What Counts as Meaningful Human Review of an AI Decision?

What does Colorado law say meaningful human review is?

The Colorado ADMT Act (SB 26-189) defines meaningful human review as review by an "individual designated by the deployer who has authority to approve, modify, or override a consequential decision" and who meets four conditions (C.R.S. § 6-1-1701(15)). The reviewer:

1. "considers relevant, available primary evidence";
2. "is trained to conduct the review";
3. "does not default to the system output"; and
4. "has access to sufficient information to understand" the output's intended use, material limitations, and categories of inputs, plus "the principal factors used to generate the output," without requiring disclosure of proprietary source code, model weights, or other trade secrets.

The definition matters because of the consumer right that uses it. When a consumer experiences an adverse outcome from a consequential decision that covered ADMT materially influenced, the deployer must provide, on request, instructions for accessing and correcting personal data and "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable" (§ 6-1-1705(1)(a)(II)). These duties apply to consequential decisions made on or after January 1, 2027, and the Attorney General must adopt rules implementing § 6-1-1705 by that date (§ 6-1-1705(3)).

What would proposed Rule 7.7 add?

Proposed Rule 7.7 in the AG's draft rules (4 CCR 904-6, filed August 11, 2026) would turn the definition into operating requirements. These rules are proposed, not final. Written comments run through October 26, 2026, and the AG said it would post any pre-hearing changes by September 23, 2026, so check coag.gov/ai for the current text. As drafted, Rule 7.7 would provide:

• Independence: review "must be conducted by an independent reviewer who did not make the original decision and who is not a subordinate of the original decision-maker, whenever feasible."
• Subject-matter depth and training: the reviewer's understanding must be commensurate with the consequences of the adverse outcome, and training must cover accuracy and objectivity, the information the ADMT considers, and the subject matter.
• Authority without steering: the reviewer "must not be subject to steering by the upper management that would influence the reviewer's decision," and must be shielded from retaliation.
• No AI in the review: "ADMT may not assist in the Meaningful Human Review."
• Outcome-changing: a meaningful review is "one that could change the Adverse Outcome"; depending on the request, that may mean fixing and re-running the system or weighing new evidence the consumer provides.
• Commercial reasonableness: seven factors weighed together, including magnitude and reversibility of harm, "The Deployer's size and capacity," marginal cost, and availability of qualified reviewers. Review is presumed commercially reasonable when the harm is "a severe and irreversible denial of a basic human need," and the deployer bears the burden of proving otherwise with specific evidence.
• Response and timing: confirm receipt within 10 days, complete the review within 45 days, stay the adverse outcome where possible, and give reasons that are "specific to the evidence provided, and not a recitation of the ADMT's general logic."
• Documentation: a record of the reviewer's identity, authority, and training; timestamps; evidence considered; the reviewer's access to the ADMT's intended use, limitations, inputs, and principal factors; the result; and a written justification.

What is the difference between a rubber stamp and a meaningful review?

A rubber stamp is a human who looks at the AI's answer and signs it; a meaningful review is one where the human could, and sometimes does, reach a different result from the evidence. The table below contrasts the two, drawing on § 6-1-1701(15) and proposed Rule 7.7.

How can a small or solo business approach reviewer independence?

Start by writing down why a fully independent reviewer is or is not feasible, then compensate with process. The statute has no small-business exemption, and proposed Rule 7.7 asks for independence only "whenever feasible" while listing the deployer's size and capacity and the availability of qualified reviewers as factors. A three-person property manager or a solo lender may have no one who is both qualified and outside the original decision. The steps below are practical governance habits, not a legal safe harbor, and nothing here guarantees compliance; talk to counsel about your situation.

1. Document the constraint. Record who is available to review, why each is or is not independent, and what you considered, such as a partner, a trusted outside professional under a confidentiality agreement, or a peer business.
2. Review primary evidence de novo. Put the AI output aside and work from the application, the records, and the consumer's submission as if deciding fresh. Proposed Rule 7.7's own example describes reviewing "the Consumer's primary evidence De Novo" when the tool cannot be corrected.
3. Keep AI out of the review. Do not ask the same tool, or a chatbot, to re-check the decision.
4. Record your reasoning. Write reasons specific to the evidence, including what would have changed your mind. A later reader should be able to see that the outcome was open.
5. Separate in time if not in person. If the same person must review, do it as a distinct step on a later day, using the checklist below, not in the same sitting as the original decision.

What should a human review record include?

A one-page record per review is enough for most small deployers. The fields below track § 6-1-1701(15) and the documentation list in proposed Rule 7.7. Keep each record for at least three years after the consequential decision, the deployer record-keeping period in § 6-1-1703.

Which FAIIR controls cover human review?

Three controls in the FAIIR framework line up with this work. F5 — Human-in-the-Loop Defined requires a written rule for where a human reviews before output is acted on. A2 — AI Decision Log requires a log of material AI-involved decisions, who reviewed them, and the outcome; the template above can serve as its entries. U5 — Opt-Out Available requires a practical path for a customer to request human handling. For the full list of deployer duties, see the Colorado ADMT Act compliance checklist, and for building the rest of the program, see an AI governance framework for small businesses.

Where FAIIR fits

FAIIR, LLC publishes the FAIIR standard, 41 pass/fail controls benchmarked to the NIST AI Risk Management Framework, and certifies an organization's practices around the AI it uses. Colorado law does not require, create, or recognize any third-party AI certification; a FAIIR certification is documented proof of reasonable care, not a guarantee of compliance. FAIIR, LLC is not a law firm and this post is not legal advice.

This article is general information from FAIIR, LLC, which is not a law firm, and is not legal advice. Colorado law does not require or recognize any third-party AI certification, and FAIIR certification is not a government approval or a guarantee of compliance. For advice about your situation, consult a licensed attorney.