AI Compliance Checklist: Two Laws, One Deadline, Three Firm Types

Summary

• Two laws. One deadline. California SB 574 and Colorado's Algorithmic Decision-Making Transparency (ADMT) law both take effect January 1, 2027.
• 73 days remain from October 19, 2026 to get compliant — this page is the build order.
• Which law applies to your firm depends on where your clients are, not where you're headquartered.
• Firm-type checklists below: law firms (SB 574 + ADMT), accounting firms (ADMT), staffing agencies (ADMT).
• Small firm exemption exists for Colorado ADMT. No exemption for SB 574.

---

Which Law Applies to Your Firm

78% of professional services clients say AI-enabled quality improvements are now essential to their decision to hire or retain a firm. 6% of firms are actually delivering them. That gap is about to be regulated.

Two state laws take effect January 1, 2027 — and they apply based on your clients' locations, not your firm's address.

Law	Who It Covers	What It Governs
California SB 574	Any attorney using AI in California-filed matters	Citation verification, court disclosure, client confidentiality, human judgment
Colorado ADMT (SB 26-189)	Any firm making "consequential decisions" affecting Colorado residents	Transparency, adverse action notice, human review rights

Where firms get caught: The assumption that "we're not in California" (or Colorado) removes exposure is wrong. If you file matters in California courts — even remotely — SB 574 applies. If any of your clients, candidates, or customers are Colorado residents and AI influences a decision about them, Colorado ADMT applies. Firms with clients across both states face obligations under both laws.

This page covers what each law requires, broken down by firm type. Pick your firm type and work the checklist. The 73-day timeline at the bottom gives you the week-by-week build order.

---

Law Firms — California SB 574 Checklist

SB 574 was signed September 30, 2026, and takes effect January 1, 2027. It applies to every attorney who uses generative AI in matters filed in California courts — regardless of the firm's home state.

The law establishes four specific attorney duties:

1. Personal citation verification You must personally verify every AI-generated citation before filing. The standard is not "I reviewed it" — it is verification that the citation is accurate, that the case exists, and that it says what you claim it says. This applies to every attorney at the firm, not just senior partners.

What "done" looks like: A documented verification step in your filing workflow. Each attorney signs off on citation review before documents leave their desk. You cannot delegate this verification to the AI itself or to a paralegal acting alone.

2. Court disclosure Attorneys have an affirmative duty to notify the court when AI has been used to assist in the preparation of filings. This is not optional and is not limited to cases where AI "substantially" assisted — the disclosure obligation attaches when AI is used in any capacity that touched the work product.

What "done" looks like: A standard disclosure clause added to your filing templates. Designate who reviews it before submission and confirm the disclosure reflects actual AI usage.

3. Client confidentiality controls Client data cannot flow through consumer AI tools (ChatGPT, Claude, etc.) without matter-level controls. SB 574 requires you to have access controls and audit logs at the matter level — not just firm-wide terms of service agreements.

What "done" looks like: Matter-level access controls on any AI tool used for client work. Audit logs showing who accessed what. Written confirmation from your AI vendors that data is not used for model training. Consumer-tier subscriptions are a compliance liability; enterprise agreements with data processing addenda are the floor.

4. Non-delegation of legal judgment No AI system may control substantive legal decisions. AI can draft; a human attorney must decide, review, and be accountable.

What "done" looks like: A written AI use policy confirming that human review is required before any AI-generated legal work product goes to a client or court. Train your attorneys on the line between AI assistance and AI delegation.

For full SB 574 detail: California SB 574: What Law Firms Must Do Before January 2027

---

Law Firms — Colorado ADMT Checklist

Colorado ADMT applies to law firms that make "consequential decisions" affecting Colorado residents. If your firm uses AI to influence client intake decisions, evaluate case merit, recommend settlements, or assess prospective hires — and any of those people are Colorado residents — ADMT applies.

Before January 1, 2027:

1. Map which AI tools touch consequential decisions. Intake scoring, case assessment tools, associate hiring tools, and any AI that filters or ranks people or cases.
2. Implement an adverse action notice workflow. When AI influences a decision that negatively affects a Colorado resident (declined client intake, rejected candidate), you must notify them and offer a path to human review.
3. Designate a compliance contact. Someone at the firm owns the response when a Colorado resident requests review.
4. Track the October 2026 rulemaking. Colorado's Attorney General published final rules in October 2026 — review them before your December deadline.

Small firm note: Law firms with fewer than 50 full-time employees using off-the-shelf AI tools without custom training qualify for reduced ADMT obligations. You still must provide adverse action notice and make the AI developer's impact assessment available on request. You are exempt from the heavier requirements — written risk management policy, annual impact assessments, website disclosure.

---

Accounting Firms — Colorado ADMT Checklist

Accounting firms are high-exposure under Colorado ADMT. AI tools that influence financial projections, audit risk flags, or advisory recommendations used to make decisions about Colorado clients fall within the law's scope.

Before January 1, 2027:

1. Inventory your AI tool stack by decision type. Tax software with AI risk-scoring features, audit analytics platforms, advisory tools. Include tools used by individual CPAs, not just firm-sanctioned platforms.
2. Identify which outputs influence consequential decisions. Focus on tools that produce client-facing recommendations or flag audit risks that affect client outcomes. These are your ADMT exposures.
3. Draft or update your AI use policy. AICPA ethics standards (ET §1.300.040) already require vetting third-party tools that handle client data. Update that policy to name ADMT compliance obligations explicitly.
4. Document your human review process. For every AI-generated output that influences a client recommendation, document who reviews it and at what stage.
5. Update client engagement letters. Add language disclosing AI tool use. For Colorado clients, add ADMT-specific notice language.

For Colorado ADMT detail: Colorado ADMT: What Professional Services Firms Must Do

---

Staffing Agencies — Colorado ADMT Checklist

Staffing firms are the highest-risk category under Colorado ADMT. The law was written with employment decisions at its center — and staffing firms use AI for exactly the decisions it targets: candidate screening, placement matching, and applicant filtering.

Before January 1, 2027:

1. Audit every AI touchpoint in the candidate journey. Resume parsing, candidate scoring, interview scheduling tools that rank or filter applicants, reference check analysis, match algorithms. All of it.
2. Implement candidate adverse action notices. When AI influences a decision not to place or refer a Colorado candidate, they must be notified and offered human review. Draft a standard notice now.
3. Update your ATS vendor agreements. If your applicant tracking system uses AI screening, ensure your vendor agreement addresses ADMT compliance obligations — including their liability and cooperation if a candidate requests review.
4. Designate a compliance owner. This person manages the adverse notice workflow and handles requests from Colorado candidates.
5. Train your recruiters. Every recruiter who works with Colorado candidates needs to know when a disclosure or notice is required and how to deliver it.

Small firm note: Staffing agencies under 50 FTE using off-the-shelf ATS tools without custom training qualify for the ADMT small business exemption — reduced to two lighter duties (adverse notice + impact assessment availability). The exemption does not apply if you have trained or substantially customized the AI system.

---

Timeline — 73-Day Build Order {#timeline}

October 19 to December 31, 2026. Seventy-three days. This is the week-by-week build order.

Week 1 (Oct 19–25): Inventory List every AI tool in use at your firm by function and by the type of decision it influences. Include tools used by individual employees even if not firm-sanctioned. This is your exposure map.

Week 2 (Oct 26–Nov 1): Jurisdiction mapping Determine which laws apply. Do you file in California courts? Do you have clients, candidates, or customers in Colorado? Multi-state firms with both exposures start with SB 574 first — it has no small firm exemption.

Week 3–4 (Nov 2–15): Policy and disclosure language Draft or update your AI use policy to cover both laws. Draft disclosure language for court filings (SB 574) and client engagement letters. Draft candidate adverse action notice template (ADMT).

Week 5–6 (Nov 16–29): Technical controls For law firms: implement matter-level access controls and audit logs on AI tools handling client data. Move from consumer-tier to enterprise agreements where needed. For all firms: confirm vendor data processing agreements are in place.

Week 7–8 (Nov 30–Dec 13): Staff training Train attorneys on SB 574 verification and disclosure requirements. Train all staff on adverse notice workflow for ADMT. Document the training.

Week 9–10 (Dec 14–31): Review and sign-off Final review of your policy, disclosures, vendor agreements, and training records. Designate your compliance contacts. Sign off before January 1.

---

FAQ — AI Compliance Deadline 2027

Q: Does my firm need to comply with both California SB 574 and Colorado ADMT? It depends on your client jurisdictions. California SB 574 applies to any attorney using generative AI in matters filed in California courts — your firm's home state is irrelevant. Colorado ADMT applies to any firm making "consequential decisions" affecting Colorado residents. Multi-state firms with California AND Colorado clients may face obligations under both laws.

Q: What is the January 1, 2027 deadline for law firms? SB 574 and Colorado ADMT both take effect January 1, 2027. SB 574 governs AI in California-filed matters — four specific duties around citation verification, disclosure, confidentiality, and non-delegation. Colorado ADMT governs AI-aided decisions affecting Colorado residents, across law, accounting, and staffing firms.

Q: Is there a small firm exemption for Colorado ADMT? Yes. Firms under 50 full-time employees using off-the-shelf AI tools without custom training qualify for reduced obligations — two lighter duties still apply: adverse action notice and providing the developer's impact assessment on request. There is no size exemption for California SB 574. Every attorney using AI in California-filed matters is covered regardless of firm size.

Q: What happens if my firm misses the January 2027 AI compliance deadline? For SB 574: civil liability, court sanctions, and potential bar discipline. For Colorado ADMT: civil enforcement with penalties up to $20,000 per violation. The exposure compounds — a firm running AI tools across dozens of client matters without compliant controls is looking at per-violation risk that adds up fast.

Q: How do I know which AI tools are covered by these laws? For SB 574: any AI system that touches work product filed in California courts. For Colorado ADMT: any AI system that makes or substantially influences "consequential decisions" about people — hiring, client intake, financial advisory recommendations. Use the inventory step in Week 1 of the 73-day build order: list every AI tool by function and decision type, then map each to the applicable law.

---

What This Means for Your Business Model

The compliance pressure and the competitive pressure are arriving at the same time. Clients already expect firms to deliver AI-enabled quality — the 78%/6% gap above says most firms aren't there yet. Now they have a regulatory deadline layered on top of that expectation.

Firms that treat compliance as the floor — not the ceiling — will come out of this window better positioned. The same controls required by SB 574 (matter-level access, human review workflows, documented AI oversight) are also what enterprise clients want to see before trusting you with their sensitive matters. Compliance documentation becomes a business development asset.

The Crossing Report Issue #28 — The 73-Day Window — covers how the competitive dynamics and the regulatory timelines are converging, and what the new business model looks like for firms that navigate both at once.

Subscribe to The Crossing Report to get the full analysis in your inbox on October 19.

For earlier compliance hubs: AI Compliance Deadline 2026 — Firm Checklist | AI Disclosure Policy for Professional Services Firms

---

The Crossing Report covers AI adoption and compliance for professional services firm owners with 5–50 employees. Subscribe free to get weekly intelligence in your inbox.