What happened
On October 6, the Colorado attorney general released an interim redline of proposed rules implementing the state's Automated Decision-Making Technology Act, SB 26-189, and its Chatbot Safety Act, HB 26-1263. The rules were first filed on August 11 and will be the subject of a rulemaking hearing on October 26. The stated aim is to have rules adopted before both laws take effect on January 1, 2027.
The most significant addition is a rule setting out when a system's output is presumed to materially influence a consequential decision. The presumption applies where the decision-maker reviews an output about the individual, such as a score, ranking, recommendation, or threshold, or uses it to screen data, and the output is consistent with the final outcome. A deployer can rebut the presumption by showing the output was only a de minimis factor. Tools used solely to summarise, organise, or present information for human review fall outside the definition. One of the draft's examples is a credit union denying loans to applicants scoring below a risk threshold.
The draft also clarifies that a deployer remains responsible when a third party runs the technology on its behalf and the deployer uses the output to make the decision.
Adverse outcome disclosures change as well. The August version would have required deployers to state the principal reasons for an adverse outcome and disclose any inferences or scores behind it. The redline drops that. Deployers would instead describe the technology's role with specificity, deliver disclosures through every channel they normally use with the consumer, and have 15 days to respond to information requests. The draft adds an exception for disclosures that would compromise legally required cybersecurity, fraud prevention, anti-money laundering, or sanctions compliance programmes.
On consumer rights, the draft recasts access and correction as rights to request instructions for obtaining and correcting personal data, excludes opinions, predictions, scores, and protected evaluations from correction, and removes the requirement to hold adverse outcomes pending correction or human review. Human reviewers may be internal or external, provided they have actual authority to override the decision.
Why this is a GRC story
Material influence is the hinge the regime turns on. A clear presumption with a defined rebuttal is easier to build controls around than a vague standard, and it tells deployers where documentation and testing effort belong.
Disclosure duties are narrowing, but accountability is not. Dropping the principal reason requirement lowers the drafting burden. Being specific about the technology's role, and answering within a defined window, is still an operational commitment with a workflow behind it.
Carve-outs need governing, not just citing. An exception for fraud prevention, anti-money laundering, or sanctions programmes only helps if someone can evidence that disclosure would genuinely compromise a required programme.
What to watch
Watch the October 26 hearing and the final text, particularly whether the de minimis rebuttal survives as drafted and how firmly the January 2027 effective date holds. Watch as well for other states copying the material influence test.
For teams deploying AI in lending, employment, or insurance, the practical work is inventory: which decisions are supported by system output, who reviews it, and what the record shows.
Attribution: Analysis based on JD Supra (Orrick client alert) and related public reporting. This article is original commentary, not a repost of the source material.