Colorado's Proposed ADMT & Chatbot Safety Rules: What Small Businesses Should Know (and Say) Before October 26

On August 11, 2026, the Colorado Attorney General filed the proposed ADMT & Chatbot Safety Rules (4 CCR 904-6) — the rules that will put operational detail on the Colorado ADMT Act (SB 26-189) and the Chatbot Safety Act (HB 26-1263) when everything takes effect January 1, 2027. The formal comment window is open now through October 26, 2026, and this time the comments go into the official rulemaking record. Here is what the proposed rules would add, what they mean for a small business, and how to say your piece before the October 26 hearing.

What just happened

The ADMT Act — formerly known as the Colorado AI Act — told the Attorney General to write implementing rules by January 1, 2027. An informal pre-rulemaking comment phase ran in June and July. Now the formal step has arrived: on August 11 the AG's office filed proposed rules at 4 CCR 904-6, covering both the ADMT Act and the Chatbot Safety Act, and opened a public comment period that runs through October 26, 2026 at 11:59 PM. A rulemaking hearing is set for October 26, 2026 at 10:00 AM at the Ralph L. Carr Judicial Center in Denver, with a remote option.

One scheduling detail matters more than it looks: per the AG's filed Notice of Hearing, comments submitted by September 4, 2026 inform the revisions the AG presents at the hearing. You can comment right up to the deadline, but the early comments are the ones that shape the draft everyone reacts to.

What the proposed rules would add for ADMT deployers

The ADMT Act gives deployers five duties — pre-use notice, adverse-outcome notice, data access and correction, meaningful human review, and three years of records. The proposed rules put specifics on nearly all of them:

• Plain-language, accessible notices. The pre-use notice would have to meet plain-language and accessibility standards — readable by the people actually affected, not just defensible in a footnote.
• Adverse-outcome disclosures with specific reasons. When ADMT contributes to a decision against someone, the disclosure would need to state the specific principal reasons for the outcome — “did not meet internal standards or policies” would not cut it. Deployers would also need a 24/7 online channel where consumers can get the required information, and would have to deliver disclosures by at least two methods.
• A 45-day clock on consumer requests. Requests to access or correct the personal data the ADMT relied on would run on a 45-day response timeline.
• Real requirements for human review.The statute's “meaningful human review” would get teeth: an independent, trained reviewer; a prohibition on using ADMT to assist the review itself; and documentation of how the review was conducted. If your current plan is “a manager glances at the rejections,” the proposed rules are aimed at you.
• A new “Midstream Developer” role.The proposal adds a category for businesses in the middle of the AI supply chain — those who take someone else's technology and modify or integrate it before it reaches the deployer — with documentation duties to match.

What the proposed rules would add for chatbot operators

The same filing covers the Chatbot Safety Act (HB 26-1263). For operators of consumer-facing conversational AI, the proposed rules would spell out:

• Age assurance mechanics — including that a government ID cannot be the sole method of estimating age.
• Disclosure mechanics— how and when the “you are talking to an AI” disclosure appears, including refreshes during long sessions.
• Minor protections and crisis protocols— the operational detail behind the statute's safeguards for minors and its suicide and self-harm response requirements.
• Professional-impersonation controls — implementing the ban on presenting chatbot output as provided by, endorsed by, or equivalent to a licensed health-care, legal, or mental-health professional.
• Annual reports to the AG with user tiers — the reporting duty starts July 1, 2027, and the proposal structures what operators of different sizes must file.

The thing small businesses keep asking: is there an exemption for us?

No. Neither the statutes nor the proposed rules contain a small-business exemption. Where size shows up is in the phrase “commercially reasonable”— the human-review duty applies “to the extent commercially reasonable,” and what is reasonable for a five-person shop differs from what is reasonable for an enterprise. That is a real but limited cushion, and how the final rules calibrate it is precisely the kind of question the comment record will influence.

How to submit a comment that gets used

1. Say who you are and what you run. Industry, headcount, and the AI tools you actually use. Specificity is credibility.
2. React to a specific proposed requirement.This is the advantage of the formal phase — there is now a concrete text to respond to. “The two-delivery-method requirement for adverse-outcome disclosures would work like this in our business” beats general opinion every time.
3. Quantify the burden where you can. If a 24/7 online information channel or independent-reviewer requirement means hiring or new software for a business your size, say so, with numbers.
4. Submit early if you want to shape the hearing draft. Comments are open through October 26, 2026 at 11:59 PM, but submissions by September 4 inform the revisions the AG presents at the October 26 hearing.
5. File through the portal. Submit at comments.coag.gov; the AG's rulemaking hub is at coag.gov/ai. Know that comments are posted publicly — write accordingly, or have counsel frame a sensitive fact pattern.

Frequently asked questions

What are the Colorado ADMT & Chatbot Safety Rules?

They are the Attorney General's proposed rules implementing the Colorado ADMT Act (SB 26-189) — formerly known as the Colorado AI Act — and the Chatbot Safety Act (HB 26-1263), filed August 11, 2026 at 4 CCR 904-6. The final rules take effect January 1, 2027, alongside both statutes, and carry most of the operational detail: notice standards, disclosure content, consumer-request timelines, human-review requirements, and chatbot age-assurance and reporting mechanics.

What is the deadline to comment on the proposed rules?

Written comments are accepted through October 26, 2026 at 11:59 PM via the portal at comments.coag.gov. Per the AG's filed Notice of Hearing, comments submitted by September 4, 2026 inform the revisions presented at the rulemaking hearing on October 26, 2026 (10:00 AM, Ralph L. Carr Judicial Center, Denver, with a remote option).

Is there a small-business exemption in the proposed rules?

No. Neither the ADMT Act, the Chatbot Safety Act, nor the proposed rules exempt small businesses. Business size matters only through the “commercially reasonable” qualifier on the human-review duty.

When do the rules take effect?

The final rules take effect January 1, 2027 — the same day the ADMT Act's duties apply to consequential decisions and the Chatbot Safety Act's operator duties begin. Until then, the proposed rules are a preview, not an obligation.

The bottom line

The proposed rules turn two short statutes into an operating manual — specific reasons in adverse-outcome disclosures, a 45-day request clock, an independent human reviewer, chatbot age assurance and reporting. None of it is final until the AG says so, and the comment window through October 26 is the last structured chance to shape it. If the rules would land hard on a business your size, the record needs to hear that from you, not just from the Fortune 500.

Want to know where you stand before the rules land? Run the free AI Act readiness checker, or see how the FAIIR standardmaps its controls to the ADMT Act, the Chatbot Safety Act, and the AG's implementing rules.