Layla Zulfa
Colorado lawmakers have unveiled proposed regulations that could significantly reshape how businesses, particularly in the financial services and mortgage lending sectors, utilize automated decision-making technology (ADMT) for critical consumer interactions. Senate Bill 26-189, which is slated to take effect for consequential decisions made on or after January 1, 2027, establishes new mandates for both the developers and deployers of ADMT when this technology "materially influences" decisions impacting consumers. The legislation’s broad scope, encompassing housing, lending, employment, insurance, healthcare, education, and essential government services, has drawn both anticipation and apprehension from industry stakeholders.
The proposed rules define ADMT as any technology that processes personal data to generate information used to make, guide, or assist in "consequential" decisions about an individual. This broad definition has raised concerns about the potential for widespread application across various stages of the lending lifecycle, from initial application processing to post-origination servicing.
Industry Experts Voice Concerns Over Clarity and Scope
A primary area of contention among legal and industry experts centers on the clarity of the definitions within the proposed rules. Mitch Kider, Chairman and Managing Partner of Weiner Brodsky Kider PC, expressed significant apprehension regarding the ambiguity of these definitions. "If [their] standard is going to be that the burden is on the user to show that a full review of an underwriting determination has to be done each and every time a consumer asks because they were adverse, it’s no different than having a manual underwrite done on every loan… and that becomes somewhat problematic," Kider stated, highlighting the potential for the regulations to impose an unmanageable compliance burden.
The Mortgage Bankers Association (MBA) echoed these concerns in a recent newsletter, emphasizing the need for further refinement to provide clearer guidance for the mortgage industry. The MBA noted that the current draft lacks precise definitions for what constitutes "automated decision-making technology" and what specifically qualifies as a "consequential decision." This ambiguity leaves creditors uncertain about which of their internal processes fall under the purview of the ADMT Act, potentially leading to inadvertent non-compliance.
Navigating Overlap with Existing Federal Regulations
A significant point of discussion revolves around the potential for duplicative compliance requirements with existing federal laws. Kider questioned whether Colorado’s proposed mandates would simply add another layer of regulation on top of federal protections already provided by the Equal Credit Opportunity Act (ECOA) and the Fair Credit Reporting Act (FCRA). "A lot of what is addressed over here is already addressed by other laws… You would think and hope that if you complied with ECOA and you complied with FCRA that you would be in compliance with this act as well, but as it’s written right now, it’s an add-on to those particular provisions, and I think that’s somewhat problematic," he remarked.
Wendy Lee, a partner at Buchalter specializing in financial services and regulatory compliance, acknowledged this potential overlap. She explained that while lenders issuing adverse-action notices under ECOA or FCRA might not need to issue entirely separate notices, additional AI-specific disclosures could still be mandated. The bill does, however, offer a potential concession by allowing ADMT disclosures to be combined with existing adverse-action notices required under ECOA or FCRA. This provision, if clarified and implemented effectively, could streamline compliance efforts.
Consumer Rights and Human Review
At its core, the Colorado ADMT Act aims to enhance consumer transparency and access to human oversight when automated systems influence significant decisions. Beginning January 1, 2027, developers of covered ADMTs will be obligated to furnish deployers with comprehensive documentation detailing the technology’s intended uses, the categories of training data employed, its known limitations, and explicit instructions for appropriate use and human review. Furthermore, developers must inform deployers of any material updates or modifications to their technology. Both developers and deployers will be required to maintain records demonstrating compliance for a minimum of three years.
For consumers, the proposed legislation introduces new disclosure requirements. Prior to utilizing a covered ADMT to materially influence a consequential decision, clear and conspicuous notice must be provided. If the technology contributes to an adverse outcome for the consumer, the deployer generally must furnish a plain-language explanation of the decision and the technology’s role within 30 days.
A crucial aspect of the bill is the consumer’s right to request instructions for correcting factually incorrect or materially inaccurate personal data used in the decision-making process. Additionally, consumers will have the right to request meaningful human review and reconsideration of the decision, provided it is "commercially feasible." Lee identified this human review requirement as a key area where lenders will need to integrate new compliance processes, including the meticulous maintenance of records and thorough vetting of their technology vendors.
Enforcement and the Absence of a Private Right of Action
A notable aspect of the Colorado ADMT Act is the absence of a private right of action. This means that individual borrowers cannot directly sue lenders solely for violating the provisions of this law. Enforcement will be primarily handled by the Colorado Attorney General and other designated regulatory bodies. Lee characterized the lack of a private right of action as a significant "win" for the mortgage industry, potentially mitigating the risk of extensive, individual litigation.
In cases of violations that can be cured, the Attorney General is generally required to provide a 60-day notice and an opportunity to rectify the issue before initiating an enforcement action. This cure period, however, does not apply if the Attorney General determines that a developer or deployer has knowingly or repeatedly violated the law. This enforcement structure suggests that lenders may have a window to identify and address compliance shortcomings before facing severe repercussions.
Broader Implications for AI Adoption and Security
The introduction of these regulations arrives at a pivotal moment for the financial services industry, as many lenders are still actively engaged in determining the safest and most effective ways to integrate artificial intelligence (AI) into their operations. Wendy Lee raised concerns about how lenders will defend themselves against potential misuse of AI by consumers, such as attempts to manipulate automated systems or gain unauthorized access to sensitive information. "How are lenders protecting themselves against borrowers using AI as an attack vector into their worlds? How are lenders getting real controls in place to manage around what’s going to be more regulation that’s going to want to look at the safety and soundness?" Lee questioned.
She further warned that lenders with underdeveloped cybersecurity and information security programs could face amplified risks as they deploy more automated systems. "If a lender doesn’t have a good cybersecurity or information security program that’s monitoring and constantly looking at the automated systems, then deploying AI in an unsafe environment is going to just compound risk," Lee emphasized.
Conversely, Mitch Kider cautioned that overly stringent and broad requirements could inadvertently stifle innovation and discourage lenders from adopting technologies that offer significant potential for cost reduction and efficiency improvements. "AI is amazing and it’s changing all the time. I think that they’re going to provide tremendous cost savings as well for both consumers and for lenders… My fear is that this is going to [dampen] the impact that AI can have overall in this industry," Kider stated. He advocates for regulations that focus on human contact, review, and transparency without imposing requirements so extensive that they negate the inherent benefits of automation.
The Colorado ADMT Act represents a significant step towards governing the use of AI in consumer-facing financial decisions. While the intent to foster greater transparency and consumer protection is widely acknowledged, the industry awaits further clarification and refinement of the proposed rules to ensure practical and equitable implementation. The ongoing dialogue between regulators, industry stakeholders, and legal experts will be crucial in shaping the future of automated decision-making in Colorado’s financial landscape. The potential for state-by-state regulatory fragmentation also raises questions about the eventual need for a more unified federal approach to AI governance in the financial sector.
