On October 6, the Colorado Department of Law (DOL) released an interim draft of its proposed rules implementing the Automated Decision-Making Technology in Consequential Decisions Act (ADMT Act) and the Conversational Artificial Intelligence Services Act (Chatbot Safety Act) (the Interim Draft). As we reported in August (here), the DOL filed its initial draft on August 11 (the August 11 Draft). After receiving more than sixty comments, the DOL made what it calls “significant, substantive changes.” Our view is that some of the changes were positive, but many of the problematic aspects of the August 11 Draft remain. The DOL’s cover letter also noted that it is open to alternatives to its definition of “Financial or Lending Service.”

Where the Rulemaking Stands

The Interim Draft is not final. The Colorado Attorney General has until January 1, 2027 to finalize the rules. The formal rulemaking hearing is scheduled for October 26, and the DOL will accept comments on both the August 11 Draft and the Interim Draft until 11:59 p.m. MST that day, or until 11:59 p.m. MST on the last day of the formal rulemaking hearing if it continues beyond October 26.

Both laws take effect January 1, 2027. The DOL declined to add a formal enforcement grace period, but it said the Attorney General’s policy is to focus on egregious and intentional violations and to exercise appropriate discretion while entities work toward compliance. Under the ADMT Act, the Attorney General must provide notice and an opportunity to cure alleged violations before bringing an enforcement action, but this provision will sunset on January 1, 2030.

Key Changes

  • New “Materially Influences” framework. The most significant addition is Rule 6, which addresses when an ADMT output “materially influences” a consequential decision. An output is presumed to do so if it constrains an option set, sets a threshold, or produces a rank, score, classification, recommendation, prediction, or other inference that pertains to the affected individual, is reviewed by or used to screen information for the decision-maker, and is consistent with the outcome. A deployer can rebut the presumption by showing the output was only a “de minimis factor,” which the Interim Draft now defines as applying when other relevant factors independent of the ADMT output played a significantly larger role in a consequential decision. Financial institutions that make rule-based decisions may benefit from the example in the Interim Draft that a de minimis factor may be established by evidence that a decision was made based on the application of a hard cut-off threshold. Our view is that models used to make credit or fraud screening decisions at account opening will still be covered, and the definition of “materially influences” is unlikely to be impactful in many financial services contexts.
  • Scaled-back adverse-outcome disclosures. The Interim Draft deletes requirements in the August 11 Draft to identify the principal reasons for an adverse outcome, inferences drawn from personal data, and the consumer’s profile or risk score and underlying personal data used to generate certain inferences or scores. The disclosure now centers on the decision and the ADMT’s specific role. Saying the ADMT “automated a review of the Consumer’s Personal Data” is too vague, but according to the Interim Draft, saying it automated review of credit-report and employment-verification information is sufficient. If an automatic-denial factor applied, the disclosure must say that the applicant was automatically denied for that reason. If the outcome resulted from incomplete information, the disclosure must say that the ADMT reviewed insufficient or incomplete information, but the disclosure no longer has to identify the information needed. Deployers now have 15 days to respond to a consumer’s request for additional information about the ADMT, rather than having to make the information immediately available through a link.
  • Coordination with ECOA and FCRA. Where a deployer must give an adverse-action or risk-based pricing notice under the Equal Credit Opportunity Act (ECOA) or the Fair Credit Reporting Act (FCRA), the Colorado requirement can be met if that notice includes the additional Colorado information. The Interim Draft also lets deployers put that information in a supplemental disclosure delivered at the same time and by the same means (meaning that it would not require changes to the Regulation B Model Form, but rather can be provided as an additional page following it). The same approach applies to ECOA notices of incompleteness.
  • Reworked consumer data rights. The Interim Draft distinguishes data the deployer possesses or controls from data a third party possesses or controls. For deployer-held data, the consumer receives access instructions, and the deployer must provide the data within 45 days after the consumer makes the access request using those instructions. According to the Interim Draft, a deployer is presumed to know the source of any information that it directly receives, the source of any information a vendor utilizes to run ADMT on the deployer’s behalf, and the source of any information that was identified by name by the developer. For third-party data, the deployer must identify the third parties, the categories each holds, and provide instructions for exercising the consumer’s access rights through those third parties within 15 days of the consumer’s request, with a parallel process for corrections. The right to correct data does not extend to opinions, predictions, scores, or protected evaluations. The DOL also dropped language that would have treated a consumer’s assertion of inaccuracy as sufficient in some cases, and it now allows a deployer to decline a correction if it reasonably determines the data is more likely than not accurate so long as the deployer follows specific steps required by the Interim Draft. This eliminates one of the most significant problems we identified with the August 11 Draft. The Interim Draft also permits a deployer to withhold information that would compromise cybersecurity, fraud prevention, anti-money laundering, counter-terrorist financing, or economic sanctions compliance programs.
  • No required stay. The Interim Draft eliminates requirements in the August 11 Draft to stay an adverse outcome, where possible, while a consumer pursues correction of incorrect personal data or meaningful human review. This will matter to lenders that need to implement decisions without waiting for those processes to conclude.
  • Meaningful Human Review. Unfortunately, the human review provisions of the Interim Draft remain very problematic for financial services providers, and it continues to minimize a deployer’s right to refuse human review when doing so would be commercially unreasonable. A new example in the Interim Draft may be particularly challenging with respect to technical glitches, because it requires that a meaningful human review include re-configuring the ADMT and re-performing the decision-making process.  A revised credit card example in the Interim Draft also now has the reviewer examine the primary evidence considered by the ADMT and confirm the denial based on the consumer’s low credit score and poor payment history. The August 11 Draft said no substantive review of the underlying evidence was needed if the system worked as expected.

Our Take

The Interim Draft addresses some of our concerns with the August 11 Draft, but not all of them.

  • Helpful changes. The Interim Draft removes problematic language that would have required a deployer to accept as true a consumer’s claims of inaccuracy for information that the deployer did not receive directly from the consumer. The deployer may instead refer the consumer to the third-party source. For financial institutions, if a consumer disputes information used by the ADMT that originated from a consumer report, the financial institution can refer the consumer to the consumer reporting agency to exercise the consumer’s dispute rights under the FCRA.
  • Remaining concerns. The “materially influences” framework and the credit union example suggest the DOL takes an expansive approach to determining when ADMT materially influences a covered decision, and the example of an account being sent to a third-party collection agency is still in the Interim Draft, which identifies a situation we believe is not covered by the ADMT Act at all. Notably, the credit union example, unlike other examples, provides no insight on how a credit union could rebut that the ADMT output materially influenced the credit decision. Although eliminating the high-harm presumption gives deployers more flexibility in arguing that meaningful human review is not commercially reasonable, deployers still bear the burden of supporting that conclusion with specific evidence, and the Interim Draft still uses an example of human review that is, in our view, not commercially reasonable. In addition, the Interim Draft’s credit card example indicates that meaningful human review may require examination of the underlying evidence rather than simply confirming that the ADMT functioned as intended.

We will continue to monitor the rulemaking and the upcoming hearing on October 26.