Which financial services activities were "consequential decisions" under Colorado SB 24-205 (repealed)?+
The Colorado AI Act defines a consequential decision as one with a material legal or similarly significant effect on the provision, denial, cost, or terms of a financial or lending service. In practice, this captures a broad range of financial services AI use cases: consumer credit and auto loan underwriting and pricing models; mortgage eligibility and pricing AI; insurance coverage and premium determination (for insurers not covered by the SB 21-169 safe harbor); ongoing account-management models that modify credit limits or terms; small-dollar and installment lending eligibility tools; and AI used in settlement or payment-plan eligibility in debt collection. Anti-fraud tools that do not use facial recognition are expressly excluded from high-risk status. Marketing and ad-targeting tools are generally not covered unless the AI system itself determines what credit terms are presented to specific consumers. The safe harbor for banks subject to examination by a state or federal prudential regulator under published guidance is available if the guidance meets specified criteria — consult outside counsel to determine whether SR 11-7 examination programs satisfy that threshold for your institution.
What were the deployer and developer obligations under SB 24-205 (repealed) for financial institutions?+
The law draws a clear line between developers (those who build or substantially modify AI systems) and deployers (those who use AI to make consequential decisions). Most financial institutions using vendor-supplied credit-scoring, underwriting, or fraud models are deployers, not developers — but if they fine-tune or adapt a vendor model for a new purpose, they may take on developer obligations. Deployer obligations include: completing an impact assessment before deployment, annually, and within 90 days of any intentional and substantial modification; implementing a risk management policy and program aligned to NIST AI RMF, ISO 42001, or an AG-designated standard; notifying consumers at or before each consequential decision with the system's purpose, nature, and a plain-language description; offering the opportunity to correct incorrect personal data and to appeal adverse decisions with human review where technically feasible; maintaining a publicly available statement summarizing high-risk systems deployed and how algorithmic discrimination risks are managed; and disclosing discovered algorithmic discrimination to the Attorney General within 90 days. Developer obligations include providing deployers with model cards, dataset cards, and governance documentation before deployment, and notifying the AG and deployers of discovered discrimination risks within 90 days. Resellers that pass through scores without modification are likely deployers, not developers.
What did a SB 24-205 impact assessment (repealed law) contain for a lending model?+
An impact assessment under SB 24-205 must include: a statement of the system's purpose, intended use cases, deployment context, and expected benefits; a detailed analysis of known and foreseeable risks of algorithmic discrimination — unlawful differential treatment based on race, sex, religion, disability, reproductive health, veteran status, and other protected classes — and how those risks are mitigated; the categories of data processed as inputs and the outputs generated; an overview of any data used to customize the system; a description of transparency measures, including how consumers are notified; and a plan for post-deployment monitoring and user safeguards, including how issues will be tracked, reviewed, and addressed. Assessments must be retained for three years after final deployment and made accessible to the Attorney General on request. For lending-model deployers, this overlaps substantially with SR 11-7 model documentation requirements — teams that already maintain model cards, validation reports, and ongoing monitoring logs under SR 11-7 have a strong documentation foundation on which to build a SB 24-205 impact assessment.
Does Colorado SB 24-205 still apply, and what replaced it?+
SB 24-205 no longer applies. Its effective date was moved from February 1, 2026 to June 30, 2026 by SB 25B-004 (signed August 28, 2025); a federal court order blocked its enforcement on April 27, 2026; and in May 2026 Colorado enacted SB 26-189, which repealed SB 24-205 and replaced it with a notice-based law on automated decision-making technology effective January 1, 2027. SB 26-189 drops the impact-assessment and risk-management-policy duties and instead requires consumer notices, adverse-outcome explanations within 30 days, data correction and human review where commercially reasonable, developer documentation, and three-year record keeping.
How did SB 24-205 interact with SR 11-7, and does that work carry over?+
SR 11-7, issued by the Federal Reserve and OCC in 2011 and updated in 2021 to encompass AI and machine learning, requires banks to validate models, document developmental evidence, conduct ongoing monitoring, and maintain independent challenge processes. Colorado SB 24-205 imposes a parallel set of obligations at the state level — impact assessments, risk management programs aligned to NIST AI RMF or ISO 42001, and consumer disclosures — that structurally overlap with SR 11-7's three-pillar framework (conceptual soundness, ongoing monitoring, outcomes analysis). The SB 24-205 deployer documentation requirements for model cards, dataset cards, bias analysis, and monitoring plans largely mirror information banks already maintain under SR 11-7 examination expectations. Banks subject to examination by a state or federal prudential regulator under published guidance meeting specified criteria in the act may be able to claim the statutory safe harbor, potentially exempting them from some SB 24-205 obligations — consult outside counsel on whether current SR 11-7 examination programs satisfy the statutory criteria. Note that in early 2026, SR 11-7 is in the process of being superseded by SR 26-02, which introduces updated model risk expectations covering AI explainability, bias mitigation, third-party model oversight, and GenAI monitoring — the same themes that SB 24-205 addresses. Institutions aligning their model risk programs to SR 26-02 will find SB 24-205 compliance requirements significantly easier to satisfy in parallel.