As financial institutions increasingly look toward artificial intelligence to streamline operations, cut costs, and process applications faster, state regulators are moving quickly to put guardrails around the technology. Colorado lawmakers have released proposed rules under Senate Bill 26-189, setting strict compliance standards for businesses that use automated decision-making technology (ADMT) in "consequential decisions"—a sweeping category that places mortgage lending, financial services, housing, and loan servicing directly in the regulatory crosshairs.
While consumer advocates and lawmakers champion the legislation as a necessary step toward transparency and fairness, mortgage industry experts, compliance attorneys, and trade groups are sounding the alarm. They warn that the proposed rules are overly broad, potentially duplicative of federal statutes, and complex enough to stifle the very technological innovation lenders rely on to remain competitive.
Main Facts
Senate Bill 26-189 establishes a comprehensive compliance framework for both developers and "deployers" of automated decision-making technology when that technology "materially influences" consumer outcomes. Set to take effect for consequential decisions made on or after Jan. 1, 2027, the law covers a vast array of sectors, with the financial and mortgage lending industries heavily impacted.
- Broad Definition of ADMT: The legislation defines ADMT as any technology that processes personal data to generate information utilized to make, guide, or assist in consequential decisions regarding an individual.
- Covered Life Cycle: Industry experts note that the law’s reach extends well beyond initial loan origination. It covers the entire mortgage life cycle—from the initial gathering and assessment of borrower data to underwriting, decision-making, and downstream loan servicing, including loss mitigation and foreclosure evaluations.
- Developer vs. Deployer Responsibilities: Developers of covered ADMT must provide deployers with comprehensive documentation detailing intended uses, training data categories, known limitations, and instructions for human review. Both parties are required to retain compliance records for a minimum of three years.
- Consumer Rights & Disclosures: Lenders must provide clear and conspicuous notice before utilizing ADMT to influence a consequential decision. If a consumer faces an adverse outcome, deployers must supply a plain-language explanation within 30 days. Furthermore, consumers gain the right to request corrections to inaccurate personal data and demand meaningful human review.
- Enforcement Mechanism: The bill does not create a private right of action, meaning individual borrowers cannot sue lenders directly solely for violating the statute. Instead, enforcement is restricted to the Colorado attorney general and state regulators, who generally must provide a 60-day cure period for correctable violations.
Chronology and Timeline of Implementation
The rollout of Senate Bill 26-189 follows a deliberate timeline, giving financial institutions a narrow window to overhaul their vendor management systems, technology infrastructure, and consumer disclosure workflows ahead of the enforcement date.
- Early 2026 (Rulemaking and Feedback): Colorado lawmakers and regulatory bodies release the proposed rules governing ADMT, prompting immediate feedback and concern from major financial trade organizations, including the Mortgage Bankers Association (MBA).
- Throughout 2026 (Compliance Preparation): Lenders and technology vendors enter a critical preparation phase. Legal experts advise deployers to await comprehensive compliance checklists from software vendors and begin auditing internal data security frameworks.
- Jan. 1, 2027 (Effective Date): The statutory requirements take full effect. All consequential decisions influenced by ADMT on or after this date must comply with documentation, disclosure, and human review mandates.
- Post-2027 Enforcement Window: Regulators monitor compliance. For minor or technical violations, the Colorado attorney general is generally mandated to issue a 60-day notice and a right-to-cure period before filing formal enforcement actions, unless willful or repeated non-compliance is uncovered.
Supporting Data and Industry Context
The mortgage industry is navigating a delicate balancing act. On one hand, automated underwriting systems (AUS), algorithmic pricing models, and AI-driven document sorting have dramatically reduced origination times and operational costs for independent mortgage banks (IMBs) and depository institutions alike. On the other hand, the sheer volume of data processed daily creates massive exposure under state-level privacy and AI laws.
According to compliance evaluations from prominent legal practices and trade groups:
- The Servicing Spectrum: Financial compliance specialists emphasize that automated workflows are deeply embedded in modern loan servicing platforms. Automated triggers for default notifications, loss mitigation tracking, and foreclosure reviews all risk falling under the "consequential decision" umbrella.
- Vendor Dependency: With developers required to pass down rigorous documentation regarding training data and limitations, lenders are heavily dependent on third-party software vendors. A failure by a vendor to supply accurate compliance guidelines could leave mortgage lenders exposed to regulatory penalties.
- Federal Overlap: Existing federal regulations—specifically the Equal Credit Opportunity Act (ECOA) and the Fair Credit Reporting Act (FCRA)—already govern adverse actions and credit scoring transparency. The added layer of state-specific AI rules creates a complex compliance matrix that lenders must navigate without running afoul of conflicting mandates.
Official Responses and Stakeholder Perspectives
As the proposed rules circulate through legal and financial circles, industry stakeholders have voiced a mixture of cautious critique, regulatory exhaustion, and strategic relief.
The Mortgage Bankers Association (MBA)
In a newsletter published to members, the MBA outlined major concerns regarding the ambiguity of the proposed framework. The organization stressed that the rules fail to adequately define what constitutes ADMT or a consequential decision, leaving lenders in the dark regarding which specific IT processes trigger compliance obligations.
While the MBA welcomed the provision allowing creditors to combine ADMT disclosures with adverse-action notices required under ECOA and FCRA, the trade group called for deeper refinements. Specifically, the MBA requested clearer guidelines on when consumer requests for human review can be rejected as "commercially unreasonable" and pushed for distinct delineations between developer and deployer liabilities.
Legal and Regulatory Experts
Mitch Kider, chairman and managing partner of Weiner Brodsky Kider PC, raised substantial concerns over the operational burden of mandatory human reviews.
"If [their] standard is going to be that the burden is on the user to show that a full review of an underwriting determination has to be done each and every time a consumer asks because they were adverse, it’s no different than having a manual underwrite done on every loan — and that becomes somewhat problematic," Kider noted.
Kider also criticized the piecemeal nature of state-by-state AI regulation, arguing that a unified federal standard would be far more efficient and less disruptive to interstate commerce.
Meanwhile, Wendy Lee, a partner at Buchalter specializing in financial services and regulatory compliance, highlighted the expansive nature of the mortgage life cycle under the rules. She pointed out that lenders must look closely at how automated tools interact with their operations from end to end.
"If I was in the middle of deploying any technology in lending right now, I would be waiting for my vendor to send me basically a compliance checklist," Lee advised lenders.
However, Lee noted one major victory for the industry: the absence of a private right of action. By preventing individual borrowers from launching private lawsuits, the law shields lenders from opportunistic class-action litigation, leaving enforcement strictly in the hands of the state attorney general.
Implications for Mortgage Lenders and the Future of AI
The introduction of Colorado’s ADMT rules carries profound implications for how mortgage lenders adopt, test, and maintain artificial intelligence systems.
1. Compounded Cybersecurity and Threat Management
Experts warn that deploying AI in an unregulated or loosely monitored environment exponentially increases corporate risk. Lenders must protect themselves not only against algorithmic bias or compliance failures, but also against malicious actors attempting to use AI as an attack vector to manipulate automated systems or breach consumer data. Without robust information security programs constantly auditing automated workflows, the integration of advanced AI could backfire on financial institutions.
2. The Threat of Innovation Stifling
A prevailing fear among industry leaders is that overly burdensome, ambiguous state laws will cool enthusiasm for technological investment. While artificial intelligence holds the promise of significant cost savings and broader credit access for consumers, complex compliance hurdles may force smaller lenders to scale back their tech ambitions. Kider warned that if regulations become too punitive, the industry risks missing out on the transformative efficiencies that automation provides.
3. Toward a Federal Standard?
As Colorado pushes forward with its pioneering framework, industry pressure is mounting for federal lawmakers to step in. Financial institutions operating across multiple states face a fragmented landscape where compliance rules shift significantly depending on geographic borders. Whether SB 26-189 serves as a blueprint for national legislation or remains a localized compliance hurdle will depend heavily on how smoothly the rules are implemented—and how aggressively the Colorado attorney general enforces them when the law goes into effect in 2027.
