In this episode of The Consumer Finance Podcast, host Chris Willis is joined by colleague Kim Phan to break down the proposed regulations recently released by the Colorado attorney general (AG) under the Automated Decision-Making Technology (ADMT) Act, Colorado’s newly amended AI statute, and explain why the financial services industry needs to engage before these rules are finalized.

Chris and Kim walk through several provisions that diverge sharply from what industry had hoped for after the statute’s May 2026 rewrite, including a narrow definition of “financial or lending service” that leaves debt collection and insurance in uncertain territory and a meaningful human review requirement that effectively demands full judgmental re-underwriting of automated credit decisions. The hosts also highlight consumer rights provisions that would require disclosure of every data input and score used in an ADMT decision, thus creating significant trade secret exposure and fraud risk with little identifiable consumer benefit.

The episode closes with the rulemaking timeline: public comments are due October 5, a hearing is scheduled for October 26, and the AG must finalize rules by January 1, 2027.


Transcript: Colorado’s ADMT Act Proposed Regulations: Unpacking the Confusion and Compliance Challenges for Financial Services (PDF)

Photo of Chris Willis Chris Willis

Chris is the co-leader of the Consumer Financial Services Regulatory practice at the firm. He advises financial services institutions facing state and federal government investigations and examinations, counseling them on compliance issues including UDAP/UDAAP, credit reporting, debt collection, and fair lending, and defending…

Chris is the co-leader of the Consumer Financial Services Regulatory practice at the firm. He advises financial services institutions facing state and federal government investigations and examinations, counseling them on compliance issues including UDAP/UDAAP, credit reporting, debt collection, and fair lending, and defending them in individual and class action lawsuits brought by consumers and enforcement actions brought by government agencies.

Photo of Kim Phan Kim Phan

Kim is a partner in the firm’s Privacy + Cyber Practice Group, where she is a privacy and data security attorney, who also assists companies with data breach prevention and response, including establishing effective security programs prior to a data breach and the

…

Kim is a partner in the firm’s Privacy + Cyber Practice Group, where she is a privacy and data security attorney, who also assists companies with data breach prevention and response, including establishing effective security programs prior to a data breach and the assessment of breach response obligations following a breach.