I wrote last month that Colorado's rewritten AI law has a line with your name on it. Among the decisions it covers are public benefits, "including eligibility and renewal determinations." Not only whether you get in. Whether you stay in.
That piece also admitted what it couldn't settle. The law's duties fall on a "deployer," meaning "a person doing business in Colorado" — an odd description of a county office. So it told you to "Ask the question nobody has answered: does 'person' include a county?" And it warned: "If the rulemaking does not close that gap, nothing will."
The question did reach the state. The Colorado Department of Law, the Attorney General's office, says it "received several comments asking for clarification as to whether the ADMT Act applies to governments." (ADMT is automated decision-making technology; the law is Senate Bill 26-189.) On October 6 it answered, in a cover page released with its draft rules: "the ADMT Law does not apply to governments." Then the consolation prize: "However, the DOL would encourage governments to comply with the ADMT Act to the extent they provide essential government services such as Medicaid."
So I owe you an admission. I framed the choice as the rulemaking closing that gap or nothing closing it. There was a third possibility, and it's the one that arrived: an answer that sits beside the rules rather than in them, tells governments they're out, and binds no one. As the September piece said of the August drafts, "These are proposals; they bind nobody." That goes double for a cover page.
What the Department said, and where it said it
The Department released an interim draft of its rules on October 6, and the 75-page draft never says whether governments are covered. The answer lives only in the cover page, which rests it on two definitions, "Deployer" and "Person," and which says plainly that "the interim rules are not final."
So what do those definitions say? SB 26-189, which Gov. Jared Polis signed in May, puts its duties on a deployer, "a person doing business in Colorado." Only the Attorney General enforces it, under the Colorado Consumer Protection Act, which defines "person" as "an individual, a corporation, a business trust, an estate, a trust, a partnership, an unincorporated association ... or any other legal or commercial entity." No government appears on the list. (Whether a county squeezes into "any other legal or commercial entity" is precisely the legal question.)
Now set that beside who decides your benefits. Colorado's 64 county human services departments decide Medicaid eligibility as "agents of the state," and each is "responsible for determining eligibility" for food assistance, too. Federal rules require a public agency to make the call: Medicaid eligibility may be delegated "only to a government agency" with merit-system staff, and under the food-assistance rules, "Volunteers and other non-State agency employees shall not conduct certification interviews or certify SNAP applicants." For Medicaid and SNAP, the decision itself stays in government hands.
So who is left inside the law? Maybe the contractors. The state contracts with a private vendor to operate the Colorado Benefits Management System, "the technology platform that counties use to determine eligibility for various public benefits," in the words of the Colorado Center on Law and Policy, a legal-aid policy group. But the statute's duties for developers run "to each deployer," and the interim rules say that when a third party runs the software for a deployer that makes the decision, the deployer stays "responsible for fulfilling all Deployer obligations." If the county isn't a deployer, does the vendor owe anything to anyone? Neither document says. Treat it as a question for the comment period.
Medicaid also sits near a second door. The statute's core sections "do not apply to a covered entity" under HIPAA, the federal health-privacy law, whose rules count "the Medicaid program" as a health plan, and Colorado's Medicaid agency calls itself "a health plan and therefore a covered entity." (It also says the counties doing eligibility work are not its business associates.) The cover page's Medicaid example mentions none of this.
One October change reaches every deployer. The August draft required a disclosure to describe "the principal reason(s) for the Adverse Outcome" and, where a score was among those reasons, said it "shall disclose the Consumer's score." The interim draft would drop both in favor of a specific description of the software's role.
Then why was the state budgeting to comply?
The Department's reading would be less striking if the rest of Colorado's government had shared it. Under the 2024 law, whose deployer was likewise "a person doing business in this state" and which already reached "an essential government service," it didn't.
September 2025. The governor's technology office told legislators that a list of state AI systems covered by that law "does not exist" because the law was unclear, so it was reading the scope broadly "to ensure compliance."
December 2025. The office asked for $5.2 million "on behalf of all state agencies" to comply. The departments listed included Health Care Policy and Financing, Human Services and (yes) Law.
March 2026. Legislative budget staff recommended denial (a recommendation, not the committee's decision) and wrote that "A fundamental divergence appears to exist" between executive and legislative readings, which staff traced to how broadly the executive read "artificial intelligence system"; in staff's account, "the sponsors understand the requirements to be much less onerous on state agencies." Less onerous, not inapplicable.
May 2026. The Colorado Sun reported that the new bill would require "businesses, schools and governments that use AI" to offer ways to appeal. The deployer definition never changed between the bill as introduced and the one Polis signed.
September 2026. The legislature's nonpartisan fiscal note for the new law said that "Staff in the Governor's Office may undertake additional work to ensure that covered domains across state agencies comply with the bill and rules adopted by the Department of Law."
One more line in the statute is hard to square with the cover page. For the right to correct inaccurate data, SB 26-189 switches off a Colorado Privacy Act exemption for data held by "the state, the judicial department of the state, or a county, city and county, or municipality." Why would a law that reaches no government switch off an exemption written for government data? The cover page doesn't say.
Is the Department simply reading the words right?
Quite possibly, and its case deserves a fair hearing.
The text leans its way. Even EPIC, a privacy and civil-liberties group, described the law in May as requiring disclosures for decisions "made by a company using an automated decisionmaking technology." A violation of this law is a deceptive trade practice, something a person does "in the course of the person's business, vocation, or occupation." When Colorado's legislature wants governments inside "person," it says so: in another article of the same title, "person" includes "government or governmental subdivision, agency, or instrumentality." And when Colorado wanted to regulate government AI, it did so by name; its 2022 facial-recognition law was aimed at "an agency of the state government or of a local government."
The structure leans its way, too. By statute the Attorney General is "the legal counsel and advisor" of every department and agency of state government — so enforcing this law against the state's Medicaid agency would mean pursuing his own client. (Counties aren't state agencies, but the awkwardness is real.)
And benefits applicants already have rights that ordinary consumers lack. A Medicaid notice of adverse action must give "A clear statement of the specific reasons supporting the intended action," and members of Health First Colorado (the state's Medicaid program) have "60 days from the date on your Notice of Action" to ask for a hearing. The fiscal note adds that most state eligibility systems follow rules "programmed by humans into a defined algorithm, rather than using generative AI or similar methods," so many of them may not be covered technology at all.
So far so good. What none of those rights does is tell you whether software shaped the decision, or how. That is the gap SB 26-189 fills (with a plain-language account of "the role the covered ADMT played"), and the cover page takes that account off the table for the agencies that decide benefits, on the strength of a definition the governor's office spent a budget cycle preparing those same agencies to meet.
The Netherlands started from the opposite premise
What happens when a country treats the government as the decider most in need of watching?
The Netherlands got there the hard way. In July 2020 the Dutch Data Protection Authority found that the tax administration's benefits office had "used applicants' nationality (Dutch/not Dutch) as an indicator in a system that automatically designated certain applications as risky," a practice it called "unlawful and discriminatory." Parliament's inquiry into the childcare allowance, Ongekend onrecht ("unprecedented injustice"), concluded, in its published English translation, that "for years, parents never had a chance." (Risk profiles that included nationality were outside its remit; that finding was the regulator's. The inquiry spread its own blame across the administration, the legislature and the courts.) Amnesty International reported that the official reviewing a flagged case "was given no information as to why the system had generated a higher-risk score." In January 2021 the whole government resigned over the scandal.
Then the regulator fined the government. In December 2021 it announced a €2.75 million fine on the tax administration (formally, on the Minister of Finance), and its chair, Aleid Wolfsen, explained why the state gets no pass: "Members of the public don't have a choice; they are forced to allow the government to process their personal data." That is the case for writing governments into a benefits law, in one sentence. You can shop around for a lender. You can't shop around for a Medicaid office.
Afterward the Dutch built a public register in which government bodies describe the algorithms they use. It launched in 2022, says it focuses on impactful algorithms, high-risk AI included, and lists 1,590 algorithms in all as of October 13, 2026, among them an algorithm the benefits agency uses to track the parents harmed in the scandal. (HAIA looked at that register once before, from a renter's side.)
Now the fair counterpoint. The register calls itself not yet complete, and in September 2025 the state secretary in charge judged a legal duty to register "(nog) niet als opportuun" or, in English, not (yet) opportune. In March 2026, with four of its nine indicators now red, the regulator named the registration of government algorithms among its concerns, and Wolfsen said that "the follow-up is lagging behind." The benefits agency's own entry marks its impact-assessment field "Veld niet ingevuld" (field not filled in). Researchers studying early city registers warned in 2021 that such registers can become "ethics theater." And repair is slow: more than 44,000 people have been recognized as harmed in the government's recovery operation, and the cabinet still aims to have every harmed parent fully compensated by the end of 2027.
So the Dutch answer is unfinished — uneven, voluntary, still argued over. But it starts from the premise that the state is the actor to watch when it decides your benefits. Colorado's statute names those decisions, and its enforcer's cover page reads the deciders out.
The first renewal letters of 2027
What follows is my extrapolation from the documents, not a forecast about any county or contractor.
January 1, 2027, is a big day for two unrelated laws. SB 26-189 starts reaching decisions made from that day on. And under a federal law requiring Medicaid redeterminations "once every 6 months" for certain adults, Colorado says some adults 19 to 64 "will need to renew every 6 months" starting that day. Renewals begin with an automated check of data the state already holds; "If enough information is not available to show that a member is exempt, a letter will be sent."
So picture next spring. A renewal check can't confirm your exemption from the new federal work requirements, the letter asking you to show it goes unanswered, a county worker reviews the flagged file, and a notice ends your coverage. It gives reasons and 60 days to appeal. What it needn't tell you, on the cover page's reading, is whether software narrowed your file. Ask the county which system was used, and it can say this law doesn't reach it. Ask the contractor that runs the platform, and it can say its duties run to a deployer — and there isn't one.
Now picture someone down your street whose help with utility bills is cut that same week by a private program using a scoring tool. That is the interim draft's own example of a covered decision (reducing a "subsidy to make energy and utilities payments"), and under the draft your neighbor is owed a disclosure, effective date included. Same kind of cut — two answers about who has to explain it.
The rare point where left and right agree
Colorado has served as a cautionary tale before. In 2008 the legal scholar Danielle Keats Citron wrote that the state's eligibility system had issued "hundreds of thousands of incorrect Medicaid, food stamp, and welfare eligibility determinations and benefit calculations since its launch in September 2004," and that "Automated systems jeopardize due process norms." (That was the record in 2008.)
On the free-market side, R Street's Adam Thierer and the American Consumer Institute's Logan Kolas put Colorado's 2024 act on their "AI Terrible Ten" list of the worst state AI policies, yet the ALEC model legislation their paper holds up as a good starting point would "conduct an inventory of AI technology use by state agencies." Amnesty, from the other direction, asks governments to "Establish effective monitoring and oversight mechanisms for algorithmic systems in the public sector." They disagree about nearly everything a business should owe you; on this they line up — the state should at least be able to say what software it runs.
What does this mean for you?
If you live in Colorado, comment by October 26. As of October 13, 2026, the Department's comment form is open through October 26, longer if the hearing runs past that day. In your own words, ask the Department to put its answer on governments into the rule text, one way or the other; to say whether a contractor running an eligibility tool for a county is a deployer; to explain the Privacy Act carve-back; and to restore the reasons and score disclosures. The form warns that submissions "may be viewable to the public," so leave out case numbers and health details.
Or say it out loud. The hearing is October 26 at 10 a.m., at 1300 Broadway, Room 1D, in Denver, and on Zoom if you register through the Department's rulemaking page. Anyone attending will be "invited to provide oral comments even if not registered in advance."
If a county or the state cuts or denies your Medicaid, you're owed the specific reasons and 60 days from the notice's date to ask for an informal meeting and a state fair hearing, whatever the AI law means. In the appeal, ask whether automated tools were used.
Ask for documents, not explanations. Colorado's open-records law makes public records "open for inspection by any person at reasonable times," with exceptions. Ask your county human services department or the state for contracts, user guides or policies on automated eligibility tools.
If you're a Medicaid adult aged 19 to 64 with income at or below 133% of the poverty line, you may be among those renewing every six months from January 1, 2027. Answer every letter fast.
Outside Colorado, read your state's AI bill for the word that names who owes you anything ("person," "deployer," "covered entity"), and ask whether a county could fit inside it.
The lesson, as I see it
A law is, in the end, a list of who has to answer to you. Colorado wrote benefit eligibility and renewals into its AI law, and its enforcer now reads that law as not reaching the only bodies federal rules allow to decide Medicaid and food assistance. The reading may be right on the text. It still leaves a covered domain whose main deciders sit outside the law, and it rests on a cover page to rules the Department itself calls not final.
What should you watch? October 26, for the comments and the hearing. The final rules, due on or before January 1, 2027, and whether they say one word about governments. The federal case: xAI, which sued over the 2024 law, alleges it amounts to "content- and viewpoint-based speech compulsion"; the Justice Department, which intervened, alleges the law "violates the Equal Protection Clause of the Fourteenth Amendment"; and the Attorney General said in a joint motion that he "does not intend to enforce" the law or its replacement until rulemaking ends. Under the resulting order, xAI must seek an injunction "within 28 days after final adoption" of the rules, and as of the docket's latest entry, on October 2, none had been filed. Then January 1, when the law and the six-month renewals start together.
My vote? Put the answer where someone can be held to it. If governments are out, let the legislature say so in the statute, in public. If they're in, let the final rule say that. And if "encourage" is to mean anything, start where even the free-market model bill starts, with an inventory of the automated tools Colorado's benefit decisions run through, and publish it. The Dutch built their register after a cabinet resigned. Colorado can build one before it needs to.
In Colorado's consumer-protection law, a trust is a person. Until October 26, you can still ask the state what your county is.