Colorado’s Automated Decision-Making Technology Act applies to a lender once a model score, ranking or recommendation is more than a trivial factor that shapes a credit decision about a Colorado consumer. From January 1, 2027, the lender must tell applicants up front, explain any denial or materially worse terms within 30 days, and offer data correction and human review. A federal adverse action notice can do the explaining if it carries Colorado’s extra items.
The law is Senate Bill 26-189, signed by Governor Jared Polis on May 14, 2026. It repeals and reenacts Part 17 of Article 1, Title 6 of the Colorado Revised Statutes, the part that held the 2024 Colorado AI Act (SB 24-205), and it applies to consequential decisions made on or after January 1, 2027. The risk-management programs and impact assessments of the 2024 law are gone. What replaced them is a notice-and-rights regime that fits closely, though not exactly, around the adverse action notices lenders already send.
What counts as covered ADMT in a lending product
Section 6-1-1701 defines automated decision-making technology as technology that processes personal data and uses computation to produce predictions, recommendations, classifications, rankings, scores or similar output used to make, guide or assist a decision about a person. It becomes “covered ADMT” when it is used to “materially influence” a consequential decision, meaning its output is a non-de minimis factor that affects the outcome. “A financial or lending service” is one of seven covered domains. The Attorney General’s proposed rules would define that phrase as credit or loans, transmitting or exchanging funds, deposit and checking accounts, check cashing and installment payment plans.
The statute also lists what is not a consequential decision. Several exclusions matter for fintech teams:
| Decision or tool | Status under SB 26-189 | Where it comes from |
|---|---|---|
| Underwriting model whose score cutoff denies applications | Covered | 6-1-1701(3) and (13); the interim draft rules use a credit union risk-score cutoff as an example of covered ADMT |
| Model that assigns a worse APR or other terms than similar applicants get | Covered when terms are materially less favorable | “Adverse outcome,” 6-1-1701(1)(b) |
| Identity verification and fraud controls required by law | Excluded | 6-1-1701(3)(b)(VIII) |
| Sanctions, AML and counter-terrorist financing screening | Excluded | 6-1-1701(3)(b)(VI)-(VII) |
| Prequalified-offer marketing and product recommendations | Excluded | 6-1-1701(3)(b)(II) |
| Customer service triage, routing, sending the decision letter | Excluded | 6-1-1701(3)(b)(I) |
| Support chatbot under a policy barring its output from decisions | Not ADMT | 6-1-1701(2)(b)(III) |
The law reaches a “person doing business in Colorado,” and its definition of consumer covers any individual whose access to a covered service in Colorado is evaluated in a consequential decision.
What the deployer owes the applicant
The lender using the tool is the “deployer,” and section 6-1-1704 sets out three disclosures.
- Before use. A clear and conspicuous notice that a covered ADMT is or will be used in a consequential decision, with instructions for getting more information. A prominent public notice reachable at the point of interaction, such as a link next to the application form, satisfies this.
- Within 30 days after an adverse outcome. A plain-language description of the decision and the role the covered ADMT played in it.
- In the same disclosure. A simple process to request the tool’s name, version number if any, its developer, and the types, categories and sources of personal data used, plus an explanation of the consumer’s rights and how to use them.
Those rights, in section 6-1-1705, are instructions for getting and correcting factually incorrect or materially inaccurate personal data, and an opportunity for “meaningful human review and reconsideration” to the extent commercially reasonable. Correction does not extend to opinions, predictions or scores. The reviewer has to be someone with authority to change the decision, trained for the job, who does not default to the system output and can see the output’s intended use, limitations, input categories and principal factors.
The adverse action notice shortcut
Section 6-1-1704(6) is the provision lenders will read first. A creditor that is required to send, and does send, a notice under the Equal Credit Opportunity Act and Regulation B (and, where it applies, the Fair Credit Reporting Act) complies with the Colorado disclosure duties for the same decision if that notice also satisfies them. It then owes no separate notice, and it may add a brief statement that a covered ADMT materially influenced the decision, with instructions for getting more information and using the Part 17 rights.
The condition is what matters. Regulation B section 1002.9 asks for the action taken, the creditor’s name and address, the ECOA anti-discrimination statement, the federal regulator, and either the specific reasons or the right to request them. The Colorado list asks for things a standard notice usually lacks:
| Item | Reg B adverse action notice | Colorado 6-1-1704(3) |
|---|---|---|
| Statement of the action taken | Required | Required, in plain language |
| Specific reasons, or right to request them | Required | Interim draft rules would ask for principal reasons |
| Role the automated tool played | Not required | Required |
| Way to request tool name, version, developer, data sources | Not required | Required |
| Data correction and human review rights | Not required | Required |
| Deadline | 30 days after a completed application | 30 days after making the decision |
A worked example shows how the two clocks interact. An applicant’s file is complete on January 4, 2027, and the model-driven denial is made on January 11. Regulation B’s 30-day clock runs from the completed application, so the notice is due by February 3. The Colorado clock runs from the decision, which gives February 10. A lender that wants one combined letter has to send it by February 3 and include the role description, the request link and the rights explanation.
The interim draft rules give the same reading. Their example is a creditor that denies a personal loan using covered ADMT and sends an ECOA-compliant notice, and they say it needs no extra disclosure as long as the notice contains the information required by section 6-1-1704(3)(b)-(c). Decisions with no federal notice, such as the draft’s example of a model that sends a delinquent card account to collections, need a full Colorado disclosure.
Two carve-outs protect existing programs. The law does not require any disclosure that federal law prohibits or that would compromise fraud, AML, counter-terrorist financing or sanctions programs (6-1-1704(7)), and it does not require disclosure of nonpublic personal information in violation of the Gramm-Leach-Bliley Act (6-1-1708(6)).
Vendors, records and liability
A model vendor is a “developer.” From January 1, 2027, it must give each deployer a statement of intended and known harmful uses, the categories of training data to the extent known, known limitations, instructions for monitoring and human review, and whatever the deployer needs to make its disclosures. It must give notice of material updates within a reasonable time. Developers and deployers each keep compliance records, such as version identifiers and changelogs, for at least three years.
The Attorney General enforces the law exclusively, and a violation is a deceptive trade practice under the Colorado Consumer Protection Act. There is no new private right of action. Before suing, the Attorney General must send a notice of violation and allow 60 days to cure where a cure is possible. That cure provision is repealed on January 1, 2030. Under 6-1-1707, fault in discrimination cases is split between developer and deployer by relative fault, and a contract term that indemnifies a party for its own discrimination-related acts is void.
Where the rules stand on November 14, 2026
The statute requires the Attorney General to adopt rules on the adverse outcome disclosures and consumer rights on or before January 1, 2027. According to the Department of Law’s rulemaking page, proposed rules (4 CCR 904-6) were filed with the Secretary of State on August 11, an interim draft followed on October 6, a regulatory analysis on October 21, and the formal hearing took place on October 26. As of November 14, the Secretary of State’s eDocket entry, tracking number 2026-00360, lists no adopted rule. The interim draft would also give a deployer 15 days to answer a consumer’s request for the additional information. Treat every draft detail as proposed until a final rule appears.
Federal adverse action rules for AI credit models are covered in our explainer on AI credit denials and adverse action notices, and another state’s approach to AI disclosure in Utah’s AI disclosure law. This article explains the statute’s text and is not legal advice.
