Your AI Said No. Who Can Override It? | Colorado ADMT
Imagine your rental application comes back rejected. You've packed half the house. You ask what went wrong and get: "The computer said no." Nobody can tell you whether it used the wrong income figure, or who can change the answer.
This is a hypothetical rental rejection, not a reported incident. For a founder building software that helps decide who gets a home, it is a useful test: can someone challenge the outcome and reach a person with the power to reconsider it?
January is the main start date. The rules are still proposed.
Colorado's SB26-189 was signed on May 14, 2026. The main requirements apply from January 1, 2027, to consequential decisions made on or after that date. The bill page's May 14 effective-date entry does not mean every duty became operative then. Section 5 of the enacted act separates the January start from enumerated provisions effective upon passage, including rulemaking provisions.
The Attorney General's office filed proposed rules on August 11, 2026. They are not final. Its rulemaking page gives October 26, 2026 as the final written-comment deadline, extended through the last day if the hearing continues beyond October 26. September 4 was the earlier deadline for comments considered in a revised proposed draft. That date has passed; it was not the final comment cutoff.
This does not cover every AI use
The act concerns technology that processes personal data and produces outputs used to make, guide or assist decisions about individuals. Coverage depends on whether that technology materially influences a consequential decision. Under section 6-1-1701, its output must be a non-trivial factor used in the decision and affect the outcome. Rankings, scores and recommendations can qualify; incidental or clerical uses do not.
Colorado residents are central to the scope, including resident job applicants. The consumer definition also includes employees and individuals whose access, eligibility or opportunity in Colorado is evaluated by a person doing business there. A deployer is a person doing business in Colorado that uses covered ADMT. Check those definitions against your actual users and operations, rather than treating an address flag as the answer.
Consequential decisions concern access, eligibility, selection, compensation or materially limiting terms in covered domains: education, employment, Colorado residential housing, financial or lending services, insurance, health care, and essential government services or public benefits. Exclusions include qualifying routine administration and tools that merely organize information without an inference that materially influences the outcome. Sections 6-1-1701 and 6-1-1708 also contain technology exclusions, entity exemptions and sector-specific arrangements, including conditional insurance and health-care provisions. These are not blanket exemptions for every use by those businesses.
The notice needs somewhere useful to lead
Before covered use, the deployer must provide clear, conspicuous notice; the act permits a qualifying prominent public notice accessible near the interaction. For a covered adverse outcome, section 6-1-1704(3) requires disclosure within 30 days after making the decision that results in that outcome. It must describe the decision and ADMT's role in plain language, provide a simple process for requesting additional system and input information, and explain consumer rights and how to exercise them.
Under section 6-1-1705, an affected consumer may request instructions for obtaining personal data and correcting factually incorrect or materially inaccurate personal data used in the decision. That does not require correction of opinions, predictions, scores or protected evaluations. The consumer may also request meaningful human review and reconsideration, to the extent commercially reasonable.
The reviewer needs training and authority to approve, modify or override the decision. They must consider relevant available primary evidence, understand the output's intended use, limitations, input categories and principal factors, and not default to the system's answer. That is independent assessment, not necessarily an outside reviewer: section 6-1-1701(15) describes an individual designated by the deployer.
What our housing-policy evaluation actually showed
Our separate HaltState test was one positive synthetic evaluation of an authored housing policy. The supplied request carried Colorado, material-influence, adverse-outcome and housing-operator flags. Those were test inputs, not legal classifications. The policy matched and returned APPROVAL_REQUIRED.
No housing decision happened. Nobody approved anything. The test did not perform human review, an appeal, notices, correction or reconsideration, a discrimination assessment, or a retention process. It was not a current production-runtime test and does not prove compliance.
The evidence record links the policy result to an operation and policy version. Its recorded digest verification passed. It is unsigned, hash-only evidence: a matching digest does not establish a signer's identity or prove a legally sufficient decision process.
Build and test the handoff before claiming it works
These are integration next steps, not functionality demonstrated by that evaluation:
- Map the decision path and have counsel assess coverage, exemptions and existing obligations. Do not let supplied flags substitute for that assessment.
- Connect the policy result to the real execution path. Test whether an action can proceed without required approval, and what happens when the reviewer is unavailable.
- Give a trained reviewer the evidence and authority to reconsider. Test corrected data, changed outcomes, customer notices and the route back to the customer.
- Design record keeping around the applicable duties. Section 6-1-1703 requires relevant deployer records for at least three years after the decision, longer where other law requires.
Existing discrimination, privacy and consumer-protection obligations need separate legal assessment. The act preserves other legal obligations; meeting these requirements does not excuse breaking another law. This article is not legal advice. Start by finding the person who can change the answer, then test whether your software actually lets them.