Colorado’s interim redline rules for the Automated Decision-Making Technology Act lay out the most detailed framework yet for holding AI agent builders and deployers accountable.
Released by the Colorado Department of Law on October 6, the draft fills a gap that federal agencies have left open.
A formal rulemaking hearing is scheduled for October 26 in Denver, with a public comment deadline closing at 11:59 PM MST that same day.
The obligations kick in January 1, 2027.
What the interim redline requires
Under SB 26-189, any automated decision-making technology that materially influences a consequential decision about a Colorado consumer, employee, or job applicant falls within scope.
That includes autonomous AI agents operating in employment, financial services, healthcare, housing, insurance, education, government services, and legal services.
Proposed Rule 5 imposes detailed documentation duties on developers.
They must provide deployers with intended uses, training data categories, known limitations, known harmful uses, instructions for monitoring and meaningful human review, and methods to control or instruct the ADMT to mitigate risk.
Developers must also notify deployers of material updates and intentional modifications.
Deployers face a separate set of obligations that are operationally heavier.
Before a consequential decision, they must give consumers clear and conspicuous notice that a covered ADMT will materially influence the outcome.
After an adverse outcome, they have 30 days to disclose via two communication methods: a plain-language description of the decision and the ADMT’s role, the principal reasons for the outcome, the ADMT’s name, version, developer, and the categories of personal data used.
Deployers must also tell consumers how to request additional information and human review.
The human review requirement is the framework’s sharpest tool.
Deployers must complete a meaningful review within 45 days of the consumer’s request.
The reviewer must be independent, possess relevant expertise, and hold genuine authority to override the ADMT’s decision.
Critically, the ADMT itself may not assist in the review, a provision that closes the loop on AI-supervising-AI arrangements.
Enforcement with teeth
The Colorado Attorney General holds exclusive enforcement authority.
A 60-day cure period applies to actions initiated before January 1, 2030, giving covered entities a defined window to remedy violations.
The rules also void contractual indemnification for an entity’s own ADMT-related anti-discrimination violations as against public policy, a provision that prevents companies from shifting liability downstream.
Federal gap
Colorado’s state-level action arrives as federal enforcement remains fragmented.
Bloomberg Law reported in October that Attorney General Todd Blanche signaled in September that the DOJ will not pursue standalone AI enforcement through prosecution, a posture consistent with the hands-off approach described in a Bloomberg Law analysis tracing DOJ policy to an April 2025 crypto memorandum.
Federal legislative efforts remain stalled: the Warner AI AGENT Act (S. 5051), introduced July 21, has not received markup, and the Hawley-Murphy AI Agent Accountability Act, announced October 1, has not advanced to committee action.
The result is a regulatory vacuum at the federal level that state frameworks like Colorado’s are filling by default.
Open questions
The Colorado AG is soliciting public input on three open questions: the precise definition of the material influence standard, how obligations apply when a deployer relies on a third-party vendor to operate covered ADMT, and additional developer-obligation clarifications.
These questions will shape the final rules and determine how broadly the framework reaches into agent supply chains.
What to watch
The October 26 hearing will set the trajectory for the final rules.
The January 1, 2027, effective date is statutory and cannot be moved by rulemaking alone.
Agent builders operating in or selling into Colorado face a choice: begin mapping agent decision chains to the interim redline’s documentation and disclosure requirements now, or scramble to comply after the rules take effect.
The first enforceable agent-liability framework in the United States is no longer hypothetical.