Colorado’s ADMT Rules: What Megaproject Leaders Must Know Before 2027

On August 11, 2026, Colorado’s Attorney General filed proposed rules for Automated Decision-Making Technology (ADMT) and Conversational AI Services, the implementing framework for two laws already on the books: SB 26-189 and HB 26-1263. Both statutes take effect January 1, 2027. For infrastructure and construction executives who have spent the last two years pushing AI-assisted scoring, screening, and risk-ranking tools into procurement and workforce decisions, this is not a compliance footnote. It is the first detailed look at how a state regulator intends to define, document, and audit “automated decision-making” — and Colorado has a well-established pattern of being a bellwether whose consumer and technology rules get echoed by other states within a few legislative cycles.

This article breaks down what the proposed rules actually cover, where AI-assisted tools already touch “consequential decisions” on capital projects, and what a defensible governance posture looks like for organizations that build infrastructure — whether or not a single project sits in Colorado.

What Colorado’s ADMT Rules Actually Do

The proposed rules implement a regulatory structure aimed at systems that make, or are a “substantial factor” in making, consequential decisions about individuals — historically the language used for decisions touching employment, lending, housing, healthcare, and similar high-stakes personal outcomes. The rulemaking also extends to conversational AI services, reflecting growing regulatory attention to chatbots and AI-driven interaction tools that engage with consumers or workers directly.

The timeline matters as much as the substance:

• August 11, 2026 — Colorado’s Department of Law filed the initial proposed ADMT and Conversational AI Service rules.
• Around September 23, 2026 — A revised draft is expected, incorporating early feedback.
• Through October 26, 2026 — The formal public comment period remains open.
• January 1, 2027 — SB 26-189 and HB 26-1263 both take legal effect.

That gives organizations roughly three and a half months from today to weigh in on the rulemaking, and just over three and a half months after the final rules settle to have governance frameworks in place. For a sector accustomed to multi-year procurement and permitting cycles, that is a short runway.

Why “Substantial Factor” Is the Phrase to Watch

The core definitional question in ADMT-style regulation is not whether a human technically clicks “approve.” It is whether the automated system was a substantial factor in the outcome. A scoring tool that ranks vendors, flags safety incidents for escalation, or filters job applicants can meet that bar even when a person signs off at the end, if the human review is cursory or the system’s output effectively pre-determines the result. Infrastructure organizations that treat “a person approved it” as sufficient documentation are likely to find that standard tested.

Where AI-Assisted Decisions Already Live on Capital Projects

Megaproject leadership teams have adopted AI-assisted tools faster in back-office and pre-construction functions than in the field itself, which is precisely where ADMT-style rules bite hardest. Four areas deserve a hard look:

Workforce and Labor Decisions

Applicant screening, shift and crew assignment optimization, and performance-flagging tools used across large labor forces on megaprojects can constitute consequential employment decisions under an ADMT framework, even when embedded inside a broader HR or workforce management platform rather than marketed as “AI hiring software.”

Vendor and Contractor Vetting

Automated prequalification scoring, financial-health screening, and past-performance risk models used to shortlist or disqualify subcontractors and suppliers are a growing part of procurement stacks on large capital programs. These tools shape who gets to bid and who gets excluded — a decision with direct economic consequences for the businesses scored, and one regulators are likely to view as consequential in spirit even where current statutory language is anchored to individual consumers.

Insurance and Risk Underwriting Inputs

Risk-scoring outputs generated by project-side AI tools increasingly feed into insurance underwriting, bonding, and surety decisions. Where those scores influence terms offered to individuals (owners, guarantors, small subcontractor principals), the chain from project tool to consequential financial outcome can be shorter than program teams assume.

Safety Incident Triage

AI-assisted triage systems that prioritize, route, or auto-classify safety incidents can influence outcomes for the individuals involved — whether an incident is escalated, investigated, or documented in a way that affects a worker’s record. This is a category many safety and EHS teams have not yet mapped into their AI governance inventory at all.

Compliance Readiness Outside Colorado

A common and understandable reaction from executives outside Colorado is to treat this as a regional matter. That reading underestimates the pattern. Colorado’s SB 26-189 and HB 26-1263 sit within a broader wave of U.S. state-level AI accountability legislation, and state AI rules of this kind have a track record of migrating: language, definitions, and compliance expectations from one state’s AI or privacy rulemaking frequently reappear, adapted, in the next state’s bill within a year or two. Organizations that run multi-state capital programs should treat Colorado’s approach as a preview of an emerging baseline, not an isolated requirement.

A practical readiness posture, whether or not Colorado is currently in scope, includes:

Adapting Decision-Governance Frameworks Ahead of January 2027

The organizations best positioned heading into 2027 will be the ones that treat this as a decision-governance exercise rather than a legal-compliance checkbox exercise handled solely by counsel. That means extending the same documentation discipline infrastructure teams already apply to engineering and safety records — version control, audit trails, sign-off chains — to the AI systems now embedded in procurement and workforce workflows. The discipline required here closely parallels the governance rigor we’ve argued for in data and decision-system governance for digital twins on infrastructure programs: know what the system touched, know what it output, know who reviewed it, and be able to reconstruct that chain later.

Three near-term actions are worth prioritizing before the rules finalize:

• Run the inventory now. Waiting for the September 23 revised draft or the final rule before cataloguing AI-assisted decision tools wastes the comment window and leaves too little runway before January 1, 2027.
• Submit or track public comments. Organizations with multi-state exposure have a direct interest in how “substantial factor” and “consequential decision” get defined in the revised draft, since that language is likely to influence future state bills.
• Pressure-test human-in-the-loop checkpoints. A checkpoint that exists on paper but functions as a formality in practice is the single most common gap regulators and litigants target in ADMT-style frameworks.

Frequently Asked Questions

Does Colorado’s ADMT rule apply to construction companies with no Colorado projects?

Not directly under current statutory scope, which is tied to decisions affecting individuals in Colorado. However, organizations with any Colorado workforce, vendors, or project presence should evaluate applicability carefully, and multi-state organizations should treat the rule as an early signal of requirements likely to appear in other states.

What counts as a “consequential decision” on an infrastructure project?

Under ADMT-style frameworks, a consequential decision is one with significant effects on an individual — employment, financial, or similar outcomes. On capital projects, this can include hiring and workforce decisions, and potentially extends to vendor or contractor screening and risk-scoring outputs that materially affect individuals’ economic outcomes.

Is a human sign-off enough to avoid ADMT obligations?

Not necessarily. Regulatory frameworks built around a “substantial factor” standard look at whether the automated system meaningfully shaped the outcome, not merely whether a human technically approved it. A perfunctory review step is unlikely to satisfy that standard.

When do organizations need to be compliant?

SB 26-189 and HB 26-1263 both take effect January 1, 2027. The proposed rules were filed August 11, 2026, a revised draft is expected around September 23, 2026, and the public comment period runs through October 26, 2026 — giving organizations a narrow window to prepare before the effective date.

Preparing for a Regulatory Pattern, Not Just One Rule

Colorado’s ADMT rulemaking is a concrete, near-term reason for infrastructure and megaproject leadership to formalize what has often been informal: how AI-assisted tools influence decisions about people, vendors, and risk across a capital program. The specifics of the final rule will matter, but the underlying expectation — documented human oversight, traceable decision logic, and accountable governance — is unlikely to be unique to Colorado for long.

If your organization is mapping where AI-assisted tools already touch consequential decisions on your capital programs, or wants a second look at your decision-governance readiness ahead of 2027, we welcome a conversation about what a defensible framework looks like for your specific project portfolio.

Sources: Vorp Labs regulatory tracker, “Colorado ADMT Rules, California AI Bills, FTC & CMG Order”; Colorado Department of Law.