Cybersecurity Policy Report, Rulemaking Launched on ADMT, Chatbot Safety in Colorado, (Aug 13, 2026)
By Tony Foley
Colorado Attorney General Phil Weiser (D.) has filed proposed rules to implement recently enacted laws governing the use of automated decision-making tools and adding protections for users of AI (artificial intelligence) chatbots.
Background. In 2024, the state enacted the Automated Decision-Making Technology (ADMT) Act (S.B. 205 (Ch. 198), Reg Sess. (Colo. 2024)), which created consumer protections from algorithmic discrimination made by high-risk AI systems. The law was amended earlier this year to add new requirements regarding the use of ADMT in consequential decisions (S.B. 189 (Ch. 131), Reg Sess. (Colo. 2026)).
Also in 2026, the legislature approved H.B. 1263 (Ch. 208), Reg Sess. (Colo. 2026), the Chatbot Safety Act, which amended the ADMT law to add protections for users of conversational AI services, including requiring chatbot operators to estimate the age of users, disclose that users are interacting with AI and not humans, and safeguard teen users against sexually explicit content and simulated emotional dependence. The amended provisions of the ADMT Act and the Chatbot Safety Act go into effect on Jan. 1, 2027.
As explained in its ADMT and Chatbot Safety rulemaking page, the AG is required to adopt rules to clarify and implement specific elements of the ADMT Act prior to the Jan. 1 effective date. In addition, while the Chatbot Safety Act did not require rulemaking, AG Weiser believes that such rules would help to ensure that compliance obligations, including the contents of required annual reports, are clear.
Rulemaking process. In its pre-rulemaking phase, the AG sought input from interested persons to inform the rule drafting process, providing a considerations paper to give commenters additional background. The comments received during this informal comment period, which ended last month, were taken into consideration in the proposed draft rules filed by the AG on Tuesday. A rulemaking hearing is scheduled for Oct. 26, and interested parties may submit formal rulemaking comments regarding these proposed rules through Oct. 26, or until the last day of the rulemaking hearing, whichever is later, using this online comment form. Written comments to be presented at the formal rulemaking hearing should be submitted by Oct. 5. Comments will be posted on this webpage.
News: StateLegislation DataPrivacy DataSecurity