Colorado AI Rules Take Effect Jan 1. You Have 72 Hours to Shape Them.

The Colorado Attorney General's office is finalizing the rules for the state's AI law, and the window for professional services firms to influence that outcome closes in 72 hours.

Comments submitted by October 5, 2026 go into the revised draft — the pre-hearing draft that will most likely become the final rule. The formal public hearing is October 26. But by then, the text will be largely set.

The law takes effect January 1, 2027. What the final rules say will determine how much compliance work lands on your firm's plate.

Here's what you need to know, and what to say.

---

What Colorado's ADMT Rules Require

Colorado's Automated Decision-Making Technology (ADMT) law requires firms that deploy AI in "consequential decisions" to:

• Notify affected parties that AI was used
• Allow opt-out or human review of AI-influenced decisions
• Document the AI systems in use and their role in the decision
• Conduct impact assessments for bias and accuracy

The Colorado AG's proposed rules, filed August 11, define "consequential decision" broadly. For professional services firms, three categories matter most:

Staffing firms: Any AI used in employment decisions — candidate screening, placement matching, performance evaluation — is covered. If your ATS has AI scoring, you're in scope.

Accounting firms: AI used in financial advisory decisions is covered. Automated cash flow forecasting tools or AI-assisted investment recommendations that influence client outcomes may qualify.

Law firms: Legal services decisions were carved out of the ADMT consequential decision definition under SB 189. However, law firms using AI in employment decisions — hiring, performance evaluation, or associate placement — remain in scope. Law firm AI tools that affect non-legal decisions about firm operations or client access to services may also qualify. The proposed rules are worth reviewing even if your practice is squarely in legal services.

The rules as drafted require notification before each consequential decision, a written opt-out mechanism, and an annual impact assessment for each AI system. Seyfarth's analysis found the proposed rules create "more operational work than the statutes suggest" — particularly for small firms without compliance teams.

---

Why October 5 Matters More Than October 26

The Colorado AG's rulemaking process has a two-tier comment structure:

• Comments by October 5 are included in the pre-hearing revised draft. The AG's office reviews these, identifies patterns, and incorporates substantive changes into a revised text before the formal hearing.
• Comments at the October 26 hearing enter the formal record but do not shape the revised draft. They can influence final technical adjustments, but the core framework will be set.

For professional services firms, the practical implication is this: if the October 5 draft contains an inadequate small-business exemption or a notification requirement that's unworkable at a 10-person firm, the October 26 hearing is too late to fix it.

The October 5 window is where the draft gets made. Submit your comment there.

---

Three Things to Say in Your Comment

You do not need legal counsel to submit a meaningful public comment. You need to describe, specifically and factually, how the proposed rules affect your firm's operations. Here are the three points most likely to influence the revised draft for small professional services firms:

1. Request a clear small-business threshold.

The current draft does not establish a simplified compliance pathway for firms under 50 employees. A staffing firm with 8 employees using standard ATS software faces the same notification, documentation, and impact assessment requirements as a 500-person enterprise. Request that the AG's office define a tiered compliance pathway — perhaps a streamlined self-attestation process for firms under 25 employees instead of a full impact assessment.

Sample language: "The proposed rules do not distinguish between a small professional services firm deploying off-the-shelf AI tools and an enterprise deploying proprietary algorithmic systems. Firms with fewer than [25/50] employees should be subject to a simplified compliance pathway, including a standard self-attestation in lieu of a full impact assessment."

2. Clarify "deployer" obligations for firms using third-party AI.

The rules assign compliance obligations to "deployers" — firms using AI tools — as well as "developers" — firms building them. A 12-person law firm using a vendor's AI intake tool should not bear the same documentation burden as the vendor that built it. Request explicit language clarifying that deployers using AI tools from ADMT-compliant vendors satisfy documentation requirements through vendor certification.

Sample language: "Deployers using AI systems from developers who have completed ADMT compliance documentation should be permitted to satisfy their own documentation obligations through vendor-provided certification. The current draft's deployer requirements create duplicative compliance burdens for small firms purchasing compliant third-party tools."

3. Narrow the definition of "consequential decision" for internal workflow AI.

The current draft's definition may capture internal workflow automation — AI-assisted scheduling, document review, or administrative triage — that does not directly affect a client's access to services or legal, financial, or employment outcomes. Request language that excludes internal process automation from the consequential decision definition when the AI output is reviewed by a professional before any client-facing action.

Sample language: "AI tools used for internal workflow automation — document drafting, scheduling, administrative triage — where all outputs are reviewed by a licensed professional before any client-facing action should be excluded from the 'consequential decision' definition. The current language's breadth would capture routine AI-assisted professional tools that pose minimal risk of harm."

---

How to Submit (5 Minutes)

1. Go to coag.gov/ai — the Colorado Attorney General's AI rulemaking page.
2. Find the public comment portal for the ADMT proposed rules.
3. Enter your name, firm name, and firm type.
4. Submit 1–3 paragraphs. You can use any or all of the sample language above. Adapt it to your specific firm — concrete operational examples from your actual practice carry more weight than generic objections.

That's it. Comments do not need to be comprehensive. Identifying the specific operational impact on your firm — "we use [tool] for [decision type], and the notification requirement would require us to [specific operational change]" — is exactly what regulators need from small businesses.

---

What Happens If You Don't Act

The January 1, 2027 effective date is firm, regardless of whether the rulemaking process resolves every outstanding concern. Firms using AI in any of the covered decision categories will need compliance infrastructure in place by then.

If the rules finalize without a meaningful small-business exemption, every firm in scope faces:

• A notification requirement for each AI-influenced client decision
• A written opt-out mechanism
• An annual impact assessment for each covered AI system
• Documentation that can withstand regulatory review

That compliance infrastructure is buildable. But it's significantly more expensive to build if the rules are written for enterprises, not small professional services firms.

The October 5 comment deadline is the last point at which small firms have meaningful leverage over what that infrastructure needs to look like. Three paragraphs, submitted by Sunday night.

---

Colorado's broader compliance requirements take effect January 1, 2027. For a full walkthrough of what professional services firms must do before that date, see Colorado ADMT Compliance: What Professional Services Firms Must Do Before January 1, 2027.