use its rulemaking authority to narrow and clarify the ADMT Act's scope, promote interoperability with existing federal and state frameworks, and provide practical guidance that enables businesses to comply efficiently while delivering meaningful protections to Colorado consumers.

Sincerely,

Jordan Crenshaw
Senior Vice President
Chamber Technology Engagement Center
U.S. Chamber of Commerce

About the author

Jordan Crenshaw

Crenshaw is Senior Vice President of the Chamber Technology Engagement Center (C_TEC).

Read more