Colorado lawmakers and regulatory bodies have unveiled a comprehensive set of proposed rules designed to govern the use of automated decision-making technology (ADMT) in high-stakes consumer transactions, marking a significant shift in the state’s oversight of the financial services and mortgage lending sectors. Senate Bill 26-189 establishes a rigorous framework for both the developers and the deployers of these technologies, specifically targeting instances where algorithmic systems "materially influence" decisions that result in consequential outcomes for individuals. With an implementation date set for January 1, 2027, the legislation represents one of the most proactive state-level efforts to regulate artificial intelligence (AI) and automated systems in the United States, following the broader legislative trend set by Colorado’s pioneering AI Act.
The scope of the proposed regulations is notably broad, encompassing technology that processes personal data to generate information used to make, guide, or assist in decisions regarding housing, lending, employment, insurance, healthcare, and education. For the mortgage industry, this includes everything from initial credit scoring and automated underwriting to loan servicing and loss mitigation. While the intent of the bill is to provide transparency and prevent algorithmic bias, industry experts and trade organizations have raised significant concerns regarding the clarity of the current definitions and the potential for duplicative regulatory burdens that could hinder technological innovation.
The Legislative Timeline and Path to Implementation
The emergence of Senate Bill 26-189 is part of a multi-year effort by Colorado to lead the nation in consumer-centric AI regulation. The journey began in earnest with the passage of Senate Bill 24-205, which established a "duty of care" for developers and deployers of high-risk AI systems to protect consumers from algorithmic discrimination. The newly proposed rules serve as the operational extension of this legislative philosophy, providing the specific compliance requirements that businesses must meet over the next three years.
Under the current timeline, the period between late 2024 and 2026 is designated for stakeholder feedback and refinement of the rule-making process. Lenders and technology vendors are expected to use this window to audit their existing systems and prepare for the 2027 deadline. The three-year lead time reflects the complexity of the task, as many financial institutions rely on legacy systems integrated with third-party AI modules that may require extensive re-engineering to meet the new disclosure and human-review standards.
Defining Automated Decision-Making and Consequential Decisions
At the heart of the controversy surrounding the bill is the definition of what constitutes an "automated decision-making technology." The legislation defines ADMT as any technology that processes data to "make, guide, or assist" in a consequential decision. This phrasing has led to concerns from legal experts like Mitch Kider, chairman and managing partner of Weiner Brodsky Kider PC, who argues that the lack of a precise threshold for what qualifies as "assisting" a decision could result in nearly every piece of software used in a mortgage office falling under the act’s jurisdiction.
"Consequential decisions" are defined as those that impact an individual’s access to essential services or economic opportunities. In the mortgage context, this includes:
- Approval or denial of credit applications.
- The determination of interest rates and loan terms.
- The assessment of collateral value through automated valuation models (AVMs).
- Decisions regarding foreclosure and loan modifications during the servicing phase.
Wendy Lee, a partner at Buchalter specializing in financial services, emphasizes that the law covers the entire "life cycle of the loan." This means that from the moment a consumer submits a digital application to the final stages of loss mitigation, any automated system that categorizes information or evaluates risk could be subject to the law’s requirements.
Industry Reactions and the Call for Refinement
The Mortgage Bankers Association (MBA) has been vocal in its call for further refinement of the proposal. In a recent newsletter, the MBA expressed concern that the current rules leave creditors in a state of uncertainty regarding which specific processes fall under the ADMT Act. The association argued that without a more granular definition of "material influence," lenders might be forced to treat every automated interaction as a high-risk event, leading to a "compliance paralysis" that could slow down loan processing times for consumers.
A primary point of contention is the requirement for "meaningful human review." The bill grants consumers who experience an adverse outcome—such as a loan denial—the right to request a human reconsideration of the decision. Mitch Kider warns that if the standard requires a full manual underwrite for every adverse action, it would essentially negate the efficiency gains provided by modern technology. "It’s no different than having a manual underwrite done on every loan… and that becomes somewhat problematic," Kider noted, highlighting the potential for increased costs to be passed down to the borrower.
Documentation and Disclosure Requirements for Developers and Deployers
The proposed rules bifurcate responsibilities between "developers" (the entities that create the software) and "deployers" (the businesses that use it). Beginning in 2027, developers must provide deployers with comprehensive documentation, including:
- The intended use cases and known limitations of the technology.
- A description of the categories of data used to train the system.
- Clear instructions on how the technology should be used and how human review should be integrated.
- Notifications regarding any material updates or modifications to the software’s logic.
Deployers, in turn, must provide "clear and conspicuous" notice to consumers before using ADMT to influence a decision. If an adverse outcome occurs, the deployer has a 30-day window to provide a plain-language explanation of the decision and the specific role the technology played in that outcome. This requirement aims to move away from "black box" algorithms where even the lenders themselves may not fully understand why a specific applicant was flagged as high-risk.
Regulatory Overlap with Federal Law
A significant portion of the legal debate centers on whether Colorado’s requirements are duplicative of existing federal protections. Under the Equal Credit Opportunity Act (ECOA) and the Fair Credit Reporting Act (FCRA), lenders are already required to provide adverse action notices that explain the reasons for a credit denial.
The MBA and legal experts have suggested that compliance with ECOA and FCRA should be deemed sufficient to satisfy the state’s ADMT notice requirements. However, as currently drafted, the Colorado rules act as an "add-on" rather than a replacement. While the proposed rules allow creditors to combine ADMT disclosures with federal notices, the state-level requirements for explaining the logic of the AI and providing a path for human review go beyond current federal mandates. This creates a "patchwork" regulatory environment that many in the industry fear will lead to confusion and increased litigation risk.
Enforcement Mechanisms and the Absence of Private Action
One aspect of the bill that has been received positively by the mortgage industry is the absence of a "private right of action." This means that individual consumers cannot sue lenders directly for technical violations of the ADMT Act. Instead, enforcement authority is vested solely in the Colorado Attorney General and relevant state regulators.
To provide a measure of protection for businesses acting in good faith, the bill includes a 60-day "cure period." If the Attorney General identifies a violation that is capable of being corrected, they must provide the business with notice and two months to rectify the issue before initiating an enforcement action. However, this grace period is revoked if the regulator determines that the developer or deployer knowingly or repeatedly violated the law. This structure is intended to encourage compliance and transparency rather than punitive litigation.
Cybersecurity and the New "Attack Vectors"
Beyond the administrative burden of compliance, the implementation of ADMT brings new security challenges. Wendy Lee pointed out a growing concern regarding how lenders will defend against malicious use of AI by consumers. As systems become more automated, they may become "attack vectors" where sophisticated actors use AI to manipulate underwriting logic or gain unauthorized access to data.
"How are lenders getting real controls in place to manage around what’s going to be more regulation that’s going to want to look at the safety and soundness?" Lee asked. She argued that a lender’s cybersecurity and information security programs must be intrinsically linked to their AI deployment strategy. Without robust monitoring of automated systems, the deployment of advanced AI could compound operational risks rather than mitigate them.
Analysis of Broader Economic and Efficiency Impacts
The ultimate impact of Senate Bill 26-189 on the Colorado mortgage market remains a subject of intense speculation. Proponents argue that the law will foster greater trust in automated systems, potentially leading to more equitable lending practices by forcing companies to identify and eliminate algorithmic bias. By providing consumers with a right to human review, the law ensures that "the computer says no" is no longer the final word in a person’s quest for homeownership.
Conversely, critics warn of a "dampening effect" on innovation. If the compliance costs and legal risks associated with ADMT become too high, lenders may revert to older, less efficient processes or limit their operations within the state of Colorado. Mitch Kider noted that AI has the potential to provide "tremendous cost savings" for both lenders and consumers by streamlining the highly complex mortgage process. If the regulatory burden offsets these savings, the industry could see a slowdown in the adoption of tools that could otherwise make housing more accessible.
As the 2027 deadline approaches, the mortgage industry will likely look toward federal regulators, such as the Consumer Financial Protection Bureau (CFPB), for a unified national standard that could preempt the burgeoning "patchwork" of state laws. Until then, Colorado’s proposed rules serve as a bellwether for the future of AI regulation in the United States, signaling a new era where transparency and human oversight are no longer optional features of financial technology.
