How Senate Bill 26-189 reshapes AI compliance expectations for lenders and financial institutions

Colorado captured national attention in 2024 when it became the first state to enact a comprehensive artificial intelligence law governing the use of AI in consequential decisions, including lending, housing, employment, and insurance.

The original legislation established an expansive compliance framework for organizations using AI systems to make or substantially assist in making decisions affecting consumers' access to credit and other critical services.

Following significant feedback from industry groups, financial institutions, and technology stakeholders, Colorado lawmakers have now substantially revised that framework.

In May 2026, Colorado enacted Senate Bill 26-189, replacing many of the original law's most burdensome requirements with a more streamlined approach centered on transparency, explainability, and consumer rights.

From Broad AI Governance to Consumer Transparency

The original law imposed extensive compliance obligations on organizations using AI systems in consequential decision-making processes. These obligations included:

• Risk management programs
• Impact assessments
• Consumer notices
• Documentation requirements
• Duties designed to identify and prevent algorithmic discrimination

The revised law shifts the focus away from broad governance mandates and toward the use of automated decision-making technology (ADMT) that materially influences consequential decisions, including lending decisions.

Key Requirements Under the Revised Law

Organizations using covered technologies should be prepared to address several core requirements.

Consumer Notice

Consumers must receive notice when automated technology materially influences a consequential decision.

Access to Information

Consumers may request information regarding decisions influenced by automated systems and the role those systems played in the decision-making process.

Human Review and Error Correction

The law provides consumers with opportunities to correct inaccurate information and seek human review under certain circumstances.

Documentation and Transparency

Organizations using covered technologies must maintain appropriate documentation and support transparency obligations relating to their use of automated decision-making tools.

What Was Removed?

The revised law eliminates several provisions that generated significant concern among lenders and other regulated entities.

Among the requirements removed or substantially scaled back are:

• Mandatory risk management programs
• Annual impact assessments
• Broad duties of care related to algorithmic discrimination

The result is a framework that places greater emphasis on consumer awareness and transparency while reducing prescriptive compliance obligations.

Why This Matters for Mortgage Lenders

Although Colorado's revisions reduce compliance burdens, lenders should not view the changes as a retreat from AI oversight.

Rather, the revised law reflects an emerging regulatory approach that prioritizes:

• Transparency
• Explainability
• Consumer rights
• Accountability for automated decision-making

As lenders continue to deploy AI and automation across underwriting, marketing, customer service, fraud detection, quality control, and property valuation, regulators increasingly expect institutions to understand how these technologies operate and how they affect consumers.

What Lenders Should Do Now

Organizations should take this opportunity to evaluate how AI and automated decision-making technologies are being used throughout the lending lifecycle.

Key considerations include:

• Identifying where AI or automated systems influence lending decisions
• Reviewing vendor oversight and third-party risk management processes
• Assessing consumer notification practices
• Establishing procedures for information requests and human review
• Maintaining documentation supporting the use of automated technologies

Colorado's revised framework may also serve as a model for future state legislation, making these assessments valuable even for institutions operating outside Colorado.

Looking Ahead

Colorado's AI law has evolved considerably since its original enactment, but it remains one of the most closely watched state AI regulatory frameworks in the country.

While the compliance burden has been reduced, the underlying message remains clear: organizations using AI in consequential decisions should be prepared to explain how those technologies influence outcomes and how consumers can seek recourse when concerns arise.

For lenders, now is an appropriate time to assess AI governance, transparency practices, and operational readiness as state regulators continue to shape the future of AI oversight.