The Challenge
Colorado's Department of Law is drafting rules to implement the Automated Decision-Making Technology Act (ADMT Act) and the Chatbot Safety Act. EPIC, the Consumer Federation of America (CFA), and Fairplay have submitted comments, with EPIC Counsel Kara Williams testifying at a public hearing. Their assessment of the ADMT rules was mixed. While the proposed text aims to reduce harms from automated tools in critical decisions, they highlighted provisions that allow deployers to avoid responsibility.
Two main issues arise. First, draft rules permit deployers to shift blame to developers or third parties when problems occur. Second, there's a heavy reliance on "commercial reasonableness" and "technical feasibility," which Williams argued would let deployers evade responsibility for harm.
If you're involved in AI governance, this is a familiar issue. A rule can appear strict but be ineffective if obligations are subject to what the regulated party deems reasonable or feasible.
The Environment and Constraints
Rulemaking is challenging. Regulators must create standards that apply across industries, company sizes, and technology stacks. Terms like "commercially reasonable" help avoid locking a rule to one specific setup. This is a valid goal.
The relationship between deployers and developers adds complexity. Most deployers don't build the models they use; they buy or license them, relying on developers for documentation and testing. Ignoring this dependency would be impractical, but leaning on it too heavily allows deployers to deflect responsibility upstream.
The Chatbot Safety Act introduces another layer. Age assurance is often a prerequisite for safety or privacy measures to protect minors. This process must balance privacy, security, and trust. Verifying age usually requires collecting more data, potentially creating privacy risks.
The Approach Taken
The commenters didn't oppose the rules outright. They engaged with the process through written comments, live testimony, and targeted objections to specific provisions. Their strategy involved three key actions:
Identify the Escape Hatches. Instead of rejecting the framework, they pinpointed where accountability could fail. Blame-shifting provisions and reasonableness and feasibility qualifiers were targeted because they determine who holds responsibility.
Link Transparency to Action. Williams argued that Coloradans deserve actionable transparency and clear accountability steps when ADMTs cause harm. Mere disclosure isn't enough. A notice about an automated tool, without a way to challenge the outcome, is transparency without accountability.
Recognize Rulemaking Limits. For the chatbot law, the commenters argued that rulemaking alone can't fix its weaknesses and urged the Colorado General Assembly to revisit the statute. Understanding an agency's limitations is a strategic decision.
Results and Metrics
The rulemaking process was ongoing when these comments were filed, so there's no final rule text or measurable outcome yet. However, the quality of the argument provides valuable insights for practitioners.
What They Would Do Differently
Without a retrospective, consider this an analysis of where the drafting is most vulnerable. The gap between a loophole and a workable standard lies in definition. A few drafting strategies could narrow that gap.
Anchor "Commercial Reasonableness" to Objective Criteria. A standard based on the deployer's judgment of cost or convenience is hard to audit. Tie it to reference points like risk management processes aligned with ISO/IEC 23894 or the NIST AI RMF, so claims can be tested.
Make "Technical Feasibility" a Deployer's Responsibility. If a deployer claims a safeguard isn't feasible, require written evidence: what was tried, what failed, and what compensating control was applied. Feasibility claims should be exceptions, not defaults.
Prevent Blame-Shifting with Non-Delegable Duties. A deployer can rely on developer documentation, but this shouldn't eliminate its duty to validate the system for its specific context. Contract terms, validation evidence, and post-market monitoring show a deployer's due diligence.
Takeaways for Your Team
Audit Your Own Reasonableness Language. Review internal AI policies for phrases like "where feasible" and "reasonable efforts." Each is a potential weak point. Pair qualifiers with documented tests for when they apply and who approves exceptions.
Don't Treat Vendor Assurances as Liability Transfers. If your defense is "the developer told us it was fine," it won't hold up. Require developer documentation, then conduct your own validation for your use case and keep the evidence. Under ISO/IEC 42001, an AI Management System assigns roles and responsibilities within your organization; it doesn't let you outsource them.
Make Transparency Actionable. For every disclosure to affected people, consider what they can do with it. If nothing, add a route for explanation, correction, or human review. ISO/IEC TS 6254 can help with explainability objectives by audience.
Design Age Assurance with Data Minimization First. If your chatbot needs to identify minors, choose the least invasive method, limit data retention, and conduct a Data Protection Impact Assessment before launch. ISO/IEC 27701 provides a structure for privacy considerations. The goal is to balance privacy, security, and trust without sacrificing one for the others.
Participate While the Text Is Still Soft. The commenters engaged in the rulemaking process rather than waiting for the final rule. If your organization will be a deployer, your comments on feasibility and cost matter. Propose a concrete, auditable standard instead of leaving a vague one in place.
The lesson from Colorado is that accountability often fails in the qualifiers, not the main obligations. Examine them closely in both the rules you follow and the policies you create.
