Colorado Tightens AI Disclosure Rules for Banks

Colorado first enacted SB 24-205 in 2024 to address algorithmic discrimination in consequential decisions, including access to financial and lending services. The state rewrote that framework through SB 26-189 in 2026, focusing on automated decision-making technology that processes personal data. For banks, the law raises operational stakes around loan approvals, account access and other customer decisions, while requiring technology vendors to document intended uses, training-data categories, known limitations and appropriate human oversight.

Governor Jared Polis signed SB 26-189 on May 14, 2026, and the new requirements take effect Jan. 1, 2027. Banks must give clear notice when customers interact with covered technology and, after an adverse outcome, explain within 30 days what was decided and the role automation played. Customers may request the personal data used, correct factual errors and seek meaningful human review. Developers and deployers must retain compliance records for at least three years.