Colorado SB 26-189: ADMT Rules for Mortgage Lenders

Last reviewed: October 28, 2026. General information, not legal advice. Quotes come from the signed act published by the Colorado General Assembly; each is followed by a plain-English line.

The act prints new law in capital letters. Quotes below use normal capitalization; the words are unchanged.

Is mortgage lending covered?

"A financial or lending service;"C.R.S. 6-1-1701(6)(d), in the list of covered domains

In plain English: Lending is one of the areas the law covers, so loan decisions can be consequential decisions.

"“Covered ADMT” means automated decision-making technology that is used to materially influence a consequential decision."C.R.S. 6-1-1701(5)

In plain English: The law reaches technology that materially influences a decision about a consumer, not every tool in the office.

Notice before use

"Prior to a deployer using a covered ADMT to materially influence a consequential decision, the deployer shall provide a clear and conspicuous notice to a consumer"C.R.S. 6-1-1704(1)

In plain English: Tell consumers up front that you use, or will use, covered ADMT in decisions about them, and how to get more information. Under 6-1-1704(2) a prominent public notice at points of interaction can satisfy this.

After an adverse outcome

"the deployer shall provide within thirty days after making the decision:"C.R.S. 6-1-1704(3)

In plain English: If covered ADMT helped produce a denial or worse terms, give the consumer a plain-language description of the decision and the ADMT's role, and a simple way to ask for more detail, within 30 days.

"A creditor ... that is required to provide and that provides a notice to a consumer pursuant to the federal “Equal Credit Opportunity Act”, 15 U.S.C. sec.1691 et seq., and its implementing regulations, including Regulation B, 12 CFR 1002, ... complies with the notice or disclosure requirements of this section that relate to the same decision or adverse outcome if the notice ... also satisfies the notice or disclosure requirements of this section."C.R.S. 6-1-1704(6)(a)

In plain English: Your ECOA and Regulation B adverse action notice can do double duty, but only if it also contains what Colorado requires. See our Regulation B page.

Correction and human review

"An opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable."C.R.S. 6-1-1705(1)(a)(II)

In plain English: After an adverse outcome, the consumer can ask for their data, correct errors, and have a person take a real second look.

Records

"A deployer shall retain, for not less than three years after the date of a consequential decision"C.R.S. 6-1-1703

In plain English: Keep records that show how you met the law for at least three years after each decision, or longer if another law requires it.

Enforcement

"The attorney general shall enforce this part 17 through the “Colorado Consumer Protection Act”"C.R.S. 6-1-1706(1)(a)

In plain English: The Colorado Attorney General enforces the act, and a violation is a deceptive trade practice.

"Violations of the disclosure requirements and consumer rights described in sections 6-1-1702, 6-1-1703, 6-1-1704, and 6-1-1705 are enforceable exclusively by the attorney general"C.R.S. 6-1-1706(1)(b)

In plain English: Only the attorney general can enforce these disclosure and consumer rights duties; the act creates no new private right of action.

Before enforcing, the attorney general must send a notice of violation when a cure is deemed possible, and the business has sixty days to cure. No cure period is required if the attorney general finds a knowing or repeated violation. That cure subsection is repealed effective January 1, 2030. The act also states: "Nothing in this part 17 creates a new private right of action." (C.R.S. 6-1-1709(1)).

A Colorado checklist for brokers and lenders

List every tool that analyzes borrower data and could materially influence a credit decision or its terms.
Ask each vendor for its ADMT documentation: name, version, purpose and data used.
Post a clear notice of ADMT use where Colorado consumers apply.
Check that your adverse action notice also covers Colorado's 30-day disclosure items.
Set up a process to correct data and offer meaningful human review.
Keep records for at least three years after each decision.
Watch for the attorney general's final rules before January 1, 2027.

Train your team on human review and records

The $699 AI Team Kit includes the AI Policy Kit, the AI Best Practices Playbook on human review, recordkeeping and disclosures, a 25-slide staff training deck with a facilitator guide and sign-off log, vendor AI scorecards, and a full year of Small Shop portal access with the state AI law tracker. Kits are templates; have counsel confirm your Colorado obligations.

Get the AI Team Kit, $699 AI Policy Starter, $99 AI Policy Kit, $349 Compare kits

Frequently asked questions

When does Colorado SB 26-189 take effect?

The act takes effect January 1, 2027 and applies to consequential decisions made on or after January 1, 2027. Some provisions, including the attorney general rulemaking sections, took effect on passage.

Does SB 26-189 cover mortgage lending?

Yes. A financial or lending service is one of the covered domains, so decisions about access to, eligibility for or material terms of lending can be consequential decisions.

Can an ECOA adverse action notice satisfy SB 26-189?

A creditor that provides a notice under ECOA and Regulation B (and, when applicable, the FCRA) complies with the related Colorado notice requirements if that notice also satisfies them, and then no separate or duplicative notice is required.

Who enforces SB 26-189?

The Colorado Attorney General, through the Colorado Consumer Protection Act. The act does not create a new private right of action.

Has the Colorado Attorney General adopted the rules?

Not as of our last review. The Attorney General released interim draft rules (4 CCR 904-6) on October 6, 2026 and held a formal rulemaking hearing on October 26, 2026. The act calls for the rules on or before January 1, 2027.

Colorado SB 26-189: automated decision-making rules for lending