There is a sentence inside Colorado's interim redline, released by the Department of Law on October 6, that most coverage has walked straight past. It sits in the human review provision: the ADMT itself may not assist in the review of its own decision.
The model cannot sit in the room while a human decides whether the model was right.
I spent six weeks in 2017 reverse-engineering a bonding curve before it had a token, and the lesson from that sprint is the one I'd hand anyone reading this draft: the clause that changes behavior is never in the summary. It's the one that forces you to rebuild a pipeline.
This clause forces a rebuild. Most agent stacks shipping today run an actor model plus a critic model — a second LLM scoring the first one's output, escalating only when the score drops. That pattern is now presumptively non-compliant for any automated decision-making technology that materially influences a consequential decision about a Colorado consumer, employee, or job applicant. Not discouraged. Non-compliant.
That is the article. Everything below is mechanics.
The vehicle is SB 26-189, and the draft implementing rules land with a formal hearing in Denver on October 26 — public comment closes at 11:59 PM MST that same day. The obligations themselves do not bite until January 1, 2027, and that date is statutory. Rulemaking cannot move it.
Scope is broad by design. Employment, financial services, healthcare, housing, insurance, education, government services, legal services. If a system materially influences a consequential decision in any of those lanes, it is in.
Proposed Rule 5 splits duties across two roles, and the split matters more than the substance.
Developers owe documentation to deployers: intended uses, training data categories, known limitations, known harmful uses, monitoring instructions, meaningful human review instructions, and methods to instruct or control the ADMT to mitigate risk. Material updates and intentional modifications must be pushed downstream.
Deployers owe the operational work. Pre-decision notice that a covered ADMT will materially influence the outcome, clear and conspicuous. Post-adverse-outcome disclosure within 30 days, through two communication channels, in plain language: what the decision was, the ADMT's role, the principal reasons, the system's name and version, the developer, and the categories of personal data used. Then instructions on requesting more information and human review.
The review must complete within 45 days of request. The reviewer must be independent, must hold relevant expertise, and must carry genuine authority to override the machine.
Enforcement sits exclusively with the Colorado Attorney General. A 60-day cure period applies to actions initiated before January 1, 2030. And the rules void contractual indemnification for an entity's own ADMT-related anti-discrimination violations as against public policy.
The federal side is empty. Bloomberg Law reported that Attorney General Todd Blanche signaled in September that DOJ will not pursue standalone AI enforcement through prosecution — a posture tracing back to the April 2025 crypto memorandum. The Warner AI AGENT Act, S. 5051, introduced July 21, has not been marked up. The Hawley-Murphy AI Agent Accountability Act, announced October 1, has not reached committee. States are filling the vacuum by default because nobody else showed up.
Here is what the draft actually is, once you strip the framing.
It is a logging mandate wearing a disclosure costume.
Consider what "the principal reasons for the outcome" requires in practice. You cannot produce principal reasons from a system you cannot replay. You cannot replay a system whose sampling temperature is non-zero, whose retrieval set shifts with the index, and whose tool calls depend on a live API response. Most production agent stacks today cannot answer "why did the agent deny this application on March 3" with anything better than a plausible reconstruction.
That is the real cost. Not the notice. Not the 30-day clock. The cost is that the redline quietly demands deterministic, versioned, attributable inference — and the industry has spent three years building the opposite.
I have watched this failure mode before. In 2020 I ran high-frequency arbitrage between Curve and Uniswap and learned that impermanent loss is not a number you estimate after the fact. It is a property of the position you either modeled in advance or didn't. Replay is that same kind of property. Either your stack reconstructs a decision, or it doesn't, and no documentation written afterward fixes it.
The second move in the draft is harder to see and more consequential. It splits liability along the supply chain — developer upstream, deployer downstream — then severs the pipe that normally carries risk back up.
That indemnification void is the sharpest provision in the document, sharper than the review clause. In crypto, the standard defense for a decade has been: we shipped the primitive, somebody else deployed it, take it up with them. The rulebook says no. You cannot contract away your own discrimination liability. The "we're just infrastructure" answer is unavailable in Colorado after 2027.
Volatility is just interest for the impatient. Regulatory scope is the same instrument with a longer tenor. The boundary that matters is "consequential decision about a consumer." An agent that prices an insurance policy, underwrites a loan, screens a résumé, or sets a housing eligibility score sits squarely inside. An agent that manages its own book, routes its own orders, or rebalances a treasury is not making a consequential decision about a consumer. It is making one about capital.
That is the arbitrage surface, and it is enormous. The rule does not regulate autonomy. It regulates the exact point where autonomy touches a person's access to money, housing, health, or work. Build the agent that touches markets, not the agent that touches credit files, and the documentation burden drops by an order of magnitude.
Liquidity is a river, not a pond. Capital will not leave the jurisdiction; it will route around the specific chokepoint — and the chokepoint here is the decision, not the model.
Now the part nobody wants to price. The "material influence" standard is undefined. The AG is soliciting input on it, alongside two other open questions: how obligations apply when a deployer relies on a third-party vendor to operate covered ADMT, and what additional developer clarifications are needed.
Read those three questions as a counterparty risk checklist, because that is what they are. An undefined standard is not a drafting failure. It is discretion held by the enforcing party, and discretion is a position you are short. Anyone claiming to know how far "material influence" will reach is selling something.
The third-party vendor question is the one I would watch hardest. Agent supply chains are already multi-layered: model provider, orchestration layer, tool provider, data vendor, deployer. If the AG lands on a rule pushing deployer obligations onto vendors who operate the stack, the compliance surface expands from a few hundred regulated entities to thousands of infrastructure providers who never considered themselves regulated.
The 60-day cure period through 2030 is the other thing worth modeling. On paper it looks like a soft landing. In practice, a cure period cures the enforcement action, not the record. Adverse-outcome disclosures are discoverable. A cured violation is still a documented violation, and the private-litigation tail does not read the AG's calendar.
The consensus read is that this is an AI story. It isn't. It's a data-governance story wearing AI vocabulary, and the winners will be the teams that already treat model versions, prompts, retrieval sets, and tool calls as signed, immutable artifacts.
The second consensus read — that on-chain deployment puts you outside the rule — fails on the mechanics. The rule reaches deployers, and a deployer is a person or entity doing business in Colorado. The chain is a settlement layer, not a jurisdictional shield. If a Colorado lender runs an underwriting agent whose inference happens off-chain and whose output settles on-chain, the lender is the deployer and the on-chain step is irrelevant to the obligation.
Hype is a lever; capital is the fulcrum. The hype here is "AI regulation has arrived." The capital is in the boring middle: audit logs, model registries, inference attestation, and a human reviewer holding an actual override key who is not another model.
You don't get to call the critic model a human. That's the whole rule.
The October 26 hearing sets the trajectory, and January 1, 2027 is fixed regardless of what happens in that room. The question worth carrying forward is not whether Colorado's framework is too broad. It is whether the third-party vendor provision drags deployer duties down into the infrastructure layer — because if it does, the compliance product becomes the product, and the builders who mapped their decision chains in 2026 will be selling to the ones who didn't.
