Key facts
- Colorado's proposed Senate Bill 26-189 establishes new requirements for businesses using automated decision-making technology (ADMT) in consequential decisions, including financial services and mortgage lending.
- The law applies to consequential decisions made on or after January 1, 2027.
- Industry experts and the Mortgage Bankers Association have raised concerns about the clarity of definitions for ADMT and consequential decisions.
- The proposed rules could create compliance burdens for lenders and potentially duplicate existing federal regulations like the Equal Credit Opportunity Act and Fair Credit Reporting Act.
- Consumers will have new disclosure requirements, the right to request human review, and the ability to request corrections to inaccurate data used in decisions.
- Enforcement of the law will be managed by the Colorado attorney general and regulators, with a 60-day notice and cure period for violations unless knowingly or repeatedly violated.
Colorado is proposing new regulations for businesses, particularly in financial services and mortgage lending, that utilize automated decision-making technology (ADMT) for consequential decisions. The legislation, Senate Bill 26-189, aims to provide consumers with greater transparency and access to human review when AI significantly influences outcomes related to housing, lending, employment, insurance, healthcare, education, and government services. The law is set to take effect for decisions made on or after January 1, 2027.
Industry experts, including Mitch Kider of Weiner Brodsky Kider PC and Wendy Lee of Buchalter, have voiced concerns that the proposed rules lack sufficient clarity regarding the definitions of ADMT and what constitutes a 'consequential decision.' This ambiguity could lead to significant compliance challenges for lenders, potentially requiring extensive manual reviews that negate the efficiency of automated systems. The Mortgage Bankers Association (MBA) has also called for further refinement of the rules to provide clearer guidance for the mortgage industry.
Questions have been raised about whether Colorado's requirements duplicate existing federal protections under laws like the Equal Credit Opportunity Act (ECOA) and the Fair Credit Reporting Act (FCRA). While the bill allows for combining disclosures with existing adverse-action notices, additional AI-specific disclosures may still be necessary. The MBA previously recommended that compliance with existing federal requirements should satisfy the ADMT Act's notice provisions. The law also addresses when creditors can deny requests for human review as 'commercially unreasonable' and seeks clearer distinctions between the responsibilities of ADMT developers and deployers.
Under the proposed law, developers of covered ADMT must provide deployers with documentation on intended uses, training data, limitations, and usage instructions. Both developers and deployers must retain compliance records for at least three years. Consumers must receive clear notice before ADMT materially influences a consequential decision. If an adverse outcome results, a plain-language explanation of the decision and the technology's role must be provided within 30 days. Consumers also gain the right to request corrections to inaccurate data and meaningful human review of decisions, to the extent commercially feasible.
Enforcement of the bill will fall to the Colorado attorney general and regulators, as there is no private right of action for individual borrowers. Violators generally have a 60-day period to cure non-compliance before enforcement actions are taken, unless the violation is knowing or repeated. This structure is seen as a potential benefit for the mortgage industry, offering an opportunity to rectify issues before facing litigation. However, lenders are also grappling with how to defend against potential misuse of AI by borrowers as an attack vector and ensuring the safety and soundness of their systems amidst increasing regulation.