Last reviewed: November 3, 2026. General information, not legal advice. State laws change often and each applies differently depending on your license, your borrowers' location and how you use AI. This page covers the state laws and actions we could verify on official sources. It is not a complete list of every state. Confirm your obligations with counsel.
The short version
No state has an AI law written only for mortgage brokers. The state rules that matter most today fall into three groups: automated decision rules for lending decisions (Colorado and California), AI disclosure rules for consumer conversations (Utah), and anti-discrimination enforcement that applies existing law to AI (Texas, New Jersey and Massachusetts). Federal rules apply everywhere on top of these: Freddie Mac and Fannie Mae AI governance, ECOA and Regulation B, GLBA and the FTC Safeguards Rule.
| State | Law or action | Status and dates | What it means for a broker |
|---|---|---|---|
| Colorado | SB 26-189, automated decision-making technology (ADMT) in consequential decisions | Signed May 14, 2026. Applies to decisions on or after January 1, 2027. AG rules (4 CCR 904-6) in progress. | Notice before covered ADMT is used in a lending decision, an explanation within 30 days after an adverse outcome, human review where commercially reasonable, and 3-year records. |
| California | CPPA ADMT regulations under the CCPA | In effect January 1, 2026. Existing ADMT for significant decisions must meet the ADMT article by January 1, 2027. | Pre-use notice, opt-out or human appeal, access requests and risk assessments, if the CCPA applies to you and no exemption covers the data. |
| Utah | Utah Code 13-77, generative AI consumer disclosures | In effect. Section 13-77-103 current version effective May 7, 2025. | Disclose generative AI when a consumer clearly asks. Licensed occupations must disclose up front in high-risk AI interactions, which include collecting financial data and financial advice. |
| Texas | Texas Responsible Artificial Intelligence Governance Act (H.B. 149), Bus. and Com. Code ch. 552 | Effective January 1, 2026. | No AI developed or deployed with the intent to unlawfully discriminate against a protected class. AG enforcement only, with a 60-day cure period and civil investigative demands that can ask about your AI system. |
| New Jersey | AG and Division on Civil Rights guidance on algorithmic discrimination | Guidance issued January 2025. | The Law Against Discrimination covers algorithmic discrimination in credit and housing, including tools you did not build. |
| Massachusetts | Attorney General enforcement under state consumer protection and fair lending laws | $2.5 million settlement announced July 10, 2025. | An enforcement example: alleged untested AI underwriting models led to required AI governance, written policies and testing. |
Colorado: SB 26-189
Colorado SB 26-189 repeals and reenacts the state's AI law with a narrower focus on automated decision-making technology used in consequential decisions. The Governor signed it on May 14, 2026, and it applies to consequential decisions made on or after January 1, 2027.
"A financial or lending service;"C.R.S. 6-1-1701(6)(d), in the list of covered domains
In plain English: Lending is a covered area, so a loan decision can be a consequential decision.
A deployer must give notice before using covered ADMT to materially influence a consequential decision, give an explanation within 30 days after an adverse outcome, and offer correction and human review where commercially reasonable. An ECOA adverse action notice can also satisfy Colorado's notice duties if it contains what Colorado requires. The Colorado Attorney General released interim draft rules (4 CCR 904-6) on October 6, 2026 and held a formal hearing on October 26, 2026. Full detail: Colorado SB 26-189 explained.
California: CPPA ADMT regulations
The California Privacy Protection Agency's regulations took effect January 1, 2026. A business already using ADMT for a significant decision before January 1, 2027 must meet the ADMT article no later than January 1, 2027.
"any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking."Cal. Code Regs., tit. 11, section 7001(e)
In plain English: The rules target tools that make the decision, or make it with little real human involvement.
The CCPA has exemptions for some financial data, so ask counsel how they apply to your loan files. Full detail: California CPPA ADMT explained.
Utah: generative AI disclosures
Utah's generative AI disclosure law is in Utah Code Title 13, Chapter 77. Section 13-77-103 has two duties.
"A supplier that uses generative artificial intelligence to interact with an individual in connection with a consumer transaction shall disclose to the individual that the individual is interacting with generative artificial intelligence and not a human, if the individual asks or otherwise prompts the supplier about whether artificial intelligence is being used."Utah Code 13-77-103(1)(a)
In plain English: If a borrower clearly asks whether they are talking to AI, your chatbot or AI assistant must say so.
"prominently disclose when an individual receiving services is interacting with generative artificial intelligence in the provision of regulated services if the use of generative artificial intelligence constitutes a high-risk artificial intelligence interaction"Utah Code 13-77-103(2)(a)
In plain English: A person in a regulated occupation must disclose AI up front, without being asked, when the interaction is high risk.
Under section 13-77-103(3), that disclosure is given verbally at the start of a verbal interaction and in writing before a written one. Chapter 77 defines a regulated occupation as one regulated by the Utah Department of Commerce that requires a license, and lists collecting sensitive personal information, including financial data, and providing personalized financial advice or services among high-risk interactions. Utah mortgage loan originators are licensed by the Division of Real Estate, part of the Department of Commerce, so the up-front disclosure rule is likely to reach AI chat or voice tools used with Utah borrowers. Confirm with counsel how it applies to your tools. For the Maine, California and Colorado chatbot rules and copy-ready disclosures, see AI chatbot disclosure rules for mortgage brokers.
Texas: TRAIGA (H.B. 149)
The Texas Responsible Artificial Intelligence Governance Act took effect January 1, 2026, as Chapter 552 of the Business and Commerce Code. Its AI disclosure duty in section 552.051 is aimed at governmental agencies and health care services, not mortgage brokers. The rule that reaches private businesses is the ban on intentional discrimination.
"A person may not develop or deploy an artificial intelligence system with the intent to unlawfully discriminate against a protected class in violation of state or federal law."Tex. Bus. and Com. Code 552.056(b)
In plain English: Do not use AI in a way designed to treat applicants differently because of race, color, national origin, sex, age, religion, disability or another protected characteristic.
Section 552.056(c) says a disparate impact is not sufficient by itself to show intent. Federal fair lending law still applies separately. The Texas Attorney General has exclusive enforcement authority (section 552.101), runs an online complaint page (section 552.102), and may issue a civil investigative demand after a complaint, asking for high-level descriptions of an AI system's purpose, training data, inputs, outputs, performance metrics, known limitations and post-deployment safeguards (section 552.103). Before suing, the Attorney General must give written notice and a 60-day chance to cure (section 552.104). Civil penalties under section 552.105 range from $10,000 to $200,000 per violation, plus daily amounts for continuing violations. A current AI use inventory makes a demand much easier to answer.
New Jersey: algorithmic discrimination guidance
In January 2025 the New Jersey Attorney General and the Division on Civil Rights issued guidance on how the New Jersey Law Against Discrimination (LAD) applies to automated decision-making tools.
"the LAD prohibits algorithmic discrimination in employment, housing, places of public accommodation, credit, and contracting"New Jersey DCR guidance, January 2025
In plain English: Credit and housing are covered, so AI used in lending, marketing or hiring falls under the LAD.
"a covered entity is not shielded from liability for algorithmic discrimination that results from the entity’s use of an automated decision-making tool simply because the tool was developed by a third party"New Jersey DCR guidance, January 2025
In plain English: Buying an AI tool from a vendor does not move the risk to the vendor. Ask vendors how they test for bias.
Massachusetts: enforcement example
On July 10, 2025 the Massachusetts Attorney General announced a $2.5 million settlement with a student loan lender. The office alleged that the lender's AI underwriting models were not tested for disparate impact, that one model variable resulted in disparate impact, with Black and Hispanic applicants more likely to be penalized than White applicants, that a rule automatically denied applicants based on immigration status, and that adverse action notices were inaccurate. Under the settlement the lender must implement a corporate governance structure and written policies for its AI use, stop using the challenged variable and rule, and report regularly to the Attorney General's Office. The lender was not a mortgage company, but the same state consumer protection and fair lending laws apply to mortgage lending. In April 2024 the Attorney General also issued an advisory that existing consumer protection, anti-discrimination and data security laws apply to AI.
What to do for every state where you are licensed
- List the states where you are licensed and where your borrowers live.
- Mark which AI tools touch lending decisions, borrower conversations or marketing. Your AI readiness self-assessment and AI use inventory are the starting point.
- For chat or voice AI used with Utah borrowers, add an up-front AI disclosure.
- For any AI that influences a credit decision, confirm your adverse action process for Colorado and California and under ECOA and Regulation B.
- Ask every AI vendor how they test for discriminatory outcomes, and keep the answers.
- Recheck this list each quarter, and check with your state regulator through NMLS for new guidance.
For federal rules, see the Mortgage AI Rules Library. For marketing, see the AI marketing and fair lending checklist.
One AI policy for every state you work in
The $349 AI Policy Kit includes a full AI/ML governance policy with risk tiers, an AI use inventory with a disclosure summary, a vendor questionnaire, an incident response one-pager and a Freddie and Fannie crosswalk, plus 3 months of Small Shop portal access for staff sign-off tracking. State requirements still need review by counsel.
Get the AI Policy Kit, $349AI Policy Starter, $99AI Team Kit, $699Compare kitsFrequently asked questions
Which states have AI laws that affect mortgage brokers?
As of November 3, 2026, the main ones are Colorado SB 26-189 (from January 1, 2027), the California CPPA ADMT regulations, Utah Code 13-77 on generative AI disclosures and the Texas Responsible Artificial Intelligence Governance Act. New Jersey and Massachusetts apply existing anti-discrimination and consumer protection law to AI.
Do Utah mortgage loan originators have to disclose AI use?
Utah Code 13-77-103 requires a person in a regulated occupation to prominently disclose generative AI in a high-risk interaction, such as collecting financial data or giving financial advice. Utah loan originators are licensed by the Division of Real Estate in the Department of Commerce, so the rule is likely to apply. Confirm with counsel.
Does the Texas AI law apply to mortgage brokers?
The Texas Responsible Artificial Intelligence Governance Act bars any person from developing or deploying AI with the intent to unlawfully discriminate against a protected class. Its disclosure duty is aimed at government agencies and health care, not brokers.
When does the Colorado AI law take effect for lenders?
Colorado SB 26-189 applies to consequential decisions, including lending decisions, made on or after January 1, 2027.
Is this a complete list of state AI laws?
No. It covers the state laws and actions we verified on official sources as of the review date. Check the states where you are licensed with counsel.