Revised Proposed Automated Decision-Making Technology and Conversational Artificial Intelligence Service Rules

Summary

SIFMA ¹ provided comments to the Colorado Department of Law on the revised proposed Automated Decision-Making Technology and Conversational Artificial Intelligence Service Rules, 4 CCR 904-6 (the “Revised Draft Rules”), filed with the Secretary of State on August 11, 2026 to implement the Automated Decision-Making Technology in Consequential Decisions Act, SB 26-189 (the “ADMT Act”), and the Conversational Artificial Intelligence Services Act, HB 26-1263 (the “Chatbot Safety Act”).

See related:

• Pre-Rulemaking Considerations Document for the Colorado Automated Decision-Making Technology Act
• Proposed Automated Decision-Making Technology and Conversational Artificial Intelligence Service Rules

Excerpt

SIFMA previously submitted comments on July 13, 2026, in response to the Department’s Pre-Rulemaking Considerations Document, ² and on September 3, 2026, in response to the Proposed Automated Decision-Making Technology and Conversational Artificial Intelligence Service Act Rules, 4 CCR 904-6. ³ We appreciate that the Revised Draft Rules incorporate several of SIFMA’s recommendations, and we offer and re-emphasize the comments below to identify matters that remain unresolved and should be addressed in the final rules.

SIFMA is a national trade association representing over 350 large, medium, and small broker-dealers, investment banks and asset managers, many of which have a strong presence in Colorado. In fact, almost 113,000 people in the state work in the finance and insurance industries, more than 26,700 of them work at securities firms, and 59 broker-dealer main offices call Colorado home.4

Executive Summary

SIFMA’s comments below address the following matters which remain unresolved:

• The definition of “Financial or Lending Service” should be clarified to exclude servicing, maintenance, and collections activity.
• Rule 7’s notice and disclosure requirements should be better harmonized with the ECOA and FCRA and should also be harmonized with Employee Retirement Income Security Act (“ERISA”); made less prescriptive; and paired with model notices and safe harbors.
• Rule 3.2(A)(2) should expressly confirm that compliance with the ADA and an institution’s existing digital accessibility program satisfies the Rule, rather than establishing Web Content Accessibility Guidelines (WCAG) 2.2 as a freestanding state benchmark.
• The Revised Draft Rules should accommodate centralized enterprise intake, routing, and review processes rather than product-by-product channels.
• Existing review, dispute, complaint, servicing, and regulatory processes can and should satisfy the Meaningful Human Review requirements.
• The Department should set a January 1, 2028, enforcement date to allow a reasonable transition period for good-faith compliance efforts.
• Several provisions (Rule 7.4(B)(5), (6), (8), (9); Rule 8.6(D)’s Colorado Privacy Act (“CPA”) appeal cross-reference) exceed the authority the ADMT Act grants the Department and should be removed or narrowed.
• Several provisions in Rule 8 should be further amended to promote cohesion, practicality, and statutory compliance.