The Colorado Automated Decision-Making Technology Law ("Colorado ADMT law") will take effect on January 1, 2027. The Colorado ADMT law repeals and replaces the Colorado artificial intelligence law, which was discussed in the following articles.
This article discusses Colorado ADMT law deployer obligations, including notice and post-adverse outcome disclosure and record-keeping, as well as consumer rights.
Deployer Obligations
Notice and Post-Adverse Outcome Disclosure
Prior to a deployer using a covered ADMT to materially influence a consequential decision, the deployer shall provide a clear and conspicuous notice to a consumer that the deployer used or will use a covered ADMT in a consequential decision affecting the consumer and instructions regarding how the consumer may obtain the additional information described herein.
A deployer must maintain a prominent public notice that is reasonably accessible at points of consumer interaction, including through a link or posting that is reasonably proximate to the interaction or transaction in which a consequential decision may occur.
If a deployer uses a covered ADMT to materially influence a consequential decision that results in an adverse outcome for a consumer, the deployer shall provide the following within 30 days after making the decision.
A plain language description of the consequential decision and the role the covered ADMT played in the consequential decision;
Instructions and a simple-to-follow process to request additional information about the covered ADMT and the inputs, including the name of the covered ADMT, the covered ADMT version number, if applicable, the covered ADMT developer, and the types, categories, and sources of personal data used, to the extent the deployer receives the necessary information from the developer under the Colorado ADMT law; and
An explanation of the consumer rights described in the Colorado ADMT law and how to exercise them.
Adverse outcome means a decision that does the following.
Denies, terminates, revokes, or materially reduces or restricts a consumer's access to, eligibility for, selection for, compensation for, or the provision of an opportunity or service; or
Results in materially less favorable differentiated price, cost, compensation, or other material terms that are reasonably likely to materially limit, delay, or effectively deny, or otherwise fundamentally alter, a consumer's access to, eligibility for, selection for, compensation for, or the provision of an opportunity or service compared to terms offered to similarly situated consumers. If a decision outcome imposes materially less favorable differentiated pricing or terms, the decision outcome materially influences price, cost sharing, compensation, or material terms.
On or before January 1, 2027, the Colorado attorney general shall adopt rules to clarify and implement the post-adverse outcome disclosure obligations described above.
Nothing herein requires a deployer to disclose a trade secret or information protected from disclosure by state or federal law. If a deployer withholds information pursuant to the immediately preceding sentence, the deployer shall notify the consumer.
A creditor, with respect to a consequential decision involving the offering, the denial, the pricing, the servicing, or other material terms of credit, that is required to provide and that provides a notice to a consumer pursuant to the federal Equal Credit Opportunity Act, 15 U.S.C. § 1691 et seq., and its implementing regulations, including Regulation B, 12 CFR 1002, and, when applicable, the federal Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq., complies with the notice or disclosure obligations hereof that relate to the same decision or adverse outcome if the notice provided to the consumer pursuant to such federal laws and regulations also satisfies the notice or disclosure obligations hereof. If a creditor complies with such federal laws and regulations and complies herewith, the creditor is not required to provide a separate or duplicative notice pursuant to this paragraph.
Nothing herein shall be construed to require a creditor to provide any notice or disclosure in a manner that is prohibited by federal law. A notice that complies with such federal laws and regulations and complies herewith may include a brief statement indicating that a covered ADMT was used to materially influence the consequential decision and instructions for how the consumer may obtain any additional information or exercise any rights provided under the Colorado ADMT law.
The Colorado ADMT law shall not be construed to require a person to make a disclosure, provide an explanation, or furnish information to a consumer to the extent doing so would be prohibited by federal law or would compromise the confidentiality or integrity of cybersecurity, fraud prevention, anti-money laundering, counter-terrorist financing, or economic sanctions compliance programs required by law.
For a consequential decision relating to education, a deployer that is subject to the federal Family Educational Rights and Privacy Act of 1974 (FERPA), 20 U.S.C. § 1232g et seq., and its implementing regulations satisfies the notice and disclosure obligations hereof by providing notice and disclosures through processes and channels that are consistent with FERPA and the deployer's FERPA notices and student record access procedures, including, where applicable, notice to a parent or guardian or an eligible student. A deployer that is subject to FERPA is not required to establish a separate or duplicative notice or disclosure process if the deployer has established a notice or disclosure process to comply with FERPA.
A deployer shall provide the notice and disclosure required by the Colorado ADMT law in a manner that is reasonably accessible to consumers with disabilities and consumers with limited English proficiency, consistent with applicable state and federal law.
Record-Keeping
A deployer shall retain, for not less than 3 years after the date of a consequential decision or for a longer period if required by applicable state or federal law, records reasonably necessary to demonstrate compliance with the Colorado ADMT law. Records may include, as applicable, covered ADMT version identifiers, changelogs, and documentation of material mitigation changes.
Consumer Rights
When a consumer experiences an adverse outcome resulting from a consequential decision in which a covered ADMT materially influences the consequential decision, the consumer may request and the deployer shall provide in response to the request the following.
Instructions for requesting personal data and correcting factually incorrect or materially inaccurate personal data used in a consequential decision that used a covered ADMT consistent with Col. Rev. Stat. § 6-1-1306; and
An opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable.
The immediately preceding paragraph does not require correction of opinions, predictions, scores, or protected evaluations. For the purposes of the immediately preceding paragraph, the exceptions to the definition of consumer in Col. Rev. Stat. § 6-1-1303 (6)(b) and the exceptions in Col. Rev. Stat. §§ 6-1-1304 (2)(k), (2)(n), and (2)(o) do not apply to the right to request correction of factually incorrect or materially inaccurate personal data pursuant thereto.
For a consequential decision relating to education, a deployer that is subject to FERPA complies with the consumer rights obligations described above through the deployer's existing student record inspection, review, and amendment procedures and any applicable district complaint or appeal process, if the deployer offers a reasonable mechanism for a parent, guardian, or eligible student to request correction of materially inaccurate personal data and reconsideration where applicable under the Colorado ADMT law. A deployer that is subject to FERPA is not required to establish a separate or duplicative correction or human review and reconsideration process if the deployer has established a correction or human review and reconsideration process to comply with FERPA.
On or before January 1, 2027, the Colorado attorney general shall adopt rules to clarify and implement the consumer rights obligations described above.
Opinions expressed in Expert Commentary articles are those of the author and are not necessarily held by the author's employer or IRMI. Expert Commentary articles and other IRMI Online content do not purport to provide legal, accounting, or other professional advice or opinion. If such advice is needed, consult with your attorney, accountant, or other qualified adviser.
The Colorado Automated Decision-Making Technology Law ("Colorado ADMT law") will take effect on January 1, 2027. The Colorado ADMT law repeals and replaces the Colorado artificial intelligence law, which was discussed in the following articles.
This article discusses Colorado ADMT law deployer obligations, including notice and post-adverse outcome disclosure and record-keeping, as well as consumer rights.
Deployer Obligations
Notice and Post-Adverse Outcome Disclosure
Prior to a deployer using a covered ADMT to materially influence a consequential decision, the deployer shall provide a clear and conspicuous notice to a consumer that the deployer used or will use a covered ADMT in a consequential decision affecting the consumer and instructions regarding how the consumer may obtain the additional information described herein.
A deployer must maintain a prominent public notice that is reasonably accessible at points of consumer interaction, including through a link or posting that is reasonably proximate to the interaction or transaction in which a consequential decision may occur.
If a deployer uses a covered ADMT to materially influence a consequential decision that results in an adverse outcome for a consumer, the deployer shall provide the following within 30 days after making the decision.
Adverse outcome means a decision that does the following.
On or before January 1, 2027, the Colorado attorney general shall adopt rules to clarify and implement the post-adverse outcome disclosure obligations described above.
Nothing herein requires a deployer to disclose a trade secret or information protected from disclosure by state or federal law. If a deployer withholds information pursuant to the immediately preceding sentence, the deployer shall notify the consumer.
A creditor, with respect to a consequential decision involving the offering, the denial, the pricing, the servicing, or other material terms of credit, that is required to provide and that provides a notice to a consumer pursuant to the federal Equal Credit Opportunity Act, 15 U.S.C. § 1691 et seq., and its implementing regulations, including Regulation B, 12 CFR 1002, and, when applicable, the federal Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq., complies with the notice or disclosure obligations hereof that relate to the same decision or adverse outcome if the notice provided to the consumer pursuant to such federal laws and regulations also satisfies the notice or disclosure obligations hereof. If a creditor complies with such federal laws and regulations and complies herewith, the creditor is not required to provide a separate or duplicative notice pursuant to this paragraph.
Nothing herein shall be construed to require a creditor to provide any notice or disclosure in a manner that is prohibited by federal law. A notice that complies with such federal laws and regulations and complies herewith may include a brief statement indicating that a covered ADMT was used to materially influence the consequential decision and instructions for how the consumer may obtain any additional information or exercise any rights provided under the Colorado ADMT law.
The Colorado ADMT law shall not be construed to require a person to make a disclosure, provide an explanation, or furnish information to a consumer to the extent doing so would be prohibited by federal law or would compromise the confidentiality or integrity of cybersecurity, fraud prevention, anti-money laundering, counter-terrorist financing, or economic sanctions compliance programs required by law.
For a consequential decision relating to education, a deployer that is subject to the federal Family Educational Rights and Privacy Act of 1974 (FERPA), 20 U.S.C. § 1232g et seq., and its implementing regulations satisfies the notice and disclosure obligations hereof by providing notice and disclosures through processes and channels that are consistent with FERPA and the deployer's FERPA notices and student record access procedures, including, where applicable, notice to a parent or guardian or an eligible student. A deployer that is subject to FERPA is not required to establish a separate or duplicative notice or disclosure process if the deployer has established a notice or disclosure process to comply with FERPA.
A deployer shall provide the notice and disclosure required by the Colorado ADMT law in a manner that is reasonably accessible to consumers with disabilities and consumers with limited English proficiency, consistent with applicable state and federal law.
Record-Keeping
A deployer shall retain, for not less than 3 years after the date of a consequential decision or for a longer period if required by applicable state or federal law, records reasonably necessary to demonstrate compliance with the Colorado ADMT law. Records may include, as applicable, covered ADMT version identifiers, changelogs, and documentation of material mitigation changes.
Consumer Rights
When a consumer experiences an adverse outcome resulting from a consequential decision in which a covered ADMT materially influences the consequential decision, the consumer may request and the deployer shall provide in response to the request the following.
The immediately preceding paragraph does not require correction of opinions, predictions, scores, or protected evaluations. For the purposes of the immediately preceding paragraph, the exceptions to the definition of consumer in Col. Rev. Stat. § 6-1-1303 (6)(b) and the exceptions in Col. Rev. Stat. §§ 6-1-1304 (2)(k), (2)(n), and (2)(o) do not apply to the right to request correction of factually incorrect or materially inaccurate personal data pursuant thereto.
For a consequential decision relating to education, a deployer that is subject to FERPA complies with the consumer rights obligations described above through the deployer's existing student record inspection, review, and amendment procedures and any applicable district complaint or appeal process, if the deployer offers a reasonable mechanism for a parent, guardian, or eligible student to request correction of materially inaccurate personal data and reconsideration where applicable under the Colorado ADMT law. A deployer that is subject to FERPA is not required to establish a separate or duplicative correction or human review and reconsideration process if the deployer has established a correction or human review and reconsideration process to comply with FERPA.
On or before January 1, 2027, the Colorado attorney general shall adopt rules to clarify and implement the consumer rights obligations described above.
Opinions expressed in Expert Commentary articles are those of the author and are not necessarily held by the author's employer or IRMI. Expert Commentary articles and other IRMI Online content do not purport to provide legal, accounting, or other professional advice or opinion. If such advice is needed, consult with your attorney, accountant, or other qualified adviser.