Legal Corner: CORA in the age of AI

With the advent of easily accessible AI tools, municipalities may be seeing a difference in record requests received under the Colorado Open Records Act (CORA) and other public records laws. Some Colorado municipalities have stated that they have seen an uptick in record requests made with generative AI. This article is intended to provide guidance on allowable policies that may give some practical support to municipalities dealing with changing record requests. Additionally, this article discusses whether municipalities that use generative AI may be required to disclose AI chat prompts in response to CORA requests.

CORA Policies

What is an AI-generated request

A custodian of records may not be able to determine whether a request is generated by a human or a computer. Whether AI created a request is irrelevant, but AI-created records requests often present unique challenges because they often seek large volumes of records, become duplicative, or apply the wrong legal standards.

As an example, we asked Google’s Gemini to create a records request to get “everything about a contract award” because a hypothetical city “awarded a contract for a road construction project to a contractor who is charging too much and wasn’t the low bid.” Gemini applied Colorado law and created an extremely broad request for “all public records regarding the bidding, evaluation, and eventual contract award for the road construction project.” The request broadly asked for “any and all records, regardless of physical form or characteristics, generated from [start date of RFP/Bidding] to the present” including:

• Solicitation documents
• Submitted proposals/bids
• Bid tabulations and abstracts
• Cost and pricing evaluations
• All written and electronic communications (including emails, text messages, and memos) among City Council members, city staff, and project managers discussing the selection criteria, pricing, low-bid deviations, or final selection of the contractor.
• Transcripts, official minutes, executive session records, or staff reports presented to the City Council regarding the authorization or approval of this contract award.

A request of this type is extraordinarily broad and likely to require many hours of staff time to retrieve, review, and redact according to CORA and applicable legal privileges. A requestor with more institutional knowledge might simply ask for bid rankings, a comparison of the bids, or a justification for the award. A custodian who receives an overly broad request might offer that simpler information to satisfy the requestor’s needs.

Under C.R.S. § 24-72-203, municipalities are allowed to adopt policies to protect the integrity of records and prevent unnecessary interference with their regular operational duties. Some municipalities in Colorado have adopted policies specifically to address the issue of large and/or duplicative requests.

Municipalities may also charge fees for copying or printing public records, as well as an hourly fee for the research and retrieval of public records (although the first hour must be free). C.R.S. § 24-72-205(5)-(6). A custodian can only impose the hourly research and retrieval fee if a fee policy has been posted to the municipality’s website or otherwise been published. C.R.S. § 24-72-205(6)(a). No copying fees can be charged for digital records sent electronically.

Having a published policy regarding responses to records requests ensures that actions taken by the municipality are uniform and limits individual discretion. A clear policy may also reduce frustration and promote positive engagement with members of the public who are submitting record requests. C.R.S. § 24-72-205(1)(b).

Time Extensions

While CORA requests generally must be fulfilled as soon as practicable, and at least within three working days, the statute provides that there may be exceptional circumstances that allow a time extension to fulfill a record request. C.R.S. § 24-72-203(b). These circumstances are (1) a broadly stated request is made that encompasses all or substantially all of a large category of records and the request is without sufficient specificity to allow the custodian reasonably to prepare or gather the records within the three-day period, (2) a broadly stated request is made that encompasses all or substantially all of a large category of records and the agency is unable to prepare or gather the records within the three-day period because the agency needs to devote all or substantially all of its resources to meeting an impending deadline or period of peak demand that is either unique or not predicted to recur more frequently than once a month, or (3) a request involves such a large volume of records that the custodian cannot reasonably prepare or gather the records within the three-day period without substantially interfering with the custodian's obligation to perform his or her other public service responsibilities. C.R.S. § 24-72-203(b)(I)-(III).

If one of these circumstances applies, then CORA allows the municipality a seven-day extension in addition to the original three-day period. C.R.S. § 24-72-203(b). However, for the extenuating circumstances extension to apply, the municipality must also notify the requestor in writing of the extension within the original three-day period. C.R.S. § 24-72-203(b). Some municipalities that utilize these extensions have developed a form notification letter that includes statutory authorization for an extension, which extension category applies, the date of the new deadline for the request, and other applicable policies, such as the fee deposit described below.

As a practical matter, both time periods allow for flexibility if the municipality responds promptly and engages with the requestor. Requests for clarification, provision of cost estimates, and other engagement with requestors should cause the time limits to be tolled. Moreover, prior to any litigation, requestors must attempt to resolve issues with the custodian of records.

Fees and deposits for large requests

To lessen the cost burden of broad requests, some municipalities have instituted a deposit policy for record requests over a certain size. In these municipalities, after a record request is received, records personnel estimate the length of time required to retrieve and review the records, calculate cost according to a fee schedule, and then require the requestor to pay a portion of or the full estimated cost (depending on the municipality’s policy) as a deposit before beginning work to fulfill the request.

CORA expressly authorizes custodians to assess research and retrieval fees, subject to hourly statutory caps. C.R.S. § 24-72-205(6). Before the statute expressly authorized such fees in 2014, Colorado courts had endorsed practices including the assessment of fees and requiring deposits. See Mountain-Plains Inv. Corp. v. Parker Jordan Metro. Dist., 312 P.3d 260, 268 (Colo. App. 2013); Black v. Sw. Water Cons. Dist., 74 P.3d 462 (Colo. App. 2003). Although the General Assembly has approved fees and not imposed any additional requirement, at least one division of the Colorado Court of Appeals has held onto the view that CORA could still allow for courts to review whether fees and deposit policies are reasonable in the context of particular requests and requesters. See Sturgell v. Colorado Department of Public Health and Environment, No. 23CA1322, 2024 WL 3874722, at *4-5 (Colo. App. Aug. 8, 2024 (suggesting in dicta that factors could include: the reasonableness of the fee in light of the amount of information requested, the percentage of the fee required before beginning record retrieval, and whether or not the requestor could ultimately pay the fee).

Disclosure of AI chat prompts

The increase in availability of generative AI platforms has also offered municipalities the opportunity to integrate these tools into their functioning. However, municipalities that are doing so must consider whether AI chatbot conversations are subject to disclosure under CORA.

In considering this issue, the first question is whether an AI chatbot conversation constitutes a public record. CORA defines public records broadly as “all writings made, maintained, or kept by the state ... for use in the exercise of functions required or authorized by law ... or involving ... public funds.” C.R.S. § 24-72-202(6)(a)(I). Courts interpret this definition broadly and generally favor access. Mountain-Plains, 312 P.3d at 265. So, if an AI chatbot conversation is made by a government employee in relation to public business, there is a possibility that a court will find that the conversation is a public record.

However, public records are not subject to disclosure under CORA if they fit an applicable exception. A recent American Bar Association (ABA) article by a Colorado attorney discussing this topic identified two exceptions as the most relevant to AI chatbot conversations: the work product exception and the deliberative process privilege. Steven D. Zansberg, Are the Government’s Conversations with AI Accessible Under Public Records Laws and FOIA?, Communications Lawyer, Sep. 10, 2026. In Colorado, the work product exception is a statutory exclusion from the definition of “public record” under CORA, while the deliberative process privilege is a common law privilege that has been codified in CORA.

The work product exception (in the context of CORA) generally applies to inter- or intra-agency communication that is advisory or deliberative, assembled for the benefit of elected officials, and communicated for the purpose of assisting elected officials in reaching a decision within the scope of their authority. C.R.S. § 24-72-202(6)(b)(II) & (6.5). Colorado courts have further defined advisory as containing or giving advice, while deliberative is “reflective of the give-and-take process.”

The governmental or deliberative process privilege may be asserted by the government over pre-decisional material that “is so candid or personal that public disclosure is likely to stifle honest and frank discussion within the government.” C.R.S. § 24-72-204(3)(a)(XIII); City of Colorado Springs v. White, 967 P.2d 1042, 1051-52 (Colo. 1998). In White, the Colorado Supreme Court stated that the key question under the common law privilege was “whether disclosure of the material would expose an agency’s decision-making process in such a way as to discourage discussion within the agency and thereby undermine the agency’s ability to perform its functions.”  CORA prohibits disclosure of material subject to this privilege.

The rationale behind these two exceptions is similar: government agencies benefit from open exchange of ideas in developing policy, which might be hampered by (1) the possibility of public disclosure, (2) by the risk of judgment not based on the quality of decisions actually made, or (3) by public confusion caused by publication of preliminary concepts or competing proposals. White, 967 P.2d at 1051-54. In the ABA article cited above, Zansberg argues that that generative AI responses are not subject to change based on fear of public scrutiny, and so these exceptions are less applicable to communication that does not occur “human-to-human.”  But the deliberative aspect applies both ways, as the human user inputting prompts and reactions to AI responses could be subject to those fears. Moreover, the other interests served by the exceptions remain present even if one-half of the conversation is AI.

Ultimately, Colorado courts have not yet addressed whether AI prompts and responses are “public records” subject to inspection under CORA or whether, in a particular case, they would be covered by the deliberative process privilege or any other limitation on disclosure. However, for municipalities who have adopted more robust usage of generative AI tools, the possibility is worth considering. Appropriate policies concerning use permissions and retention periods when AI is used in connection with public business should account for the potential that CORA could require disclosure.