FPF Urges Colorado to Simplify and Align Its Automated Decision-Making Rules

What the rulemaking covers

The comments concern the Colorado Automated Decision-Making Technology Act (SB 26-189), which was enacted in May 2026. According to FPF, the law repeals and replaces the Colorado AI Act (SB 24-205) and sets new requirements for developers and deployers of automated decision-making technology (ADMT) used to materially influence consequential decisions.

Developers must provide a general statement about covered ADMT, including its intended uses and known limitations. Deployers must give consumers notices and explanations about how the technology is used in consequential decisions. The law also gives consumers rights to access and correct certain personal data and to request meaningful human review after adverse consequential decisions. It takes effect January 1, 2027.

In August 2026, the Department started a formal rulemaking process to clarify and implement SB 26-189 and the Colorado Chatbot Safety Act (HB 26-1263). After an initial round of public comments, it released the updated interim draft on October 6, 2026.

Recommendation one: narrow the scope test

The interim draft lists six considerations for deciding whether an ADMT output was a de minimis factor in a consequential decision. That question determines whether the technology materially influenced the decision and therefore falls under the law.

FPF recommends keeping the first four considerations, which focus on human involvement. They look at whether a decision-maker reviewed the ADMT output, independently analyzed other relevant information, had the necessary subject-matter understanding, and had authority to make or change the decision. FPF says these match California's ADMT regulations and Colorado's existing Privacy Act regulations, both of which stress sufficient human participation.

It recommends removing the final two considerations, which cover organizational policies and the volume, type or complexity of personal data processing. In FPF's view, these address the circumstances around human involvement rather than the involvement itself. It suggests treating organizational policies and related documentation as supporting evidence, consistent with proposed Rule 6.1(B).

FPF also argues that the complexity of data processing does not necessarily show whether an ADMT output materially influenced a decision, especially when a human exercises independent judgment. Because the statutory definition of ADMT already includes the processing of personal data, adding that factor risks a duplicative inquiry, according to FPF.

Recommendation two: link developer and deployer duties

FPF's second recommendation addresses a gap it sees in the draft. Developers must document intended uses, known limitations and known risks, but the information they must supply may not match what deployers must disclose to consumers. That could leave deployers explaining aspects of a system they cannot independently assess.

Drawing on its Updated Best Practices, FPF proposes that the Department:

• Tie developer documentation to deployer obligations by requiring information sufficient for deployers to meet their statutory responsibilities, to the extent it is within the developer's knowledge.
• Clarify "known limitations" and "known risks" to include relevant performance limitations, intended user populations, and reasonably foreseeable risks identified through developer testing.
• Clarify ongoing disclosure duties by specifying when developers should notify deployers of material updates, changes in intended use, or newly identified material risks.
• Encourage standardized formats, such as model cards and system cards, for consistent communication between developers and deployers.

What it means for developers and deployers

The draft rules are still in the rulemaking stage, and the Department has not adopted FPF's suggestions. FPF says its aim is to promote interoperability, clarify compliance obligations, and support meaningful transparency and human oversight in consequential decisions. For companies building or using automated decision tools in Colorado, the outcome will shape how they judge whether a system is covered and what documentation they must pass along before the law takes effect on January 1, 2027.