The Coverage Test: When an AI Output Becomes a Consequential Decision
Colorado's Automated Decision-Making Technology in Consequential Decisions Act does not regulate a system merely because it is marketed as AI. The legal question is narrower and more consequential: does a technology process personal data, produce a computational output, and use that output to materially influence a decision that affects a person in a covered domain? The useful test turns that sequence into a practical way to distinguish a covered use from ordinary software assistance before asking what duties follow.
Start with the output, not the product label
The statute defines automated decision-making technology, or ADMT, by what it does. It is technology that processes personal data and uses computation to generate an output—such as a prediction, recommendation, classification, ranking, score, or other information—used to make, guide, or assist a decision, judgment, or determination about an individual. The definition is functional. A system does not need to be a large language model, and a vendor does not need to use the word “algorithm,” for the definition to matter.
That first step is deliberately broad, but it is not the end of the analysis. A spreadsheet that requires manual human analysis and does not use machine learning, a foundation model, or a large language model is expressly outside the definition. So is a tool used only to summarize, organize, translate, draft, route, or present information for human review, when the system does not itself generate a score, ranking, recommendation, classification, prediction, or other inference that materially influences the result. The distinction is between helping a person handle information and generating an output that takes a meaningful role in deciding what happens to that person.
The distinction can be tested with a simple contrast. A caseworker might use software to place submitted documents into a readable order before reviewing them. That is information presentation. A system might instead assign a risk score that determines which applications receive closer scrutiny or which applicants are rejected. The latter output may be an ADMT because the computation produces a judgment-relevant signal. Whether it becomes a Covered ADMT depends on the next links: the output's effect and the decision's subject.
The diagram is a sequence, not a shortcut. A system can satisfy the definition of ADMT without satisfying the definition of Covered ADMT. Conversely, a high-stakes decision does not become covered merely because some software appeared somewhere in its workflow. The output must have a meaningful relationship to the outcome.
Material influence is the causal link
The statute uses “materially influence” to identify that relationship. An ADMT output must be a non-de-minimis factor used in making a consequential decision, and it must affect the outcome by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how the decision is made. Incidental, trivial, and clerical uses do not qualify.
This definition contains two requirements. First, the output must matter as a factor. A system that produces a score that no one sees and that has no bearing on the final decision has not materially influenced it. Second, the output must affect the result or the path to the result. A ranking that determines which applicants move forward, a classification that places a person into a benefit category, or a recommendation that a decision-maker routinely follows can alter the decision even when a human formally makes the final call.
The human's presence therefore does not automatically break the chain. Suppose a housing provider uses a system to calculate a security-deposit score and an employee reviews the result. If the score helps determine whether an applicant pays $1,500 or $2,500, the employee's review does not by itself make the score incidental. The question is whether the output materially altered the consequential decision. The answer may depend on how the review worked, what authority the employee exercised, and whether other evidence could change the result. Those facts also become important later when the consumer seeks meaningful human review.
The reverse is also true. A system can be sophisticated and still fall outside this trigger if it performs only a clerical or low-stakes function. An automated scheduling tool, customer-service triage process, or administrative routing system may process personal data and use computation, but the statute excludes routine processes that do not materially influence eligibility, selection, denial, compensation, pricing, or access in a covered domain. The technology's sophistication is not the legal threshold. Its role in the decision is.
Consequentiality comes from the effect on the person
The next question is whether the decision is consequential under the statute. A consequential decision concerns a person's access to, eligibility for, selection for, or compensation for a covered domain, or concerns differentiated price, cost sharing, compensation, or other material terms that are reasonably likely to materially limit, delay, effectively deny, or fundamentally alter that access, eligibility, or opportunity.
The covered domains are education enrollment or opportunity; employment or an employment opportunity that creates or may create an employer-employee relationship; the lease or purchase of residential real estate in Colorado; financial or lending services; insurance; health-care services; and essential government services and public benefits. The list matters because it ties the trigger to practical consequences rather than to an abstract judgment that an algorithm is important.
A housing example shows how the parts fit. A provider uses an automated system as the sole basis for setting a deposit. The system analyzes information from the applicant and decides that the applicant should pay more because the application lacks recent rental history. The output is not merely a descriptive report. It affects a material term of access to residential housing. If the system's score meaningfully determines the amount, the use may satisfy the chain from ADMT to Covered ADMT to consequential decision. The higher deposit illustrates why a material term can matter even when the person is not categorically denied access: the statute looks at whether a differentiated term can materially limit or fundamentally alter access compared with similarly situated consumers.
A credit decision provides another test. A creditor may use an automated system to decide whether to extend a loan, or to price the loan differently. If the system's output materially affects that result, the decision falls within the financial or lending domain. A system used only to organize paperwork for a human underwriter does not reach the same conclusion automatically. The relevant facts are the output, the underwriter's use of it, and its effect on the final decision.
This effect-based approach also explains why the statute excludes advertising, marketing, search, content moderation, and differentiated product recommendations from the definition of a consequential decision in the circumstances stated by the act. Those activities may have social or economic importance, but the supplied statutory framework reserves Part 17's particular duties for decisions that govern access, eligibility, selection, compensation, or materially consequential terms in the named domains.
Exclusions prevent the test from becoming limitless
Colorado's statute contains exclusions at several points in the chain. Some concern the technology itself: anti-malware, antivirus tools, databases, data storage, firewalls, networking, web hosting, and similar functions are not ADMT under the listed conditions. Some concern the task: summarizing information for human review, narrow procedural processing, and routine academic administration may be outside the consequential-decision framework when they do not generate an inference that materially influences an outcome. Others concern special activities such as cybersecurity, fraud prevention, identity verification, anti-money-laundering controls, and economic-sanctions compliance.
These exclusions are not a general permission slip. The statutory language attaches conditions to several of them, including the system's purpose and whether its output produces a prediction or inference about a consumer. A fraud-prevention system may be excluded from a particular Part 17 analysis, but that does not mean every use of the same system is outside other law. The act itself says that compliance with Part 17 does not excuse noncompliance with applicable state or federal requirements.
Intended use is especially important for natural-language systems. The statute excludes technology that communicates with consumers to provide information, referrals, recommendations, answers, or other content when it was not contracted, advertised, marketed, configured, or intended to be used in a consequential decision and is subject to an acceptable-use policy prohibiting generated content from being used in such a decision. A general-purpose assistant therefore cannot rely on a benign description if the organization has configured or marketed it for a covered decision. At the same time, a system that genuinely performs an informational function does not become covered solely because it uses conversational technology.
This is why classification should begin with the actual use and not stop with the system's capabilities. The same underlying model could summarize documents for a human reviewer in one setting, rank applicants in another, and answer billing questions in a third. The statutory analysis changes because the output, purpose, and consequence change. A system's technical identity travels less reliably than the facts of its deployment.
The Privacy Act comparison is a live boundary question
The Future of Privacy Forum's comment letter identifies a further source of uncertainty: an organization can be subject to both Colorado's ADMT Act and Colorado Privacy Act, but the two frameworks do not use identical concepts. The letter notes differences in the degree of human judgment they examine, the threshold for automation's role, the scope of covered decisions, and the timing of consumer rights. It recommends clarifying when a Covered ADMT is also regulated profiling and aligning processes where possible.
That comparison is useful, but its authority must be stated accurately. The letter is stakeholder commentary and a recommendation to the Department, not a judicial ruling or an additional statutory definition. It does, however, expose a practical problem that the statutory coverage test alone cannot settle. A system may be “human reviewed” in an organization's description while the review is too superficial to change the output. It may be covered as profiling under one law but not as a Covered ADMT under the other. Or the same consumer may receive different transparency or appeal rights depending on which trigger is applied.
The supplied materials do not resolve every overlap. They support a disciplined approach instead: identify what personal data is processed, what output is generated, how much independent judgment the system exercises, what role the output plays in the decision, how significant the effect is, and whether a statutory exclusion applies. Treat those as analytical questions, not as a substitute for the enacted definitions or a final regulatory interpretation.
The legal line is a relationship
The coverage test can now be stated without turning it into a technology checklist. A system is in the ADMT conversation when it computes from personal data to produce a decision-relevant output. It becomes a Covered ADMT when that output materially influences a consequential decision in a covered domain or materially consequential terms, after the statutory exclusions are considered. Each link matters. Remove the computational output, and there may be no ADMT. Remove the meaningful effect, and there may be no material influence. Remove the covered consequence, and Part 17 may not attach.
That structure also shows why boundary cases deserve careful facts rather than confident labels. A score used as a decisive input to a housing deposit is different from a document-organizing tool. A recommendation that changes which job applicants receive interviews is different from a routine scheduling system. An informational chatbot subject to a genuine prohibition on consequential use is different from a system configured to rank people for credit or benefits.
Once a use crosses the line, classification is only the beginning. The next problem is preserving enough information to explain what happened: which organization supplied the system, what it was intended to do, which version produced the output, what limitations were known, and what evidence the deployer retained. Colorado's operational model depends on those records surviving the handoff from developer to deployer and the changes that occur after deployment.