- Key insight: Colorado's new law requires banks that use AI in decision-making to disclose and explain it, and let customers correct any inaccurate data that may have been fed into an AI model.
- Expert quote: "The concept is fair," Frank Trotter, CEO of Battle Bank in Avon, Colorado, told American Banker. "If you've been denied for one reason or another, you should at least have the opportunity to know why. It's kind of a principle of credit: you get to ask the question."
- What's at stake: Banks and their vendors may have to make significant changes to core, lending and new account-opening software.
Colorado recently watered down its AI Act, which is due to take effect in January — it narrowed the statute's scope to automated decision-making technology that materially influences "consequential decisions" including approvals for loans and new accounts.
But it remains one of the three most aggressive state AI laws (along with California and Texas) and it calls for significant changes in the way banks handle AI-influenced decisions that affect consumers.
One requirement is that financial institutions that use AI to make decisions will have to provide "clear and conspicuous" disclosure to any Colorado customers beforehand.
"If you think about this in connection with applications for lending and for opening up an account, it's pretty impactful to have to make this disclosure prior to using that information," Obrea Poindexter, a partner at the law firm Orrick, told American Banker.
What exactly "clear and conspicuous" means is contextual, Poindexter said.
"Given the context of what you're doing, whether it's applying for a loan or opening a bank account, where is it best suited to be placed?" she said. "Nine times out of 10, it's not going to be in a footnote. It's going to be presented in a way in which the consumer will notice the disclosure. I don't think that requires it to be in bold, large print, but you'll want to make sure it's something that's designed for the customer to see and notice."
A footnote in tiny print would not work, according to Scott Kosnoff, partner at Faegre Drinker.
"The proposed regulations add specifics," Kosnoff said. "Disclosures must use 'plain, straightforward language,' be readable on all devices including mobile and for printed disclosures, must be in no less than 12-point font."
A second major change involves the aftermath of a declined loan or new account. Any time a bank denies a loan or account, it already has to explain why and provide an adverse action notice under federal Regulation B. Under Colorado's new law, if an AI model materially influenced that decision, the bank has to include instructions for the consumer to request additional information about the system used for the decision, including its name, its developer, and the types, categories and sources of personal data used.
When a consumer makes that request, every data source must be identified by name, including data brokers and intermediaries. Consumers have the right to ask for all specific pieces of personal data used in the decision and be provided with a way to correct inaccurate data and obtain "meaningful" human review.
"The concept is fair," Frank Trotter, CEO of Battle Bank in Avon, Colorado, told American Banker. "If you've been denied for one reason or another, you should at least have the opportunity to know why. It's kind of a principle of credit: you get to ask the question."
He noted that at most banks, credit and account opening decisions are made by a core banking system, most likely from FIS, Fiserv or Jack Henry, and account opening software like Alloy's.
"All the vendors we all use, use AI," Trotter said. These vendors will have to come up with automated processes for complying with the new Colorado law, he said.
The granularity in the Colorado law, particularly the need to identify every data source by name, is a big deal, according to Kosnoff. The data correction and meaningful human review may require building new infrastructure, he said.
Banking software that uses AI in decision-making typically has explainability built in.
"I can go into our system, and on any denial, you can see all the factors that went into it," Trotter said. "Maybe your address doesn't match your driver's license, or there are 20 Social Security numbers associated with your driver's license, indicating fraud."
But a downside of sharing these details with consumers, Trotter pointed out, is that a criminal could pretend to be a legitimate customer with a genuine question, get adverse action reports, and reverse engineer the decisions to figure out how to beat the system.
Simply not using AI for these decisions isn't feasible, Trotter said, especially for banks that take in thousands of applications a day. Every vendor automates parts of the loan and account opening process with some form of AI, he said.
Additionally, he said, this option could have an effect on a bank's operations.
"From an efficiency standpoint, if everybody wants a human review, that sort of throws it out," Trotter said.
California and Texas also have aggressive AI laws, Poindexter said. California requires companies that deploy chatbots to make it clear to people that they are communicating with a bot and not a human. It also requires AI deployers (like banks) to provide consumers with a way to opt out of automated decision-making that replaces or substantially replaces human decision-making.
Texas is focusing on deceptive trade practices, data security and unfair AI-driven consumer targeting, Poindexter said. It also provides consumers the right to opt out of any form of solely automated processing. This might take the form of a disclosure that tells a consumer that AI would be used, and by moving forward with an application, they are consenting to it and if not, they can opt out.
Some bankers would prefer to see one federal AI law rather than 50 separate state laws.
"A patchwork of 50 different state regulatory regimes — particularly at a time when more than 1,200 AI-related bills were introduced in state legislatures last year alone — risks creating conflicting requirements that make it harder for responsible innovation to reach consumers," Consumer Bankers Association President and CEO Lindsey Johnson said in a statement shared with American Banker.
The group would prefer a national framework "that protects consumers, provides clear rules of the road" and lets banks continue to invest in new technologies.
Trotter mostly agrees. "If you could have federal preemptive legislation, that would be very comfortable for all of us if we liked it," he said. Another possibility is that several state attorneys general could get together and create model legislation for all the states to follow, he said.
Experts agree, however, that it's unlikely that Congress will pass an AI law anytime soon.
In the meantime, "banks should invest in an AI governance framework that gives them a good story to tell — one that demonstrates they understand AI-related risks and have taken reasonable steps to mitigate them," Kosnoff said. They should also watch agentic AI closely — "these systems can act autonomously with limited human oversight, creating risks of unauthorized actions and data exposure that can occur at scale," he said.
