Chris Willis and Kim Phan unpack Colorado's brand-new Automated Decision-Making Technology (ADMT) Act, which repeals and replaces the state's much-criticized 2024 AI law.
In this episode of The Consumer Finance Podcast, Chris Willis and Kim Phan unpack Colorado's brand-new Automated Decision-Making Technology (ADMT) Act, which repeals and replaces the state's much-criticized 2024 AI law. They explain the shift from "high-risk AI systems" to the broader ADMT framework, what it means for consequential decisions in lending and financial services, and how the statute's "material influence" standard can sweep in tools that do far more than make final credit determinations.
The Consumer Finance Podcast – Colorado’s New ADMT Act: Repeal of the 2024 AI Law, Expanded Coverage, and What It Means for Financial Services
Host: Chris Willis
Guest: Kim Phan
Air Date: May 28, 2026
Chris Willis (00:05):
Welcome to The Consumer Finance Podcast. I'm Chris Willis, the co-leader of Troutman Pepper Locke's Consumer Financial Services Regulatory practice. And today we're gonna be talking about Colorado's new version of its AI Act. But before we jump into talking about that very important topic, let me remind you to visit and subscribe to our blogs, TroutmanFinancialServices.com and ConsumerFinancialServicesLawMonitor.com. And don't forget about all of our other great podcasts: The FCRA Focus, The Crypto Exchange, Payments Pros, and Moving the Metal. All of those are available on all popular podcast platforms. And speaking of those platforms, if you like this podcast, let us know. Leave us a review on your podcast platform of choice and tell us how we're doing. Now, one of the things that has been, I feel like, very vexing to the financial services industry over the past couple of years, in fact, almost exactly two years, has been the Colorado AI Act passed in May of 2024, which had a whole lot of ambiguities and unanswered questions and lots of what seemed like very burdensome requirements on any user of what it termed to be a high-risk AI system. But that statute has been wiped away and replaced as of May 12th with a new version of the Colorado AI Act. And joining me to have a discussion about how the new one differs from the old one is my partner and frequent guest on this podcast, Kim Phan. Kim, thanks for being here today.
Kim Phan (01:26):
Thanks for having me, Chris. I will admit, when I saw this development, I had a geek-out moment and was very excited about this, especially for our clients and listeners who are in the financial services space.
Chris Willis (01:38):
Yeah, I mean, I was excited about it, too, because there have been some false starts with the Colorado legislature, like at the end of 2025, and then a lot of uncertainty about whether they'd get an amendment passed or not. But they did it... They got it done. And so now we've got something to talk about, and I think it's very important for us to communicate about this with the industry.
Kim Phan (01:54):
Well, it was a long time coming, right? Even the governor, when he signed the original Colorado AI Act into law, issued a signing statement saying, "Look, this is something that needs to be amended."
Chris Willis (02:05):
Right.
Kim Phan (02:06):
So we knew this was coming. We didn't know if it would make it across the finish line. Now it has. It's very exciting.
Chris Willis (02:11):
It is definitely exciting. So let's dive into it and talk about some of the differences between the 2026 version and the old 2024 version of this law. Kim, start off, because there have been some major things that were very difficult to comply with in the 2024 Act that have been removed entirely from this new version.
Kim Phan (02:28):
Yeah, I do want to actually start with the terminology. We keep referring to it as the Colorado AI Act, but we may not be able to call it that anymore. The artificial intelligence terminology has been removed. The high-risk AI system terminology has been removed. And it now is using terminology that is more aligned with what California has been doing with their automated decision-making technology rulemaking. So the new term is ADMT. Which is... So just for purposes of this conversation, maybe we stop calling it the Colorado AI Act, because it may be now the Colorado ADMT Act. So it's a change.
Chris Willis (03:07):
I think we should call it that. I'm hopelessly stuck in the past in 2024, and now you've brought me up to the present day. So thank you, Kim.
Kim Phan (03:13):
And that's probably the biggest change, right? Is this shift away from this idea that this was supposed to be limited to high-risk artificial intelligence before, and now it's this ADMT, which is inclusive of AI, certainly, but it's a very broad term that could capture all kinds of different activities that previously may or may not have been in scope. So I would consider that one of the significant changes that companies need to be thinking about. If they were already developing some sort of inventory internally of what their AI systems and high-risk AI systems are, they need to be rethinking that whole analysis and thinking more broadly to ADMT.
Chris Willis (03:52):
Absolutely, because some things are gonna get swapped in and some things are gonna get swapped out. Let's talk for a second about the new framework under the new ADMT Act in Colorado of like, what is an ADMT that's covered by this law? Because it has a definition, and it has some aspects of the definition that are not quite what they appear from their plain language. So go ahead and take us through that, Kim.
Kim Phan (04:13):
So ADMT, for purposes of the new law, is a system that is contributing to a consequential decision. Consequential decisions related to any number of covered domains. And there's lots of different covered domains, but for purposes of this podcast, financial services and lending. That consequential decision is important in that the ADMT output has to more than materially influence that consequential decision. There's this weird little... It can't just be a de minimis factor in how a company decides on a consumer's eligibility.
Chris Willis (04:49):
Yeah. And that's one of the parts of the definition that I think will catch people off guard, because the definition of a covered ADMT is one that materially influences a consequential decision. And you think, oh, material influence, that means it's a major part of the decision. But then when you read the definition of material influence, it says it is anything more than a de minimis impact on the decision, including handling the application in a different way or routing it through a different set of steps or things like that. So it is very broadly inclusive. Materially influences is basically any use in deciding the application, at least as I read the law.
Kim Phan (05:24):
I agree. It doesn't necessarily define what it means or refers to with regard to de minimis, but we have to assume it's a very low bar.
Chris Willis (05:31):
Yeah. And so we have the same concept of consequential decisions, but there's also another new wrinkle in the new law. Because in the old law, a consequential decision is one that affected the provision, denial, terms, or pricing of, say, a financial service or lending service. The new definition is a little bit different from that. Can you take us through it?
Kim Phan (05:52):
Well, with regard to what? The fact that it is a little bit broader? It's anything that relates to those types of activities. Right? It's broader than what it used to be under the old law.
Chris Willis (06:01):
Right. And it specifically talks about either provision or denial of something. So, like, if somebody applies for a loan and they get it or they don't, that's clearly a consequential decision under the ADMT law. But the treatment of pricing is different in the new law, and it's subject to some strange language, and I'd love for you to talk to the audience about that.
Kim Phan (06:21):
So the pricing language, let me pull it up really quickly, and I have it right here. The idea of the impact on how you price, and specifically in the area of financial services. Right? Because you have... The concept of pricing is, I think, makes sense in, if you're talking about grocery stores, the price of an apple in one location versus another or for one consumer versus another. This is a decision for which the outcome of the decision that is materially influenced by ADMT influenced the price, cost sharing, compensation, or material terms of providing an opportunity or service. Is that what you're referring to, Chris?
Chris Willis (07:04):
But then it goes on to say that that impact on pricing and those other things sort of materially interferes with the consumer's access to the product or something like that. So it's not just it affects the price, full stop. It's it affects the price in a way that limits their access to the product. And that's the strange language I was referring to.
Kim Phan (07:22):
So the access part, the exact phrasing is "Fundamentally alters the consumer access, eligibility, or opportunity for that financial product or lending product." Right? And I don't really know what that means, "fundamentally alters?"
Chris Willis (07:38):
Yeah. So I mean, my view of it is... I mean, I'm a little confused by it, but I think the better reading of it is that ordinary risk-based pricing that creditors do in consumer loans all the time doesn't materially limit a consumer's access to a lending product just because one consumer gets a 10% rate and the other one gets 12 or 15 or whatever. It seems to me that the reading of the statute that I think is correct is that risk-based pricing isn't a consequential decision and isn't also an adverse outcome under the statute that requires notice, which we'll talk about in just a minute. But I will note that the statute explicitly calls for the Colorado Attorney General to engage in a rulemaking after vigorous public engagement, and that's set forth in the statute itself by January 1, 2027. And so the AG's office may put some gloss on that definition that's not there in the statute today.
Kim Phan (08:30):
I do appreciate that they put in black and white that they actually have to engage stakeholders, have a notice and public comment period, and at least one hearing where they can hear about this. But I tend to agree with you, Chris. The idea of fundamentally altering whether or not a consumer has access to eligibility or the opportunity to get financial services or lending, whether or not a product's even available to a consumer, their eligibility can... I don't see any problem with, "a consumer is eligible for this product or not." I agree. I think there's definitely some room for interpretation there, and it's strange phrasing.
Chris Willis (09:06):
Yeah. Let's talk about something else that has been excluded from the definition of ADMT that was a big industry ask that industry got its way on in this new version of the law, and that's things relating to KYC, OFAC, and fraud prevention and identity verification. Can you talk a little bit about that?
Kim Phan (09:23):
Sure. I do want to point out, of the exceptions, there are a lot more of them. There are plenty of new exceptions in there. They did remove a few, right? The small business exception is now gone for businesses with less than 50 full-time employees. There's no more safe harbor if a company was complying with NIST's AI governance framework or the ISO AI framework. But there's plenty of new positive ones, right? Administrative uses of ADMT are fine. Chatbots with some conditions are fine. Advertising, marketing. But those specifically with regard to specific ties to federal requirements, I think, is greatly appreciated by the industry. There was always sort of general language with regard to complying with other laws and regulations, but having it in clear, expressly stated that BSA/AML, Patriot Act, FCRA red flags, and more business-friendly processes like fraud detection and ID verification, those are all laid out very clearly in the new act with regard to being out for purposes of having to comply with these new requirements.
Chris Willis (10:31):
Right. And they're full exclusions as opposed to the way that it was phrased in the 2024 law, which is fraud is excluded as long as it's not making a consequential decision. So it had this circular definition that didn't do anybody any good. Now we don't have that circular definition anymore.
Kim Phan (10:45):
Yes, very clearly out, which is great.
Chris Willis (10:48):
So we're celebrating that. High five to everybody on that very wise decision by the Colorado legislature. Let's talk about, though, one area that I think may be a little confusing. It is to me and maybe to the industry as well, and that is the concept of adverse outcome. We're gonna use that word because that's the word used in the statute, not to be confused with adverse action under ECOA and the Fair Credit Reporting Act, because there is an adverse outcome disclosure requirement in the statute, and it may or may not be very coextensive with that that we're used to as adverse action under Reg B. So, Kim, can you just talk a little bit about that?
Kim Phan (11:25):
Sure. So adverse outcome is a new definition, where it would have been great if they tried to align this more closely with the other terminology, adverse action, that's already used in existing laws like, as you mentioned, ECOA and FCRA. But the concept is similar, right? The idea that if a business uses ADMT in a way that results in a negative consequential decision to that consumer, then the deployer of that ADMT would need to send the consumer a notification laying out their rights with regard to what they can do as a next step after receiving that adverse outcome. There is very, very helpful, clear language that says if you are already going to send an FCRA, ECOA adverse action notice and it conforms with what you're required to send with regard to Colorado, you can use the same communication so that you're not sending the consumer two or three different notifications about the same activity.
Chris Willis (12:23):
Yeah. And that's nice. But what it doesn't answer is that the concept of adverse action under ECOA has a very different trigger and different exceptions to it. ECOA adverse action is triggered by the creditor refusing to grant credit or granting it on substantially the same terms as requested by an applicant in an application. And so there are plenty of instances where creditors don't give adverse action notices because they may have approved a credit application, but there weren't specific terms requested in the application, for example. Likewise, ECOA and Reg B have an exception that if you make a counteroffer to a consumer, like, you don't approve what they ask for, but you say, "I'll approve this instead," and the consumer accepts and uses the credit, no adverse action notice. But there's no counteroffer exception in the Colorado law. And so it's not clear at this point whether or not the Colorado law will require adverse outcome notifications in places and times when creditors do not make adverse action notices available under the federal laws that you talked about. And part of the reason for that question is because the legislature explicitly acknowledges in the statute itself that there will be differences in these adverse outcome notifications between different industries, and they want the Attorney General to take those into account and specify what each different industry is supposed to do. And the legislature specifically said to the AG's office, "You need to do this rulemaking by January 1, 2027," subject to the notice and comment and engagement process, Kim, that you mentioned. So we have a lingering, yet-to-be-answered question about what those regulations will show on adverse outcome because it is specifically called for by the legislation. So we all have to hold our breath and sort of engage with the Colorado Attorney General's office about this topic.
Kim Phan (14:12):
The AG rulemaking hopefully will be industry-specific. Like, "This is what the financial services industry needs to do in this scenario." The reason being is one of the consumer rights that has to be included in the adverse outcome notice is the ability for the consumer to review the information that was fed into the ADMT, correct any information that may have been incorrect, and then require that the business who used the ADMT reconsider the original decision with corrected information. And that can be a very time-consuming and burdensome process for businesses, especially those that are moving very, very quickly to make these types of decisions that are sometimes instantaneous, and then being bogged down by this review process. But luckily, there is language in there that says that that right is limited to the extent commercially reasonable. What any of that means in the financial context, I'm hoping will be illuminated on in the AG rules.
Chris Willis (15:11):
Well, and that brings up another topic too, because the concept of sort of a human appeal of a consequential decision was present in the 2024 version of this law. And the human review aspect is sort of beefed up in the 2026 version because now they call it something like meaningful human review or something like that. And there's a big long section of the statute that defines what it means, and it definitely requires full-on reconsideration of a decision without real deference to the automated decision. But as you said, Kim, fortunately, it says that that meaningful human review should only be made available to consumers who are contesting a consequential decision to the extent it is, "commercially reasonable." I personally don't think it's commercially reasonable to have a creditor with an automated loan application decision process to go and do that kind of human review of any application. And frankly, from a fair lending standpoint, it would surprise me if the Colorado AG's office would want to inject that level of judgmental underwriting into an otherwise objective automated process. But we will just have to see what they say in those regulations.
Kim Phan (16:20):
Yeah, I found it interesting that the standard for what they consider meaningful human review is so robust. It goes even above and beyond what California in their ADMT regs require. You have to have knowledge of this specific situation, knowledge of the technology that feeds and informs the ADMT, and review all the underlying materials to evaluate whether or not you're supposed to overturn the ADMT output or not. Right? That is not the basic line agent that could handle that in a financial institution.
Chris Willis (16:50):
No, seriously. And I think now's probably a good time, Kim, since you brought up the comparison to the California CCPA ADMT regulations, the phrase automated decision-making technology, that framework was really borrowed from the CCPA regulations into this statute. And I'd love for you to talk to the audience about any sort of similarities or differences between the definitions between California and now the new Colorado law.
Kim Phan (17:14):
Well, I think it's a token effort to try to align the states with each other. Right? We already know that the Trump administration is putting pressure on the states in their efforts to try to regulate artificial intelligence in a patchwork way that doesn't follow a national standard or framework. So it may have been just an effort by Colorado to try to look like they're aligning with California, the other major player in this space right now. Again, that's about where it ends. Right? They use the ADMT terminology, but they essentially use their old definition of AI. So there's not a ton of difference there, but I think it is at least nice that there's a token recognition that these states have set up pretty different regimes for this.
Chris Willis (18:01):
Okay. Let's talk about two other aspects of the revised law. First of all, there's now a specific sort of notice and cure period when the Attorney General may pursue an enforcement action under the statute. And the Attorney General, we should mention, is the only one with enforcement authority under the statute. It is not enforceable in a private right of action. And the statute wants us to understand that so much that it says it about three times. Talk about this notice and cure provision, Kim, in this statute, because I think that's important.
Kim Phan (18:28):
Well, what I really appreciate about the notice and cure period, and there was some notice and cure in the prior law, but what I really appreciate is the reality that the Attorney General actually has to do their job and figure out when companies are, let's say, acting up and not complying with the law to pursue an enforcement action. Because in the prior law, companies were obligated to affirmatively notify the Attorney General. "Here's all the AI we're using. Here's what happens when it goes wrong. Hey, we just had an issue, AG, we want to tell you all about it." Right? They had to affirmatively take all of these steps to keep the AG in the loop. And now the AG actually has to investigate if they think there's something happening and issue an opportunity for companies to fix whatever issue's been identified. And I believe under the new law, they have 60 days to do so before the Attorney General can pursue an enforcement action.
Chris Willis (19:22):
Yeah, although there's an exception to that if the Attorney General finds that it's a repeat violation or it's an intentional violation of the law. But I think the expectation is generally that 60-day period will be afforded before enforcement is sought. Let's close out the discussion by talking about the effective date. A lot of the industry was getting nervous because the 2024 law, by virtue of a small amendment that happened in the fall of 2025, had a new effective date of June 30, 2026. Now we have yet another effective date, which I'd love for you to tell the audience about, but it's also subject to some slippage based on some litigation that's going on. So can you just tell the audience about all that? They need to know.
Kim Phan (19:58):
Sure, of course. So the new date is January 1, 2027, and that date is pretty much set in stone. Right? So this was passed by the Colorado legislature the day before they were going to adjourn for the year. And they won't come back into session until later in January 2027. So January 1 is when this law will go into effect. Now, enforcement is a little bit delayed. There is a current litigation that's ongoing with regard to a challenge to the Colorado AI Act in its prior form. Right? Question whether or not that's moot because of the amendments. But in that litigation, the Colorado Attorney General's office had already committed to not bringing enforcement action under the prior law until they had issued their regulations, the court had an opportunity to review them, lift the injunction in that case, and then another two weeks after that. So we are looking at at least some leeway between when this will actually go into effect and potential enforcement activity. Because, again, the Attorney General's rules are now only required to be issued by January 1, 2027. Presumably, a company's not gonna be able to comply in one day.
Chris Willis (21:10):
Right. And the important thing is, even though, as you noted, that litigation that's pending had to do with the old version of the law, the 2024 version, the stipulation by Attorney General Weiser and the plaintiffs in that case and the order of the court that was entered on that stipulation, applies explicitly to the 2024 law or any replacement law, which that's what this is. And so we have a timeline now that is uncertain. There's two principal uncertainties about it. One, the first trigger of it is when the Attorney General's office finishes its rulemaking that's required by the statute. It has a deadline of January 1, 2027, but it might do it sooner than that. When that happens, the plaintiffs then have 28 days to sort of renew their motion for a preliminary injunction, and then the court has an undetermined period of time to decide that motion. And then after that decision, assuming that the law is not enjoined, the Attorney General cannot commence enforcement for another 14 days after the court's ruling. Now, of course, that also could be affected by appeals and what the substance of the ruling itself might be. So the point is there could be a lengthy period of non-enforcement of the law after January 2027, or there could not be. We don't know at the moment, so we can't count on that, is what I'm saying.
Kim Phan (22:21):
I find it interesting that you have any faith that the Attorney General will actually meet that January 1, 2027 deadline to get those regs out. It's possible, but I also see it possibly being delayed.
Chris Willis (22:31):
Well, I'm just envisioning that the Attorney General's office had advance copies of this version of the legislation and had started working on the regulations before it was even passed, and so that might enable them to put them out sooner than later. But a lot of time did go by under the 2024 statute without those rules, even proposed rules, being put out. So I understand the basis of your skepticism, Kim. Okay, I think that's probably enough in terms of the highlights of the new Colorado ADMT Act. Kim, thank you very much for joining me to talk about this today. And you know that we will be updating our listeners and our readers on our blog and on this podcast with any further developments on this issue, like proposed regulations or public hearings or anything else that happens with respect to this law. So, thank you to our audience for listening today as well. Don't forget to visit and subscribe to our blogs, TroutmanFinancialServices.com and ConsumerFinancialServicesLawMonitor.com. And while you're at it, we'd appreciate it if you'd visit us on the web at our website, troutman.com, and add yourself to our Consumer Financial Services email list, because we do send out some pretty helpful alerts and advisories from time to time, as well as occasional invitations to our industry-only webinars. And of course, stay tuned for a great new episode of this podcast hitting your podcast feed every Thursday afternoon. Thank you all for listening.
Copyright, Troutman Pepper Locke LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper Locke. If you have any questions, please contact us at troutman.com.