Colorado AI Compliance: What Professional Services Firms Must Do Before January 1, 2027

Published: September 11, 2026 | By: The Crossing Report

---

On August 11, 2026, Colorado's AG filed draft implementing rules for the state's Automated Decision-Making Technology (ADMT) framework — the first concrete regulatory guidance on what compliance actually looks like before the January 1, 2027 effective date.

A public hearing is scheduled for October 26. Written comments can be submitted before then. After the hearing, final rules are expected to land alongside the law on January 1.

If you're an accounting, staffing, or consulting firm operating in Colorado — or serving Colorado residents — this is the checkpoint. Here's where you stand, who must act, and the three documents that get you ready before year-end.

---

What Colorado's AI Law Now Requires

Colorado's AI compliance story is in its third chapter. The brief version:

SB 24-205 (original law): Mandatory bias audits, algorithmic impact assessments, and a June 30, 2026 compliance deadline for firms using AI in "consequential decisions" — employment, credit, housing, healthcare, education, and legal services.

SB 189, signed May 14, 2026: Governor Polis signed the replacement. The ADMT framework eliminated bias audit requirements, removed legal services from the consequential decisions list, added a 90-day cure period, and shifted full enforcement to January 1, 2030. New effective date: January 1, 2027.

August 11 draft rules: The AG's office filed implementing guidance spelling out what disclosure notices must contain, how the small business deployer exemption works in practice, and what records firms must maintain. The October 26 hearing is the public's last formal opportunity to shape the final rules before they lock.

The core requirements under SB 189 / ADMT for covered firms:

• Consumer notice — When AI materially influences a consequential decision about a Colorado resident, notify them before or at the time of that decision
• Adverse action explanation — If a consumer is negatively affected by an AI-influenced decision, explain why and which factors were used
• Human review option — Consumers must be able to request human review of any AI-influenced consequential decision
• Recordkeeping — Maintain documentation of AI tools used, their intended purpose, and how they inform decisions
• No algorithmic discrimination — AI outputs must not produce discriminatory results based on race, sex, age, disability, or national origin

---

Who Must Comply (and Who Is Exempt)

What counts as a consequential decision under SB 189:

• Employment (hiring, promotion, termination, compensation)
• Credit and lending
• Housing
• Healthcare and clinical services
• Education enrollment and evaluation
• Governmental services

Legal services were removed from this list under SB 189. That's the most significant change for professional services firms compared to the original law.

How the major firm types shake out:

Firm type	In scope?	Why
Staffing / recruiting firms	Yes	AI-assisted hiring and candidate screening are employment decisions
Accounting firms	Potentially	AI used in financial risk assessment or credit advisory for Colorado clients
Management consulting firms	Potentially	AI used in employment recommendations or financial decisions for Colorado residents
Law firms	No	Legal services explicitly excluded from consequential decisions under SB 189
Marketing agencies	Generally no	Standard work doesn't intersect covered decision categories

The small business deployer exemption: If your firm has fewer than 50 full-time equivalents and you use off-the-shelf AI tools without custom training or fine-tuning, you qualify as a "small business deployer." The exemption removes the annual algorithmic impact assessment requirement — but you still must avoid discriminatory outputs, provide consumer disclosures, and offer human review on request.

Most 5-to-50 person professional services firms using standard tools like ChatGPT, Claude, CoCounsel, or Thomson Reuters AI Drafting qualify for this exemption. If you've fine-tuned a model on your own client data, you may not — check with your vendor or counsel.

---

The October 26 Hearing — What It Means for Your Firm

The draft rules filed August 11 address several areas SB 189 left ambiguous:

• What "material" AI influence means (how significant must the AI's role be to trigger disclosure?)
• Exactly what the consumer notice must contain and when it must be delivered
• How small business deployers should structure and maintain their AI tool inventory
• What "human review" looks like for automated or semi-automated systems

If any of those definitions are consequential for how your firm operates, the October 26 hearing is your opportunity to submit comments before the rules finalize. Law firms and professional associations have been the most active commenters on Colorado AI rules — standalone firms almost never submit comments and often end up subject to interpretations written with larger companies in mind.

Written comments can be submitted through the Colorado AG's rulemaking docket before October 26. After the hearing, expect final rules in late November or early December. January 1 is a firm date.

---

Action Steps Before January 1, 2027

Whether or not you're squarely in scope, every professional services firm with Colorado-connected work should have these three documents built before December 31:

1. AI Tool Inventory

A simple list: every AI tool your firm uses, what decisions it informs, whether any of those decisions affect Colorado residents, and what vendor documentation you have on file. For most small firms, this takes two to three hours to build. It is the foundation of every other compliance document.

Start here: open a spreadsheet and list every AI subscription your firm pays for. Then note, next to each tool, whether any staff member uses it to help make a hiring, financial, or advisory decision that affects a Colorado resident or client.

2. Vendor Policy Statements

Request or locate a written statement from each AI vendor you use confirming: intended use cases, data handling practices, and known limitations. Most major vendors (Anthropic, OpenAI, Thomson Reuters, Clio, Microsoft) have this documentation available on their legal or compliance pages. For smaller tools without a published policy, a one-page written statement from the vendor is sufficient. Keep these on file with your AI inventory.

3. Client Disclosure Language for Engagement Letters

Draft a single paragraph for your standard engagement letter explaining that your firm uses AI tools in certain analyses, and that clients may request a human review of any AI-influenced recommendation. Most professional associations (state bar associations, AICPA, state CPA societies) now have guidance on what this language should include. Your AI disclosure doesn't need to be elaborate — it needs to be present, honest, and accessible.

These three documents satisfy the core transparency and recordkeeping requirements under the ADMT framework for small business deployers. Build them before October 31 so you're ready before final rules land.

---

The one thing to do this week: Pull up your firm's standard engagement letter. Find where you'd add an AI disclosure paragraph. Draft two or three sentences — don't finalize, just start. Firms that don't have a draft by mid-October are the ones scrambling in December.

---

For law firms in Colorado: you're out of scope under SB 189 — but AI use still carries professional responsibility obligations under your state bar's ethics rules. See our AI compliance guide for law firms.

For regulatory updates across all state AI laws affecting professional services firms, see our state AI compliance hub.