Sharpen Your Edge: Highlights from The Data Edge - Colorado's Proposed ADMT Regulations: What Matters Now

Colorado's automated decision-making technology ("ADMT") law is scheduled to take effect on January 1, 2027. With proposed regulations under consideration, businesses have a short window to identify where the law may affect their products, decisions, and compliance processes.

During the September installment of The Data Edge, Hudson Cook Partners Megan Nicholls and Webb McArthur discussed the proposed regulations and steps businesses can take while the rulemaking continues.

Look Beyond Tools Labeled "AI."

ADMT is broader than artificial intelligence. It can include technology that uses personal data and computation to produce a prediction, recommendation, classification, ranking, or score that helps guide a decision about an individual.

The discussion focused on consequential decisions, including those involving financial or lending services, housing, employment, and education. The speakers also described exclusions for certain uses, such as fraud prevention and identity verification, and for tools that merely organize or present information for human review without producing an output that materially influences a decision.

KEY TAKEAWAY: Inventory the tools and processes used in consequential decisions. Focus on what each output does and how it affects the decision, regardless of whether the tool is called AI.

Identify Your Role in Each Process.

The proposed regulations distinguish among developers, deployers, and "midstream developers." A midstream developer incorporates or modifies an existing model before providing a product to another entity for use.

These roles matter because documentation must move through the chain. A company may have different roles across different products or processes, and a deployer may need information from its vendors to understand how a tool uses personal data and produces its output.

KEY TAKEAWAY: Determine your role for each product or process, then identify what documentation you need to obtain, maintain, and share.

Watch the "Materially Influences" Standard.

A central question remains open: When does an ADMT output materially influence a consequential decision? Colorado is considering different approaches to defining when an output's effect is too minor to bring it within the law.

The final standard could significantly affect which tools and uses fall within scope. Businesses assessing their systems now should document how outputs are used and be prepared to revisit those assessments when the regulations are final.

KEY TAKEAWAY: Do not assume that human involvement takes a system outside the law. Examine whether the tool's score, ranking, recommendation, or other output affects the outcome or the way the decision is made.

Plan for Notices and Human Review.

The speakers described notice requirements at several points in the consumer journey: before covered ADMT is used, after an adverse decision, and through an ongoing public notice. Businesses may need to review existing adverse action notices alongside the final Colorado requirements and understand which personal data their ADMT uses.

The law also calls for an opportunity for meaningful human review after an adverse outcome to the extent commercially reasonable. The proposed rules address the independence of the reviewer, the review process, and response timing. A meaningful review cannot simply default to the original ADMT output.

KEY TAKEAWAY: Map where notices belong in your process and who will deliver them. Establish how consumers can request human review and how an independent reviewer will assess the decision.

Prepare While the Rules Are Pending.

The proposed regulations are scheduled for discussion at an October 26 hearing. In the meantime, organizations can identify potentially covered uses, gather vendor documentation, review notice and retention practices, and plan for training and human review.

KEY TAKEAWAY: Use the remaining time to build an inventory and assign responsibility for the work. Revisit those plans once Colorado resolves the open questions in the final regulations.

Looking Ahead.

Colorado's ADMT requirements could reach well beyond tools commonly described as AI. For consumer financial services companies, the immediate task is to understand where technology influences consequential decisions and whether existing documentation and consumer processes can support the new requirements.

For questions about Colorado's ADMT law, the proposed regulations, or their potential effect on your business, please contact Megan Nicholls or Webb McArthur.

Want more practical insights on data compliance, artificial intelligence, privacy, consumer reporting, fair lending, and emerging regulatory developments? Join us for an upcoming episode of The Data Edge. Register here.

Stay Sharp. Stay Compliant. Find Your Edge.

Hudson Cook, LLP provides articles, webinars and other content on its website from time to time provided both by attorneys with Hudson Cook, LLP, and by other outside authors, for information purposes only. Hudson Cook, LLP does not warrant the accuracy or completeness of the content, and has no duty to correct or update information contained on its website. The views and opinions contained in the content provided on the Hudson Cook, LLP website do not constitute the views and opinion of the firm. Such content does not constitute legal advice from such authors or from Hudson Cook, LLP. For legal advice on a matter, one should seek the advice of counsel.