Chris Willis and Kim Phan break down the proposed regulations recently released by the Colorado attorney general under the Automated Decision-Making Technology (ADMT) Act, Colorado's newly amended AI statute.
In this episode of The Consumer Finance Podcast, host Chris Willis is joined by colleague Kim Phan to break down the proposed regulations recently released by the Colorado attorney general (AG) under the Automated Decision-Making Technology (ADMT) Act, Colorado's newly amended AI statute, and explain why the financial services industry needs to engage before these rules are finalized.
Chris and Kim walk through several provisions that diverge sharply from what industry had hoped for after the statute's May 2026 rewrite, including a narrow definition of "financial or lending service" that leaves debt collection and insurance in uncertain territory and a meaningful human review requirement that effectively demands full judgmental re-underwriting of automated credit decisions. The hosts also highlight consumer rights provisions that would require disclosure of every data input and score used in an ADMT decision, thus creating significant trade secret exposure and fraud risk with little identifiable consumer benefit.
The episode closes with the rulemaking timeline: public comments are due October 5, a hearing is scheduled for October 26, and the AG must finalize rules by January 1, 2027.
Podcast: The Consumer Finance Podcast
Episode: Colorado's ADMT Act Proposed Regulations: Unpacking the Confusion and Compliance Challenges for Financial Services
Host: Chris Willis
Guest: Kim Phan
Aired: September 10, 2026
Chris Willis (00:05):
Welcome to The Consumer Finance Podcast. I'm Chris Willis, the co-leader of Troutman Pepper Locke's Consumer Financial Services Regulatory Practice, and today we're going to be talking about the newly released proposed regulations under the Colorado ADMT Act, which used to be the Colorado AI Act.
But before we jump into that topic, let me remind you to visit and subscribe to our blogs, troutmanfinancialservices.com and consumerfinancialserviceslawmonitor.com. And don't forget about all of our other podcasts, the FCRA Focus, the Crypto Exchange, Payments Pros, and Moving the Metal. Those are all available on all popular podcast platforms. And speaking of those platforms, if you like this podcast, let us know. Leave us a review on your platform of choice and tell us how we're doing.
Now, as I said, today we're going to be talking about a new set of proposed regulations recently released by the Colorado Attorney General under Colorado's newly amended or reenacted AI statute, which is called the Automated Decision-Making Technology Act, or that's at least what I call it. And joining me to talk about that is my longtime friend and partner and co-host of our FCRA Focus podcast, Kim Phan. Kim is a partner in our Privacy and Cyber Group, but she specializes in privacy and AI issues as it relates to financial services companies. And of course, it's always a pleasure to have you on the show, Kim.
Kim Phan (01:23):
Well, thank you for having me, Chris. These are exciting times in the world of AI and ADMT, and excited to be here talking about this particular rulemaking, which I hope gets lots of public comment and amendment before it's finalized.
Chris Willis (01:36):
Yeah, for sure. Because when I read the regulations the day after they came out, I was really quite surprised and disappointed at a number of things in the regulations. Because when the statute had been reenacted basically from scratch in May of 2026, there had been a lot of improvement over the previous version of the statute, and so I was feeling very excited about that. The newly enacted version of the law required the Colorado AG to finalize regulations by January 1, 2027, which is when this law was supposed to go into effect, and also specifically required the Attorney General to engage with stakeholders and take comments and do all these other things. And then the proposed regulations came out in the first half of August of this year. So what was your feeling when you read the proposed regulations?
Kim Phan (02:26):
Chris, I had a similar reaction to you. When the ADMT amendments were put into place earlier this year, it was one of those scenarios in which a lot of the process without tangible, observable consumer benefit had been removed. A lot of that, such as some of the bias testing, some of the auditing, some of the, again, a lot of process paperwork, really, as opposed to actual tangible benefit to the consumer.
Chris Willis (02:52):
Yeah, like the annual risk assessments and stuff like that.
Kim Phan (02:55):
Correct. And so that seemed to be a positive move forward where they were really focusing very narrowly on specific steps that could directly benefit consumers in ways that could be observed, could be tracked, could be monitored with clear metrics. And then the regulations came out and they introduced a lot of the same concepts: process without clear benefit to the consumer, and process that I think will not be practicable for the industry without a lot of technical build and a lot of unnecessary steps that have to be taken. And again, with unknown and limited benefit, I think, to the consumer.
Yeah, I totally agree with you. Well, let's go through some of the highlights of the things that you and I observed when we read these proposed regulations, starting with how they define a financial or lending service. And for background, the statute defines a covered ADMT as one that influences a consequential decision about a series of different topics. And the one of those topics that we care about on this podcast is, quote, "a financial or lending service." So what do the proposed regulations say about that?
What I found interesting about the definition is that it is written in a way that it appears to be a very exclusive definition. There's a number of enumerated financial activities that are defined as a financial or lending service, rather than providing examples of what they mean by a financial or lending service. And for context, they specifically refer to the extension of a credit or a loan, transmitting or exchanging funds, the provision of deposit or checking accounts, check cashing, or installment payment plans. And that's it. Those very specifically enumerated items are what they consider to be a financial or lending service. And all other activities in the financial sector appear to be not included in that definition. For example, collections activity, insurance activity. So are those folks not in scope of the Colorado ADMT Act because the activities they're engaging in would be, by this definition, excluded from what is a financial or a lending service? I think that's unclear.
Chris Willis (05:09):
Yeah, I think it is, too. And there's one other thing that is unclear that I think should be clarified in the rulemaking before it's finalized. And that's that last example, not last example, last part of the definition of a financial or lending service about installment payment plans. Now, given the earlier language in that definition about credit or a loan, I was thinking an installment payment plan would be a point-of-sale credit extension where a seller engages in a credit sale and enters into a retail installment contract with the customer to buy some good or service. But the use of the word "installment payment plan," I think, makes that a little less clear. My belief is it is intended to cover retail installment contracts, or credit sales as we would think of them under the Truth in Lending Act, but that is a little bit unclear.
Kim Phan (05:56):
I agree. I think there are some opportunities here for the industry specifically to seek some additional guidance on that point. And we'll talk about some of those opportunities in a little bit, I'm sure.
Chris Willis (06:06):
Yeah, and there's lots of them. And part of the reason you and I wanted to do this podcast was to sort of ring the bell for the industry. I think it's an alarm bell, honestly, that there are a lot of things in these regulations that will be so difficult or harmful both to industry and consumers that they really do need to be commented on. Let's move on to another topic that both of us noticed when we read the proposed regulations, and that is there are some examples given in the proposed regs of adverse outcomes that would require the adverse outcome disclosure that's required by the statute as it was redone in May of 2026. What are those examples?
Kim Phan (06:43):
Well, I would note that I do approve of the fact that they do provide examples, and the regulations actually are filled with them, which I think is appreciated by many in the industry to have specific things that you can point to and how they're thinking about them. I think the challenge, of course, for the particular examples they provide in this context is they don't make much sense in the context of the definitions that have already been presented and how they would play out within the industry.
And two of the examples they've provided specifically for the financial or lending services arena is with regard to the referral of a delinquent credit card account to collections, and the other is the denial of a credit application. So those are the two examples they provide of an adverse outcome in the financial area. And I know, Chris, we had already discussed that the referral of a delinquent credit card to collections does not appear to actually align with their definition of what constitutes an adverse outcome.
Chris Willis (07:45):
No, it doesn't. And the thing is, that term is defined in the statute. An adverse outcome is one that denies, terminates, revokes, or restricts access to, say, a financial product or service. Well, let's imagine that we have a credit card issuer and they have a delinquent account. And when the account reaches a certain level of delinquency, X days past due, your charging privileges are suspended. That certainly restricts your access to the account, but there's no ADMT there, because it happens based on just the single criteria of your account being X number of days past due.
And then when it reaches a greater state of delinquency, it will charge off because it has become so delinquent that the issuer is going to charge it off. Now the issuer has a closed, charged-off account that it can either collect internally or it can send to a collection agency. The decision of which of those to do does not, in my view, come anywhere close to the definition in the statute of an adverse outcome, because the account's already closed, it's already terminated without an ADMT involved.
And if I now use an algorithm to say which ones are best to send to a collection agency, the account is untouched. It's just a question of who's going to collect the delinquent balance. And so I really didn't appreciate that being used as an example in the regulations, because it implies a definition of an adverse outcome that doesn't square with the definition in the statute.
Kim Phan (09:07):
Those particular examples I found interesting, because they seem to be outcome-based, right? They're providing these examples in the context of the notice of adverse outcome. And they're providing those examples as, one, the scenario in which a delinquent credit card account is sent to collections, in which a Colorado ADMT notice of adverse outcome needs to be sent because an ECOA or FCRA notice of adverse action wouldn't otherwise be sent. And then they provide the example of the denial of a credit application as a scenario in which the Colorado ADMT adverse outcome notice could be wrapped in to the ECOA/FCRA notice that would otherwise be sent. So it appeared to be they're focusing on the result as opposed to the front-end context of the example, Chris, which might explain why it doesn't quite square with the definition.
Chris Willis (09:59):
Yeah, that makes sense to me as a source of the error here. And I think it gives us an opportunity, too, to talk about the provision of the proposed regs that deal with the interaction between ECOA and FCRA adverse action notices and the Colorado ADMT Act adverse outcome disclosure. And so what do the proposed regulations say? If I am giving an ECOA/FCRA adverse action notice, do I have to give a separate Colorado one? What does the proposed regulation say to do in those instances?
Kim Phan (10:27):
One of the useful things I think the regulations clarified was that if you provide all the disclosures that are otherwise required in the Colorado's ADMT adverse outcome disclosure with your ECOA/FCRA notice of adverse action, then that will, according to the Colorado AG, satisfy your obligation under the Colorado ADMT Act. What I find interesting is that there's this reality that the federal government and the states have this tension right now between what's required under the federal law and what the state laws are requiring right now.
And it's notable that the CFPB, the FTC, others who have jurisdiction oversight over ECOA and FCRA have been entirely silent. There is a standard and approved model form for providing notice of adverse action under ECOA and FCRA. And if an entity, according to the Colorado law, adds its Colorado disclosures to that form, do they lose the safe harbor for those standard templates under the CFPB-issued ECOA/FCRA model notices of adverse action?
Chris Willis (11:38):
And it's notable because the proposed regulations say that if you give an ECOA/FCRA adverse action notice, you can't just sit on that for purposes of compliance with the Colorado law. There are two disclosures that have to be added to it under these proposed regulations that basically deal with the nature of the algorithm and the consumer's right to various requests that they can make under the Colorado law, which we're going to talk about later, and how they invoke those rights. That is what would have to be added to the model form.
Kim Phan (12:08):
And you're right, nobody likes to mess with a model form. We in the credit industry, we enjoy using those model forms, because they provide a safe harbor for compliance with the underlying federal laws. And now the Colorado AG is saying, no, you need to add some stuff to the Reg B model form.
Chris Willis (12:24):
And I can easily see under the current administration a federal agency saying, "Hey, you've diluted the model form with all this extra stuff under a Colorado law, so you're going to lose the safe harbor." And I think that's a tough position for companies to be in.
Kim Phan (12:38):
Yeah, agreed. Let's talk about another area that I thought we were in the clear on when I saw the new rewrite of the legislation back in May, but now I'm much more pessimistic about where we are on that issue, and that is meaningful human review. And so there's a couple of aspects. This is discussed extensively in the proposed regulations. A couple of aspects of it include what does a meaningful human review entail and when are you able to avoid meaningful human review based on the fact that it's not commercially reasonable, which was a provision in the statute as it was amended in May of 2026. Because I had thought, well, it's probably never going to be commercially reasonable for a large-scale creditor making automated credit decisions to do meaningful human review of those decisions. But let's talk through, Kim, what the proposed regs say about that that has gotten me so depressed.
Well, we'll reach that second part of the commercial reasonableness potential exemption for organizations, and let's look at the specific definition of what it means to have meaningful human review. So there's two parts to that. There is both the human reviewer and whether or not what they are doing is meaningful. So to have a human reviewer, there is a whole series of obligations with regard to the obligations, the requirements, and the credentials that a human reviewer has to have. So they have to have sufficient independence from the decision-making, the original decision-making, so that they can make their review. They have to have subject matter understanding of the process, for example, the underwriting process or other decision-making process that the ADMT was originally tasked to make a decision about.
They have to have sufficient training not only in that process, but in the actual functionality of the ADMT and how it is supposed to operate. And they need to have the authority to actually override an ADMT's decision in any particular situation. And ADMT is not allowed to assist that human reviewer in any way in making their determination during their review. I'm sure this is going back to some of those scenarios where we've had AI who will hallucinate something, and when asked to verify their original conclusion, the AI will double down on the hallucination. So I'm sure they're trying to avoid that particular scenario.
Chris Willis (14:55):
But of course, gradient-boosted tree underwriting models do not hallucinate, to be clear.
Kim Phan (15:02):
Right. That's not a risk in a lot of the scenarios that the financial sector would encounter. And again, this is a statute that's intended to be written broadly for all industries. But I agree with you, Chris, in the narrow scenarios in which the financial industry might be deploying ADMT and are currently deploying ADMT technologies, that this probably isn't a great risk. But now that we've determined what requirements the human reviewer has to have...
Chris Willis (15:26):
Yeah, which by the way sounds like a full-on judgmental review of a credit decision without any assistance from the model that rendered the initial decision. So are we going to go back to judgmental underwriting? I mean, we'll get to that question in a second. But that's what that definition would seem to require.
Kim Phan (15:41):
Yeah, it requires the subjective determination of a human over a process that has built over the last however many years to improve that process, to remove subjective elements and review objective criteria.
Chris Willis (15:56):
Well, and I might add, under regulatory pressure from the consumer protection agencies to alleviate fair lending concerns by eliminating judgmental underwriting from credit decisions, because those were thought to provide biased results and that automated decision-making was better and fairer from a fair lending standpoint. This seems like a page out of 1955 to me in comparison to that.
Kim Phan (16:19):
And it's another example of that tension between what the federal regulators are expecting and how these state laws are starting to play out.
Chris Willis (16:28):
Yeah, I apologize for interrupting you. You were going to talk about what it means for a human reviewer with all of this unicorn of authority, training, and knowledge to then engage in a meaningful review. So what does that require?
Kim Phan (16:39):
It's a little unclear how meaningful the review has to be. So assuming that the human reviewer meets all of those criteria, there is no clear standard as to what it means to be meaningful, except that the regulations state clearly that if the human reviewer decides to override the ADMT's decision, that is conclusively determined to be a meaningful review. And I'm like, okay, well, so every time we disagree with the automation, then that's meaningful, but anytime that we agree, there's some risk.
Chris Willis (17:11):
Which again, in the context of credit models, seems very misplaced to me.
Kim Phan (17:18):
They're setting up some very unreasonable expectations for what a human reviewer will have in their arsenal of capabilities and what the standard is for the meaningfulness of their review. And while there is a sliver of light, in that there is an exception for scenarios in which a human review may not be commercially reasonable, I know that you have some thoughts on the reality that the standard set up by the regulations, the proposed regulations, aren't really something that the financial sector could meaningfully benefit from.
Chris Willis (17:47):
No, that's right. And the thing is, as I said earlier in the show, when I saw the commercially reasonable exception in the statute as it was passed back in May, I thought, oh, this is great, because it's really not commercially reasonable to review these many, many hundreds of thousands of instantaneous automated credit decisions. And there's frankly no reason to do it, because there's no reason to give a different result. And so when the proposed regulations came out, it did two things to depress me about the availability of this exception under the statute. First, it sets forth these standards, this multi-factor balancing test with no clear outcome to it about when commercial reasonableness exists, and we'll talk about that definition in a second.
But then it goes on to provide another example that says, oh, well, if you have a consumer who is applying for credit at the point of sale at a merchant to buy something at a merchant and gets their application declined, then here is the type of meaningful human review that will be required. And so it assumes that a very sort of low-level, non-essential, typical credit decision is going to be subject to meaningful review and assumes that it would be commercially reasonable, in the Colorado AG's mind, to engage in human review of all of those decisions, which seems totally crazy to me.
Kim Phan (19:10):
I agree with you. Again, for your example, at a retail point of sale, if I'm a consumer standing at the counter in a retail store and want to exercise my right to human review, how meaningful could that possibly be at that point in time?
Chris Willis (19:24):
Well, and how commercially reasonable is it? This is something where you're not even communicating directly with the creditor. The merchant is facilitating the credit application. The creditor is making the decision via a model, obviously, that's why it happened instantaneously. And so is somebody sitting there with a batphone at the creditor's office who has all this constellation of skills and training and authority that the regulations require, who can then make an instantaneous sort of review of the decision with full authority to override it and make a fully judgmental credit decision under those circumstances?
Now, I'm exaggerating a bit, because in the example that's given in the regulations, the Colorado AG says, and this seems to be in tension, by the way, with the definition of meaningful human review, but nevertheless, it says, oh, well, in that kind of an instance, the only human review that would be required is a review to make sure the algorithm is working as intended. So an employee, a human being, would need to verify that in connection with this particular application, that the algorithm did what it was supposed to do, which sounds like a relaxed requirement for human review because it's not a full-on judgmental review of the credit decision. But it still seems totally unworkable. How is someone going to be there to sit there and check that the algorithm is working as it was intended to with respect to every Colorado application as to which somebody asks for human review? How will that work? It just seems like something that's an impossible ask for the industry.
Kim Phan (20:54):
I agree. And the rules make very clear that the company is the one that bears the burden of proof to show that what is commercially reasonable to them in whatever scenario should alleviate that meaningful human review obligation.
Chris Willis (21:08):
And the other thing is, back to your point earlier at the beginning of the show, you talked about process without consumer benefit. This is a prime example of it. Those of us in the credit industry know that these decision-making algorithms do not malfunction except in incredibly rare circumstances when you have generally a problem with data feeding into them that might be inaccurate or missing. Maybe there's an error with downloading the credit report or something like that.
But the algorithm, once it's set, it processes information and it does it the same for every transaction. And this is not something that breaks every five tries or something like that. And so the idea that it's helpful to consumers to have a human verify that, oh, yeah, today, for the 100,000th time today, it actually worked the same as the other 99,000 times, seems silly to me and certainly with no consumer benefit.
Kim Phan (22:01):
I hear you.
Chris Willis (22:02):
Well, let's talk about another sort of segment of the proposed rules revolving around the consumer rights under the Colorado statute. And those rights include the opportunity to ask for the information that the algorithm based its decision on and then the right to correct that information and have the decision remade. So what do the proposed regulations say about those two things? Because this is about to stick in my craw again.
Kim Phan (22:30):
These are incredibly burdensome to the industry, specifically the financial services industry, but others as well. And while there are some exceptions that are slivers of light, they are not necessarily that meaningful, because they won't necessarily protect the industry from some of the harms that they're there to presumably alleviate. Information that has to be provided about the ADMT include all the specific pieces of personal data, including things like ranking, scoring, classifications, recommendations, predictions, and other inferences, and all the ADMT inputs that were used in a particular decision for a particular individual.
Now, the consumer, once they're able to review all of that data that the company would have to provide in response to these requests, would then be able to correct or question the accuracy of any of those inputs. And it's interesting, specifically on the accuracy standard, there is a reference in the regulations that says if the entity that used the ADMT did not receive the personal data that was input directly from the consumer and doesn't have other documentation to support the accuracy of that information when it was input into the ADMT, the presumption has to be that the consumer's claim of inaccuracy was upheld and that that information needs to be corrected in accordance with what the consumer is saying it needs to be.
Chris Willis (23:52):
Yeah.
Kim Phan (23:52):
That's an untenable standard.
Chris Willis (23:54):
It is. But let's save that for in just a minute and let's talk about the information that's required to be disclosed about what was considered by the algorithm, because under the proposed regulations, it has to be every data point that was considered by the algorithm plus the score that the algorithm gave. And so I see two problems with this that are glaringly obvious. First of all, many creditors have custom scorecards that they build and they carefully choose which items of information are going to be considered by the scorecard or the model. And then they have a score that they generate internally that says, whether you're going to be approved or not or what your interest rate is going to be.
And so if the Colorado Act requires the disclosure of every single one of those data elements that feeds into the model and that the model considers, and the score, it has two implications. First of all, the fact that these are trade secrets and are very carefully guarded as such by financial institutions, because the accuracy of their underwriting they view as a real competitive advantage will be completely ruined because you have to give all the attributes in the model and the score that the model gave, which makes it, I think, much easier for someone to reverse engineer the model from a competitive standpoint.
But the second problem, which stems from the same over-disclosure of information, is that there are organized fraud rings out there who love to understand how credit models work so that they can manipulate them and defraud the creditor. And again, giving every element of data that the model considers and the score seems to massively facilitate that kind of fraud. And both of those things are bad for the industry, but also what good is it going to do a consumer to have a list of fields off of your credit report and say, "Well, here you had this delinquency and this is paid as agreed," or whatever, and then this is your score? What is a consumer going to do with that?
And the thing is, if a credit report was used in the decisioning, they already have the key factors disclosure under the FCRA section of the adverse action notice. So how does this add anything to it? And they have the right to obtain their credit report and to dispute any information on the credit report under the FCRA. That right's been around for 50 years. And so what does this add in terms of consumer benefit? I think nothing.
Kim Phan (26:10):
Yeah, again, the sliver of light that they try to offer that says that you don't have to disclose any trade secret information in response to these consumer requests, that's a meaningless exemption. If you comply with the statute, you are giving away trade secret about how the industry is operating.
Chris Willis (26:25):
Well, yeah, and frankly, it's like what consumer protection enforcement agencies would say about making a broad claim in marketing and then caveating it with a footnote that contradicts it. These regulations do the same thing. It's like, "You have to do all these things and, oh, by the way, don't disclose trade secrets." Well, where does that leave the industry? We don't know what to do, because there's such this absolute requirement to provide all the pieces of data that the ADMT considered. And in the credit industry, I think that would be a disaster. But the disaster's not over yet because, Kim, you referred a moment ago to the correction issue, and I want you to highlight in particular the scenario that creates, which makes absolutely no sense to me.
Kim Phan (27:03):
Again, the scenario is that if a consumer questions the accuracy of any data that the deployer of the ADMT did not receive directly from the consumer, then the assumption has to be under the proposed regulations that the consumer is the one who is correct and the information has to be corrected and then reversed and the ADMT decision reevaluated. And in the scenario that you just gave, Chris, where a financial institution's using a credit report, that's information that they didn't receive directly from the consumer.
And if the consumer questions something under that credit report and the deployer, the financial institution, is required to reverse and correct that information so that that ADMT decision has to be revisited, again, that process that is already resolved under the FCRA, that does not benefit the consumer in this scenario, adds additional hurdles for the industry, and I think is not beneficial in any way.
Chris Willis (27:58):
Well, it actually harms the consumer, because if the example plays out as noted in the proposed regulations, let's say the credit report says that the consumer has 12 delinquent accounts. And so the creditor says, "Well, no way, I'm not giving you any more credit because you can't pay the credit that you have already." The consumer then invokes his or her rights under the Colorado statute and says, "Oh, no, none of those accounts is delinquent. I'm paid as agreed on every single one of them. And since you don't have any underlying documentation to prove that I'm delinquent on them, because you got it from a third party, you must accept my version of that and now you must approve me." Well, what does that mean? That means we give credit to people who can't handle the credit. Surely the Colorado AG's office doesn't want that, but that's precisely the result the proposed regulations would seem to call for.
Kim Phan (28:41):
Yes, and we know that is not useful too, because that results in an account that's going to end up in default, which is not good for the financial institution, is not good for the consumer. No one benefits.
Chris Willis (28:50):
There seems like there would be a significant preemption argument with respect to that, particularly for a nationally chartered bank, of the Colorado Act forcing the bank to make a credit decision that's unsafe and unsound and contrary to its own credit risk principles. But we'll get to that someday, perhaps. Let's talk about the last couple of things about the proposed regs that you wanted to note. And there's a lot of technical build that would be required by this because of one of the particular requirements about responding to this notice of requesting information that is considered by the ADMT. Can you explain that, Kim?
Kim Phan (29:24):
We've seen over the last few years that these state privacy laws that have created new consumer rights in a variety of different areas specific to privacy have generally provided some flexibility to companies that are subject to those laws to provide a method of request and a vehicle for providing information back. Here under Colorado, they are requiring that companies have and provide an online link, a source for consumers to exercise these rights through an internet-based functionality, and that the information in response to any consumer ADMT request, specifically as soon as a consumer clicks, then the information has to be immediately available to them and delivered through this online portal.
That's going to require a huge technical build, not only to build these portals out where they don't currently exist, and especially for smaller entities, right, that don't necessarily have strong internet functionality or IT build teams. And the reality that this information has to be immediately available is going to require a lot of integration that I think companies aren't prepared for, especially again under existing state privacy laws that provide up to 45 days to provide responses. Now, the proposed regs do have a 45-day timeline for a number of different rights that are created for consumers.
But some information that again has to be immediately available, has to be displayed on screen as soon as a consumer clicks, are things like the information inputs that are used in a particular ADMT system, the version number, the developer of that ADMT, and the types, categories, and sources of personal data that are going to be used to make a decision about a particular consumer in a particular scenario. That's an incredible amount of data that has to be available at a company's fingertips for any consumer request.
Chris Willis (31:11):
Yeah. And the thing is, because of the nature of that information and the fact that it has to be made available instantaneously, it accelerates the trade secret and fraud harms that we were talking about a few minutes ago. Let's say that the credit industry is as unhappy with these regulations as you and I are, and I feel like they should be. What are the next steps in terms of this rulemaking? Because these are, fortunately, just proposed rules at this time.
Kim Phan (31:36):
Well, at this stage, the proposals I think are recognized to be just that, and there's going to be additional layers of process. So there is a deadline of October 5th for the public to submit comments that will be considered as part of an upcoming hearing that the Attorney General's office is going to hold about these proposed regs. That hearing is scheduled for October 26th. Now, there's a couple of items that are pre-scheduled on the agenda to discuss at that upcoming hearing. Material influence, the standard of how much influence an ADMT has to have on the consequential decision, which currently the standard is a de minimis effect, but how to define that de minimis amount of influence is going to be discussed at the hearing, as well as the reality that ADMT is complicated.
There are developers, there are vendors, there are multi-party arrangements in which an original developer might be further tweaked by a middle party before it's deployed by a third party. That's going to be discussed. But anything else that the industry wants to make sure is raised during that hearing should be submitted by that October 5th deadline. Any other public comments can be submitted through October 26th, and that will also be considered as part of the AG's review of the rules as they work toward and draft final rules.
Chris Willis (32:59):
Right. And the statute requires the AG's office to finalize these rules by January 1st, 2027, which was the effective date of the statute as enacted. There is, however, some litigation ongoing and a consent order that's been entered in that litigation that may delay enforcement of this law, and enforcement is exclusively by the Colorado AG. There's no private right of action. Kim, do you want to tell the audience a little bit about that?
Kim Phan (33:25):
Sure. The ongoing litigation, which we won't get into here, but it is specifically involving an injunction so that the Colorado AG, in accordance with that litigation, has entered into an agreement. The court has entered an order that states that the Colorado Attorney General will not engage in any enforcement activity until after the rules are finalized. Now, the AG hasn't always hit some of their deadlines, so it's unclear whether or not they will hit that January 1st deadline to get these final rules out. I know there's a commitment from the AG's office to do so, but we'll have to wait and see. And whether or not they actually start bringing enforcement actions even when these rules are finalized is up in the air.
Chris Willis (34:27):
Thanks for going over that, Kim. That gives a little bit more breathing room for these issues like the ones that we've discussed to be hashed out between the Attorney General's Office and the financial services industry. So Kim, thanks so much for being on the podcast again today. Thanks to our listeners for listening as well. I know this was a longer episode, but there's a lot to unpack with these proposed regulations, and Kim and I both think that it's pivotally important for the consumer credit industry to be aware of these.
Thanks for listening. Don't forget to visit and subscribe to our blogs, troutmanfinancialservices.com and consumerfinancialserviceslawmonitor.com. And while you're at it, why not visit us on the web at troutman.com and subscribe to our Consumer Financial Services email list? That'll allow us to send you copies of the alerts and advisories we send out on important issues, as well as invitations to our occasional industry-only webinars. And of course, watch your podcast feed every Thursday afternoon for a great new episode of this podcast. Thank you all for listening.
Copyright, Troutman Pepper Locke LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper Locke. If you have any questions, please contact us at troutman.com.
DISCLAIMER: This transcript was generated using artificial intelligence technology and may contain inaccuracies or errors. The transcript is provided "as is," with no warranty as to the accuracy or reliability. Please listen to the podcast for complete and accurate content. You may contact us to ask questions or to provide feedback if you believe that something is inaccurately transcribed.