AI is no longer just a tech-company issue. Colorado businesses now need to understand how automated decision-making technology can create legal obligations before 2027. If your company uses AI to help screen job applicants, rank tenants, evaluate borrowers, quote insurance, route health-care access, or decide who receives an important service, Colorado AI laws may apply even if the tool comes from a third-party vendor.
The main concern for small business owners is simple: “Are we using software that affects real people’s opportunities, eligibility, compensation, pricing, or access?” This guide explains what changed, which businesses should prepare, what numbers and deadlines matter, and how to build a practical compliance plan before January 1, 2027.
Colorado AI laws now center on two 2026 statutes taking effect January 1, 2027: the Automated Decision-Making Technology Act and the Chatbot Safety Act. For most small businesses, the biggest issue is not whether they built AI, but whether they use a vendor tool that materially influences decisions about employment, housing, lending, insurance, health-care services, education, or public benefits. Businesses should start with a tool inventory, vendor documentation requests, consumer notices, human review procedures, and contract updates. The practical deadline is not January 2027; it is the months before then, because vendor cooperation, notice language, staff training, and policy drafting take time.
Colorado’s AI compliance landscape changed significantly in 2026. The earlier 2024 Colorado Artificial Intelligence Act was repealed and reenacted through Senate Bill 26-189, which now focuses on automated decision-making technology, often shortened to ADMT. Colorado also added the Chatbot Safety Act, which creates separate requirements for some conversational AI services.
For official updates, businesses should monitor the Colorado Attorney General’s ADMT and Chatbot Safety rulemaking page, because the Attorney General must adopt rules that clarify post-adverse-outcome disclosure requirements by January 1, 2027. Colorado Attorney General’s ADMT and Chatbot Safety rulemaking page is the best place to check current rulemaking updates before publishing or revising a compliance plan.
Automated decision-making technology generally means technology that processes personal data and uses computation to generate an output, such as a prediction, recommendation, classification, ranking, score, or other information used to make, guide, or assist a decision about an individual.
That definition matters because many ordinary software tools now include scoring or ranking features. A small employer may not think of its applicant tracking system as “AI,” but if the platform ranks applicants or recommends who should move forward, it may fall into the compliance conversation.
Colorado AI laws do not treat every AI feature the same way. Using generative AI to draft a blog outline, summarize internal meeting notes, or create first-draft marketing copy is different from using ADMT to materially influence a consequential decision about a person.
The current ADMT law focuses on consequential decisions. These are decisions related to an individual’s access to, eligibility for, or compensation connected to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits.
For small and mid-size businesses, the most common trigger points are employment, lending, housing, insurance, and access to services. A 12-person company can still be covered if it uses a covered ADMT system in one of those areas. The statute is not limited to large enterprises.
Chatbots deserve a separate review. Colorado’s Chatbot Safety Act goes into effect January 1, 2027 and is aimed at conversational AI services. For many ordinary business websites, a basic FAQ bot may not create the same risk as a hiring or underwriting tool. But businesses should still review whether the bot collects personal data, routes access to important services, gives professional-sounding advice, or is presented in a way that could confuse users into thinking they are communicating with a human.
Colorado AI compliance is deadline-driven. The most important date for businesses is January 1, 2027, when the new ADMT requirements and Chatbot Safety Act provisions are scheduled to take effect. The months before that date are when businesses should finish tool inventories, vendor outreach, notice language, human-review workflows, and contract updates.
| Date / Number | Requirement | Business Example |
| January 1, 2027 | ADMT and Chatbot Safety requirements take effect. | Finish vendor documentation and consumer notices before this date. |
| 30 days | Post-adverse-outcome plain-language description deadline. | If a covered ADMT contributes to a denied application, prepare a timely explanation pathway. |
| 3 years | Minimum record-retention period for compliance records. | Keep tool inventories, notices, vendor files, review logs, and policies. |
| 60 days | Pre-2030 notice-and-cure period before enforcement, if cure is possible. | Document corrective steps if the AG flags a compliance issue. |
| Up to $20,000 | Potential Colorado Consumer Protection Act civil penalty per violation. | Multiple affected consumers can multiply exposure quickly. |
A business should prepare if it develops or deploys ADMT that materially influences consequential decisions about Colorado consumers. “Deploy” matters because a business can be responsible even when the software vendor built the tool. If your company uses the tool in your decision-making process, you may need your own documentation, notices, procedures, and contract protections.
Most High Plains Law readers are more likely to be deployers than developers. A deployer might be an employer, landlord, lender, insurer, health-care provider, education provider, or business offering access to an essential service. The key question is whether the tool materially influences a consequential decision.
A developer is usually the company that creates, codes, or substantially modifies the ADMT system. Most small businesses are not developers, but a business can move closer to developer obligations if it heavily customizes, trains, or modifies a system for consequential decisions instead of simply using a vendor’s standard product.
Colorado’s current ADMT framework is built around transparency, recordkeeping, consumer rights, and human review. A small business does not need a 100-page AI governance manual, but it does need a practical system it can explain and produce if regulators ask questions.
Deployers must provide clear and conspicuous notice to consumers at the point of interaction with a covered ADMT. In plain English, that means the consumer should know when automated decision-making technology is involved in a meaningful decision process. Hiding the disclosure deep in a privacy policy is not a strong compliance strategy.
If a covered ADMT makes a consequential decision that results in an adverse outcome, the deployer must provide a plain-language description of the ADMT’s role within 30 days. That requirement affects workflow. Someone in the business needs to know when an adverse outcome happens, which tool was involved, what explanation is available, and who sends the response.
Consumers have the right to request personal data used by the covered ADMT, correct factually inaccurate personal data, and request meaningful human review and reconsideration after an adverse outcome. Businesses should build this process before the first request arrives.
Developers and deployers must retain records necessary to demonstrate compliance for at least three years. A practical file should include the tool inventory, vendor documentation, notices, decision-flow descriptions, human-review records, employee training materials, incident notes, and contract terms related to ADMT compliance.
The best way to prepare is to turn the law into a manageable checklist. For many small businesses, the first compliance project can be completed in phases over 60 to 120 days, depending on how many vendors and decision systems are involved.
Assume a 25-employee Colorado company receives 180 job applications for 3 roles. Its applicant tracking system ranks candidates, flags “best fit” applicants, and filters out some resumes before a human review. Even if the company does not call the platform “AI,” the tool may materially influence employment decisions. The business should ask the vendor for documentation, confirm whether the tool is covered ADMT, keep a record of how humans review results, and prepare an explanation process for applicants who request review after an adverse outcome.
A property manager who uses software to rank rental applicants should review whether the tool affects housing eligibility, deposit amounts, or approval decisions. Because housing is a listed consequential decision category, the property manager should document the tool’s role, vendor support, data inputs, appeal process, and human-review procedure before the law takes effect.
Many small businesses will not have enough information to comply unless their software vendors cooperate. A business cannot responsibly explain a tool’s role, known limitations, and appropriate use if the vendor refuses to provide documentation. That is why vendor contracts should be reviewed before 2027.
A vendor agreement should not leave AI compliance as a vague promise. Depending on the tool, businesses may need contract terms covering compliance with applicable AI laws, documentation delivery, material-change notices, audit cooperation, cybersecurity, data handling, indemnification, insurance, and termination rights if the vendor cannot support compliance.
The Attorney General enforces the ADMT Act through the Colorado Consumer Protection Act, and a violation is deemed a deceptive trade practice. Before January 1, 2030, the Attorney General must provide 60 days’ notice and an opportunity to cure an alleged violation if a cure is possible. That cure period is helpful, but it is not a reason to wait. Businesses that cannot show records, notices, procedures, or vendor due diligence may have a harder time demonstrating good-faith compliance.
Colorado Consumer Protection Act penalties can reach up to $20,000 per violation in actions brought by the Attorney General or a district attorney. In AI cases, the practical risk is that one flawed system may affect many people. For example, if a covered hiring tool improperly screens 40 applicants, the exposure analysis may not feel like one mistake. It can become a multi-person compliance event.
A public AI compliance issue can damage trust with employees, applicants, tenants, customers, investors, and vendors. Even if a business avoids the maximum penalty, a poorly handled automated decision can create complaints, social-media attention, employee-relations problems, civil-rights concerns, or contract disputes.
If your business uses AI or automated software in hiring, screening, pricing, underwriting, eligibility, customer access, or chatbot workflows, now is the time to review your risk before January 1, 2027. High Plains Law helps Colorado small businesses review vendor contracts, build practical compliance records, draft notices, and create internal processes that match the business rather than overwhelm it. Contact High Plains Law to discuss whether your tools, vendors, and decision workflows need a Colorado AI compliance review.
Colorado AI laws include the Automated Decision-Making Technology Act and Chatbot Safety Act. For most businesses, the key issue is whether automated technology materially influences consequential decisions about individuals in areas such as employment, housing, lending, insurance, health care, education, or public benefits.
The current ADMT and Chatbot Safety requirements take effect January 1, 2027. Businesses should prepare before that date because vendor documentation, notices, human-review workflows, contracts, and staff training can take months to complete.
Yes. The ADMT law is not limited to large companies. A small Colorado employer, landlord, lender, or service provider may be covered if it uses automated decision-making technology to materially influence consequential decisions about individuals.
ADMT is technology that processes personal data and uses computation to generate outputs such as predictions, recommendations, classifications, rankings, or scores that help make, guide, or assist a decision about an individual.
A consequential decision relates to access, eligibility, or compensation connected to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits.
They can. If a hiring platform scores, ranks, screens, or recommends applicants in a way that materially influences employment decisions, the business should review whether the tool is covered ADMT and whether notices, records, and human-review procedures are needed.
Deployers must provide clear and conspicuous notice at the point of interaction with a covered ADMT. After an adverse consequential decision, businesses must provide a plain-language description of the ADMT’s role within 30 days.
Developers and deployers must retain records necessary to demonstrate compliance for at least three years. Practical records include tool inventories, vendor documentation, notices, human-review logs, policies, and contract terms.
Ask whether the tool is covered ADMT, what data it uses, what limitations are known, how human review should work, what bias testing exists, and whether the vendor will provide documentation, updates, and compliance cooperation.
Yes. Consumers have rights to request personal data, correct factually inaccurate data used by covered ADMT, and request meaningful human review and reconsideration after certain adverse consequential decisions.
Violations are enforced through the Colorado Consumer Protection Act as deceptive trade practices. Civil penalties can reach up to $20,000 per violation, and multiple affected consumers can increase the practical exposure.
Not every AI use requires a lawyer, but legal guidance is useful when AI affects hiring, housing, lending, insurance, health care, or other consequential decisions. Contracts, notices, policies, and vendor obligations all carry legal risk.
Disclaimer: This article is provided by High Plains for general informational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws, fees, regulations, and court decisions referenced may change. For advice on your specific situation, please contact High Plains directly to schedule a consultation.
High Plains Law is a division of Gessler Blue LLC. All legal services are provided through Gessler Blue LLC.
The content on this website is not legal advice and is intended for general informational purposes only.
No attorney-client privilege is formed by use of this website or the content hereon.
Copyright High Plains Law LLC. Attorney advertising.
The content on this website is not legal advice and is intended for general informational purposes only.
No attorney-client privilege is formed by use of this website or the content hereon.
