Colorado Repealed Its AI Act. The Rules Decide What Remains

SB 26-189 Is Called a Notice Bill. The Attorney General's Draft ADMT Rules Make Coverage and Review Turn on What the Human Actually Did

by Sam Rogers
8 min read
analysis
legal
governance
regulated-industries
policy
Colorado Repealed Its AI Act. The Rules Decide What Remains

This article is for educational purposes and does not constitute legal advice. Organizations subject to Colorado's AI statutes or its pending rules should consult qualified counsel about their specific obligations.

A reviewer who always agrees with the model is, under Colorado's draft rules, evidence that the model made the decision.

What Survived the Repeal

On May 14, 2026, Governor Polis signed SB 26-189, which repeals and reenacts part 17 of article 1 of title 6 of the Colorado Revised Statutes, the part of the Colorado Consumer Protection Act that SB 24-205 created as the Colorado AI Act. SB 24-205 is the original act, SB 26-189 is the act that replaced it, and the reenacted part 17 is the text a deployer now reads. The duty of reasonable care, the impact assessments, the risk management programs, and the high-risk system category are gone. What remains applies to "covered ADMT," automated decision-making technology used to materially influence a consequential decision in employment, housing, lending, insurance, health care, education, or essential government services. Developers owe deployers documentation. Deployers owe consumers a notice before the decision, a plain-language disclosure within 30 days of an adverse outcome, a correction path, and an opportunity for meaningful human review. Everyone keeps records for three years. The act applies to consequential decisions made on or after January 1, 2027, and the Attorney General must adopt implementing rules by that date.

We modeled the surviving obligations in ObligationFirst the week the bill was signed, and the sponsor's reported description of it as "more of a notice bill" held up under the schema. Davis Polk's client update reaches the same reading: a narrower regulatory framework focused on transparency and disclosure. The statutory milestones are tracked at EveryAILaw.

That reading is correct about the statute. It's just that the statute also delegated the two questions that decide who's covered and what compliance looks like, and the delegation is now live.

The Rulemaking Decides Who's Covered

On August 11, 2026, the Colorado Department of Law filed proposed rules at 4 CCR 904-6 with a notice of hearing. Written comments are open through October 26, 2026, at 11:59 p.m. Mountain, the same day the hearing begins at 10:00 a.m. at 1300 Broadway in Denver. That deadline is softer than it looks in one direction and harder in another: if the hearing continues past the 26th, the comment period continues with it, but a comment filed late in the window arrives after the office has already revised the draft it brings to the room. The office has been circulating interim revisions to its rulemaking mailing list, so the operative text on any given day is the one on the rulemaking page, not the August filing. That page carries the current draft and the comment form.

The largest open question in the notice is the meaning of "materially influence," the phrase every obligation in the act hangs on. The Attorney General has published two competing standards and asked the public to choose.

Both standards share a presumption. An output is presumed to materially influence a decision if it constrains an option set, sets a threshold, or produces a rank, score, classification, recommendation, prediction, or other inference about the individual, is reviewed by the decision-maker or used to screen what the decision-maker sees, and is consistent with the outcome. That describes most resume rankers, underwriting scores, and tenant screens. Fisher Phillips read the presumption the same way for employment tools: if a recruiter looks at a ranked list and hires from the top of it, the presumption applies.

Now look at what rebuts it. Under Standard 1, the rebuttal evidence is that the decision-maker recorded an independent judgment before seeing the output, didn't view it, or reached a decision inconsistent with it. Under Standard 2, the rebuttal evidence is that the decision-maker conducted an independent review of substantial other information, had the authority to decide on that review, and had the subject matter understanding to do so. Neither standard asks what the tool is. Both ask what the person did with it, and whether there's a record.

That's the quiet inversion in this rulemaking. The scope of a technology statute will be decided, deployment by deployment, by observed human behavior. A tool that a qualified person actually second-guesses may fall outside the act. The same tool, with a person who signs off on whatever it says, is covered, and the person's agreement is the evidence.

Meaningful Human Review Has a Definition

The second delegated question is what a consumer gets when they ask for reconsideration. Here the statute did more than the notice-bill label suggests. Section 6-1-1701(15) defines meaningful human review as review by an individual designated by the deployer who has authority to approve, modify, or override the decision, who considers relevant available primary evidence, who is trained to conduct the review, and who does not default to the system output.

Draft Rule 7 builds that out. The reviewer must be independent of the original decision-maker and not their subordinate, whenever feasible. Their subject matter understanding must be commensurate with the harm of the adverse outcome. Their training must let them recognize when review of additional primary evidence would be valuable, and let them understand that evidence. They must be shielded from steering by management and from retaliation. ADMT may not assist in the review. A review is meaningful only if it could change the outcome, and a full reversal is treated as evidence that it was. When the harm is a severe and irreversible denial of a basic need, such as housing, review is presumed commercially reasonable and the deployer bears the burden of proving otherwise.

Draft Rule 6 closes the loop from the disclosure side. The deployer must state the principal reasons with specificity, disclose any score that drove the outcome and the data behind it, and describe the role of any human reviewer. A deployer that can't accurately explain why its covered ADMT produced the outcome doesn't comply. Not what they report, what they do, written into an administrative rule.

The Proxies That Don't Answer the Question

Most of us preparing for January have three artifacts ready: a policy that says a human reviews consequential decisions, an org chart that names the reviewer, and a training completion record. Read the rebuttal evidence and the reviewer standards again and you'll notice that none of those artifacts answers what the rules ask.

The rules ask whether the decision-maker's judgment was independent of the output. A policy asserts that it should be. The rules ask whether the reviewer defaults to the system output. An approval log shows an approval, and a log where the human agreed with the model every time is the presumption's own evidence. The rules ask whether the reviewer has the subject matter understanding to recognize when primary evidence would change the answer. A certificate shows that instruction happened. When new systems are introduced, execution is audited. Behavior is not.

This is where the operational drift sequence meets a statute. Adoption increases, output volume increases, verification rigor decreases, and human review becomes performative. Colorado's draft rules give that last step a legal consequence: performative review pulls the tool into coverage, fails the meaningful-review standard, and leaves the deployer unable to produce the disclosure. Three failures from one habit.

What a Deployer Can Observe Before January

The rules will move again before the October 26 hearing. The material-influence standard will be chosen and the review requirements may soften or harden. What won't change is that the rebuttal evidence and the reviewer standards both describe behavior under conditions where the model is confident and the person has a reason to agree with it.

PAICE (People + AI Collaboration Effectiveness) measures that behavior directly. The assessment puts a professional in an AI-assisted task, seeds output that's confident, plausible, and wrong, and scores whether the person considers the primary evidence, declines to default to the system output, escalates when a claim can't be confirmed, and overrides rather than rationalizes. A person who sounds fluent but misses the seeded error scores lower than a terse person who catches it. That's the behavior Colorado's reviewer standard names, observed before an adverse outcome instead of reconstructed after a request for reconsideration.

The results are private by architecture. Scores attach to hashed identifiers, no conversation text is retained, and individual results are structurally unavailable to the organization. A deployer learns whether its reviewer population defaults to the model under pressure. It doesn't learn which reviewer to reassign. The reviewer does.

PAICE covers the People vector only. Tracking the statute and its milestones as the rules land is a job for EveryAILaw, typing the obligations in a shared schema is a job for ObligationFirst, and AI Posture is one framework for thinking about organization-level posture. The narrow question the rulemaking leaves with the deployer is the one it made central: when the model is wrong, what does your reviewer do, and can you show it?

Want to know whether your reviewers default to the model before a regulator asks? Learn about PAICE for organizations or take an individual assessment to see it firsthand.

Curious but short on time?

Take the 3-minute PAICE Pulse — a quick confidence check that maps how you see your own AI collaboration posture. No login required.