A hiring manager reviews an automated ranking of candidates, reads the underlying records, conducts interviews, and selects the top-ranked applicant. A person made the final choice. Did the automated system materially influence it?
Colorado’s October 6 interim draft rules use hiring examples to examine that question. They propose a presumption of material influence in specified circumstances, even where a human participates. Evidence of independent judgment can rebut the presumption. Human involvement alone does not settle the issue.
The same proposal asks a second question: if someone challenges an adverse outcome, what must a human reviewer actually do?
Together, these provisions would make organizations account for what their people examined, understood, and had authority to change. A human signature would be only the beginning of the inquiry.
Colorado Is Writing Rules for a Revised Law
The proposal implements legislation already enacted. In May, Senate Bill 26-189 replaced Colorado’s earlier AI provisions with a framework for automated decision-making technology, or ADMT, in consequential decisions. Those decisions concern access to or eligibility for opportunities and services such as employment, education, housing, credit, insurance, healthcare, and essential government services.
The law addresses developers that supply covered technology and deployers that use it. It requires documentation and notices and establishes consumer rights. Coverage depends on the statutory definitions and exemptions.
The Attorney General filed proposed rules August 11 and released the interim revision October 6. The current rulemaking docket schedules a hearing and written comments for October 26. The new statutory requirements begin January 1, 2027. The proposed rules are not yet final, and the rule numbers used here follow the October 6 draft.
The rulemaking also implements Colorado’s chatbot legislation. That branch addresses a different set of risks, including users mistaking a service for a person and safeguards for minors.
A Recommendation Can Shape a Decision Before Anyone Signs It
An automated system does not need to issue the final decision to affect the result. It can screen out candidates, limit the options a reviewer sees, or supply a ranking that shapes where the reviewer begins.
Proposed Rule 6 would presume material influence when an output constrains options, sets a threshold, or supplies an individual-specific rank, score, classification, recommendation, prediction, or other inference that meets specified conditions. The output must be reviewed or used to screen available information before or during the decision process, and be consistent with the outcome.
The presumption can be rebutted. The draft identifies evidence that the output was not consulted or incorporated, that a consistently applied cutoff determined the outcome, or that the decision-maker independently analyzed substantial relevant information. For that last route, the person must have the understanding and authority needed to decide on the independent evidence. A different outcome from the automated recommendation or other persuasive contemporaneous evidence can also matter.
The draft’s hiring examples make the distinction concrete. Reading records and conducting interviews does not automatically establish that the ranking was insignificant. The inquiry remains whether the other evidence and the manager’s judgment explain the decision independently of the output.
This is a test of legal coverage. It does not require every original decision to follow a universal human-review procedure.
Challenging the Decision Creates a Different Obligation
The second inquiry concerns an adverse outcome that a consumer asks to have reviewed. Proposed Rule 8.7 develops the statutory right to meaningful human review and reconsideration, qualified by commercial reasonableness.
Here, the draft examines the person doing the review. The reviewer would need actual authority to approve, modify, or override the consequential decision. Their subject-matter understanding must be commensurate with the issue and its negative consequences. Training would address accurate and objective decisions, the information considered by the system, and the underlying subject.
Authority must also be usable. The proposal says reviewers must not be subject to management steering that influences their decisions and must be shielded from potential retaliation.
The October revision permits internal or external reviewers. It removes an earlier categorical requirement that the reviewer be independent and not have made the original decision. For contracted external reviewers, it addresses contractual insulation of individual review decisions and the deployer’s continuing accountability.
The proposed protection therefore depends on the reviewer’s capabilities and freedom to act, rather than simply their organizational location.
The Review Must Address What Went Wrong
A review of whether software operated as designed is different from a review of whether the decision accounted for the right evidence.
The draft illustrates this with a housing example. A system relies on recorded lease violations, but some allegations were investigated and the tenant was cleared. The missing context matters. Reviewing the system alone would not supply the information needed to reconsider the result.
The proposal distinguishes incomplete or inappropriate information from technical malfunction. Depending on the problem, meaningful review could involve primary evidence and additional information from the consumer, or investigation and correction of a technical failure followed by re-performing the decision process.
The draft also draws a technology boundary. ADMT could not assist the meaningful human review. Tools excluded from the ADMT definition, including those used solely for specified administrative functions such as organizing or translating information, could assist it.
The purpose is to create an opportunity to reconsider the outcome. A meaningful review can confirm a decision. Reversal is not its only possible result.
The Organization Must Be Able to Explain the Review
The proposed response to the consumer would identify the outcome, the kind of review performed, the factors considered, and the reasons for confirming or overriding the decision. Those reasons must be specific to the evidence, rather than a recitation of the system’s general logic.
Records would identify the reviewer, their authority and training, timestamps, available primary evidence, access to information about the system, and the justification for the decision. The draft proposes acknowledging the request within 10 days, and completing review and responding within 45 days.
Commercial reasonableness remains a qualification. The draft weighs the type of review, magnitude and reversibility of harm, value of available primary evidence, organizational capacity, and reviewer availability. The deployer would bear the burden of showing with specific evidence why review was not commercially reasonable.
The October revision deletes an earlier presumption that a severe and irreversible denial of a basic human need automatically makes review commercially reasonable. The potential harm remains part of the assessment. It also deletes a provision that would have stayed an adverse outcome pending review where possible. The outcome would stand while the review proceeds, which affects what a later reversal can repair.
Human Review Depends on the Surrounding Controls
The proposal is broader than these two tests. Its ADMT provisions address clear consumer communications, responsibilities across vendors and integrators, developer information about intended uses and limitations, adverse-outcome explanations, access and correction procedures, authentication, and coordination with existing legal processes.
These provisions support the review. A person cannot examine relevant evidence if the organization cannot obtain it. A reviewer cannot evaluate an unfamiliar system’s limitations without usable developer information. A consumer cannot challenge an error they have no practical way to discover or correct.
The chatbot provisions separately address coverage exclusions, age assurance, AI disclosures, minor protections, professional-service representations, and annual reporting. Reporting would examine safeguards through testing, monitoring, performance metrics, and supporting records. The draft also incorporates external standards.
The entire proposal must be read with its statutory exemptions and sector-specific provisions. Its principles can inform governance elsewhere without making every Colorado obligation applicable to every organization.
