Colorado Revises Proposed AI Decision-Making Rules Ahead of October Hearing
Colorado Attorney General Phil Weiser’s office released revised proposed rules Oct. 6 implementing the state’s Automated Decision-Making Technology Act and Chatbot Safety Act, including changes to consumer disclosures, human review requirements and the use of artificial intelligence in credit decisions. The revisions come ahead of an Oct. 26 rulemaking hearing and could affect financial institutions, debt collectors and other businesses using automated systems to make consequential decisions about consumers.
The revised draft rules address requirements under Senate Bill 26-189 and House Bill 26-1263, both scheduled to take effect Jan. 1, 2027.
Colorado Clarifies When AI Influences Consumer Decisions
The revised proposal introduces a presumption that automated technology materially influences a consequential decision when its output, such as a credit score, ranking, recommendation or risk threshold, aligns with the final decision.
Businesses could rebut that presumption by demonstrating that the automated output played only a minimal role in the outcome.
For example, the draft identifies a credit union denying loan applications based on an automated risk-score threshold as a situation in which technology materially influences the decision.
The proposal also clarifies that businesses remain responsible for automated decisions involving technology operated by third-party vendors on their behalf.
Systems used exclusively to summarize, organize or present information for human review would fall outside the law’s definition of covered automated decision-making technology.
Consumer Disclosure Requirements Revised
Colorado’s revised proposal removes several requirements included in the original August draft.
Businesses would no longer be required under the proposed state rules to disclose the principal reasons for an adverse outcome or provide underlying scores and inferences. Instead, they would need to explain the technology’s role in the decision with specificity.
The revisions also allow businesses subject to the Equal Credit Opportunity Act or Fair Credit Reporting Act to provide required Colorado disclosures alongside applicable federal adverse action or risk-based pricing notices.
Additional changes include a 15-day response period for certain consumer information requests and exceptions where disclosures could compromise legally required cybersecurity, fraud prevention, anti-money laundering or sanctions compliance programs.
Human Review and Consumer Rights Modified
The revised rules narrow certain consumer rights involving access to and correction of personal data.
Consumers would have the right to request instructions for accessing or correcting information, but the correction provisions would exclude opinions, predictions, scores and certain protected evaluations.
The proposal also removes a previous requirement to pause adverse decisions while consumers pursue corrections or human review.
Human reviewers could be employees or external parties, provided they have genuine authority to override an automated decision.
Implications for the Receivables Management Industry
For accounts receivable management companies, the proposed rules could be relevant to automated systems used in credit-related decisions, consumer account evaluations and other activities that qualify as consequential decisions under Colorado law.
The revisions are particularly significant for businesses relying on third-party AI vendors, as outsourcing automated decision-making would not eliminate the deployer’s responsibilities.
Debt collection agencies and financial services providers should evaluate whether their automated tools fall within the law’s scope, particularly when technology influences consumer eligibility, financial outcomes or other covered decisions. Routine collection activities should not automatically be assumed to qualify as consequential decisions.
Businesses may also need to coordinate state disclosure procedures with existing federal compliance obligations, including requirements under the FCRA and ECOA.
Public Hearing Scheduled for Oct. 26
The Colorado Attorney General’s Office is accepting written comments through Oct. 26, when it will hold a public rulemaking hearing.
The Colorado Attorney General’s AI rulemaking page provides information about the proceeding.
The revisions remain proposals and are subject to further changes before adoption. Both laws are scheduled to take effect Jan. 1, 2027, giving affected businesses a limited implementation window if the rules are finalized before that date.
