Colorado’s AI Act —Attacked, Delayed, and Now Amended—Part II: What You Need to Do

In this series, we are discussing the Colorado AI Act (the “Act”) as amended and as set to take effect on January 1, 2027. In the last article, we discussed who and what the Act covered. In this article, we’ll dive into what those covered by the Act must do to comply.

The Act regulates the use of so-called “automated decision-making technology (ADMT)” – technology that we commonly refer to as AI. As discussed in Part I, the Act applies when ADMT is used to make “consequential decisions.” Those who develop, sell, license, or substantially modify the covered ADMT are referred to under the Act as “developers.” Entities who use the covered ADMT to materially influence consequential decisions are referred to as “deployers.”  And those who have their data used in making the ADMT determinations or who have decisions, judgements, or determinations made about them by the ADMT are the “consumers.”

Now that we know the players, what does the Act require or provide for each?

What Must Developers Do?

Under the Act, developers of ADMT have certain responsibilities with respect to their ADMT. Beginning on January 1, 2027, developers of ADMT used (or intended to be used) in connection with consequential decisions must make the following available to any deployers using their ADMT:

• A general statement describing the intended uses and known harmful, or inappropriate uses of the ADMT
• A description of the categories of data, including personal data, used to train their ADMT
• Known limitations of the ADMT, including known risks and circumstances where their ADMT should not be used
• Instructions for deployer’s appropriate use, monitoring, and meaningful human review where appropriate
• Information reasonably necessary for deployers of their ADMT to meet their disclosure requirements (see below) and, if information is withheld, notice to the deployer of this withholding

In addition, developers of ADMT used or intended to be used in connection with consequential decisions must provide deployers of their ADMT with notices of any material updates, intentional or substantial modifications, and “changes to the intended use of, limitations for, or risk mitigation for their ADMT within a reasonable time.” The developer must keep the records related to these notices and disclosures for at least three years.

Of note, the requirements of this section only apply if the developer’s ADMT is intended, documented, marketed, advertised, configured, or contracted to be used to make consequential decisions or when the developer becomes aware that its ADMT is being used to make consequential decisions (so long as that use is consistent with the intended and contracted-for uses). Put differently, this appears to create an exception to these requirements for developers who sell ADMT but expressly prohibit its use in connection with the making of consequential decisions.

What Must Deployers Do?

Deployers who use ADMT materially influence the making of consequential decisions and must provide consumers with certain disclosures regarding that ADMT and the decisions being made.

The deployer must provide “clear and conspicuous” notice to consumers that the deployer uses or will use ADMT in making consequential decisions affecting the consumer. The deployer must also provide instructions for how the consumer can obtain more information about that use and decisions made. This notice must be prominent and reasonably accessible where the deployer interacts with the consumer. For example, the Act provides that the deployer could meet this requirement by providing a link or posting where the information is collected to make such consequential decision or where the transaction that impacts the consumer occurs.

If the ADMT materially influences a consequential decision that results in an adverse outcome for the consumer, the deployer must provide the following notices within thirty days of making that adverse consequential decision:

• A plain language description of the consequential decision and the role the ADMT played in making that decision
• Instructions and a “simple-to-follow” process to request additional information about the ADMT used, including the name of the ADMT, its version number, the developer’s name, and the types, categories, and sources of any personal data that was used to make the decision
• Information regarding the rights consumers are provided under the Act, as described further below

Of note, the deployer’s obligation to provide additional information regarding the ADMT use is limited by what information the deployer receives from the developer about the ADMT technology in connection with an adverse decision. It is not clear what obligations a deployer would have where the developer fails to provide any of the information necessary for the deployer to meet this requirement.

Consumers and Their Rights

Under the Act, when ADMT materially influences a consequential decision resulting in an adverse outcome for a consumer, that consumer may request and deployers must provide:

• Instructions for requesting the personal data used in the consequential decision and the ability to correct any factually incorrect or materially inaccurate personal data relied upon
• An opportunity for meaningful human review and reconsideration of the consequential decision

What Comes Next: Proposed Rules

The Act also requires the Colorado Attorney General’s Office to promulgate rules to implement these requirements. On August 11, 2026, the Attorney General’s Office filed its first set of proposed rules that begin to provide additional detail regarding how developers and deployers are expected to comply with the Act. In Part III of this series, we will take a closer look at the proposed rules and what they may mean for developers and deployers preparing for the Act’s January 1, 2027, effective date.

This publication is intended for general informational purposes only and does not constitute legal advice or a solicitation to provide legal services. The information in this publication is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this information without seeking professional legal counsel. The views and opinions expressed herein represent those of the individual author only and are not necessarily the views of Clark Hill PLC. Although we attempt to ensure that postings on our website are complete, accurate, and up to date, we assume no responsibility for their completeness, accuracy, or timeliness.