Colorado’s AI Law After the October 26 Rulemaking Hearing

SB 26-189 takes effect January 1, 2027, but the Attorney General cannot bring an enforcement action over conduct that occurs until well into 2027, and possibly longer. That protection comes from a federal court order in the xAI litigation rather than from the rulemaking, and its end date depends on a ruling no one can yet schedule. The final rules are still being written. My advice to Colorado businesses is to use the time to prepare, because the obligations themselves do not move.

The rulemaking hearing was October 26, and written comments closed at 11:59 that night. As of today the rules have not been adopted, and 4 CCR 904-6 does not yet appear in the Code of Colorado Regulations. The statute requires the Attorney General to adopt them on or before January 1, and press coverage of the hearing reports that the Department expects to finish in roughly two months.

The October 26 hearing

About a dozen people testified. The Colorado Chamber, the U.S. Chamber of Commerce, the Colorado Technology Association, and Chamber of Progress, joined by several lenders and the Colorado Hospital Association, asked for a narrower reading of “materially influence,” relief from notice requirements in high-volume hiring, and either a later effective date or a first year in which good-faith compliance would be enough. Affirm told the Department that human review of every denial would mean about eleven reviews a minute at its volume. EPIC, TechEquity, and student advocates argued the opposite, that the current draft should be treated as the minimum. The Department announced nothing from the hearing.

The October 6 interim draft

The testimony was directed at a revised draft the Department released on October 6, after reviewing more than sixty comments. Several of its changes matter for a Colorado business:

• “Materially influence” now has a working definition. The August proposal offered two competing standards, and the interim draft adopts the narrower one. A software output is a “De Minimis Factor,” and outside the Act, if other relevant factors independent of the output played a significantly larger role in the decision.
• The presumption remains, but it can now be rebutted on named grounds. An output that pertains to the person, was in front of the decision-maker, and matches the outcome is still presumed to have influenced the decision. The draft now lists evidence that rebuts it, including proof that nobody consulted the output, that the decision rested on a hard cutoff applied consistently to everyone, or that someone with authority to decide independently reviewed substantial other information. The Department’s cover letter also asked what could replace the presumption altogether, so I would not assume it survives into the final rules.
• “Basic human need” has examples. In the human review rule, the interim draft names food, shelter, and required medical care.
• Outsourcing the screening does not outsource the notice. A deployer is presumed to know the sources of data a vendor uses to run a tool on its behalf.
• The adverse outcome notice got lighter, but the questions about inferences moved. The interim draft dropped the August requirements that the notice itself state the principal reasons, identify any inferences, and disclose the actual score. A person who asks for more information is still entitled to the categories of data the tool considered, including any inferences or profiles it generated about them, with sources named, and on request to their own score and inputs. A business cannot answer those requests without documentation from its vendor.
• Government is out. The Department concluded that the Act does not apply to state and local government.

On October 21 the Department also published a regulatory analysis stating that the rules “do not create additional rights or compliance obligations beyond those provided in the ADMT and Chatbot Safety Acts.” Several witnesses, the U.S. Chamber among them, argued the opposite at the hearing. The interim draft had already pulled back some of what drew that criticism, including the requirement to disclose the actual score in an adverse outcome notice. If the final rules reinstate requirements like that one, the disagreement could become a challenge that the rules exceed the statute.

The federal court order

When people say the Attorney General is holding off on enforcement, the operative document is a stipulated order entered April 27 in X.AI LLC v. Weiser, the constitutional challenge xAI brought against the 2024 law and the Department of Justice joined. The order bars the Attorney General from initiating enforcement, including opening an investigation, “for alleged violations of SB24-205 (or any legislation replacing or amending SB24-205 enacted during this legislative session) that occurred or may occur on or before 14 days after” the court rules on xAI’s motion for a preliminary injunction. SB 26-189 is that replacing legislation, so the order reaches it.

The bar turns on when the conduct occurs, not on when the Attorney General acts. A notice a business fails to send in February 2027 falls inside the covered period, and as long as the order stands, the Attorney General cannot pursue it later, even if the court eventually denies xAI’s motion. The order also binds the only party that can enforce these provisions. The statute makes the disclosure and consumer rights obligations “enforceable exclusively by the attorney general,” and there is no private right of action.

The Attorney General’s statement on enforcement

The other thing people call a hold is a policy statement. Several commenters asked for a grace period, and in the October 6 cover letter the Department answered that the laws take effect January 1, 2027, that the Attorney General’s policy “has been to focus on egregious and intentional violations of the law,” and that he “will exercise appropriate discretion in enforcement.” That describes priorities. It binds no one, and it comes from an Attorney General who is term-limited and leaves office in January. Colorado elects his successor on November 3.

When the protection ends

The court order was written around a ripeness problem. xAI’s strongest arguments are that the law is too vague to follow and that it burdens protected activity, and neither can be tested against a statute whose central term the Attorney General had not yet defined. The parties agreed to wait for the rules, and the order requires xAI to file its motion “within 28 days after final adoption of rulemaking.”

The window therefore runs through a sequence of events, and only the first is close to fixed:

1. Final adoption. For the rules to take effect January 1 as drafted, they generally have to be adopted, filed with the Secretary of State, and published in the Colorado Register at least twenty days in advance. That puts adoption in late November or early December.
2. xAI’s motion, within 28 days. That puts the filing around the turn of the year.
3. Briefing and a ruling. Briefing in this district typically takes another five weeks, and nothing requires the court to rule by a particular date on a constitutional challenge in which the United States is a co-plaintiff.
4. Fourteen more days. Enforcement exposure begins fourteen days after the ruling, and only if the motion is denied.

On any realistic version of that sequence, conduct before spring 2027 is covered. If the court grants an injunction, the window stays open until the case is decided.

Open questions

Several questions remain unresolved, and any of them could move that timeline:

• What counts as “final adoption.” The order does not say whether the clock runs from the date the Attorney General adopts the rules, the date they are filed, or the date they are published. I expect xAI to file early rather than argue the point.
• Whether xAI still has a case. Its complaint attacked the 2024 law’s duty to avoid algorithmic discrimination, and the Department of Justice intervened under its statutory right to join equal protection cases, a claim built around that duty. SB 26-189 dropped the duty. What remains for a model developer is largely disclosure to the businesses that deploy its tools, and the State can reasonably argue that xAI lacks standing to challenge those provisions or that its claims are not ripe. A narrower case could mean a faster ruling and a shorter window.
• Whether the order covers the Chatbot Safety Act. HB 26-1263 is a separate bill, but it was enacted in the same session and directly amends section 6-1-1701, the definitions section at the heart of the 2024 law. That gives xAI a credible argument that the order reaches it, and the State a credible argument that a chatbot law is not what the parties had in mind. xAI operates Grok, a consumer chatbot, so I expect the question to be argued. Until it is decided, I would not treat chatbot obligations as paused.
• A new Attorney General. Whoever takes office in January inherits the final rules, the litigation, and the stipulation. The court can modify a stipulated order. I have no reason to expect that, but the protection lasts only as long as the order does.
• Congress. Federal preemption of state AI laws has been proposed repeatedly and has not passed. Nothing in Washington changes the January 1 effective date today.

Preparing for January 1

The law takes effect on January 1 whether or not anyone can enforce it, and the window could close sooner than the sequence above suggests. With this in mind, I would use the time to prepare rather than to wait:

• Finish the inventory. List every tool that scores, ranks, screens, or classifies people in a covered decision. The interim definition of “materially influence” is concrete enough to sort each one, and the SB 26-189 compliance checklist walks through the coverage test.
• Document why borderline tools fall outside the Act. If you rely on a hard cutoff applied to everyone, or on a reviewer who independently weighs other information, write that down now. Those are the rebuttal facts the draft names, and they carry far more weight when the record of them predates a complaint.
• Get your vendors’ answers in writing. You are presumed to know your vendor’s data sources, and if someone asks, you will need to describe the inferences the tool drew about them. Contract amendments take longer than anyone plans for.
• Name your human reviewer. This remains the obligation most businesses cannot assemble on short notice.
• Watch for the final rules. When they are published, the 28-day clock starts, and I will update this page.

None of this work is wasted if the court enjoins the law or the final rules change. The inventory, the documentation, the vendor terms, and the reviewer are what any version of these rules will ask for. If you are not sure whether a tool in your business is covered, start with the coverage question, or see how I handle AI governance and compliance work. I would welcome the chance to work through it with you.