What does SB 24-205 say about AI in banking?

What are the key points of SB 24-205?

• Defined 'high-risk artificial intelligence system' as one that makes or is a substantial factor in a consequential decision, expressly including decisions affecting access to financial or lending services
• Imposed a duty of reasonable care on developers and deployers to protect consumers from known or reasonably foreseeable algorithmic discrimination
• Deployers had to maintain a risk management policy and program (NIST AI RMF or ISO/IEC 42001 named as acceptable frameworks) and complete annual impact assessments
• Consumers were entitled to pre-decision notice, a statement of reasons for adverse decisions, data correction, and an opportunity to appeal to human review
• Rebuttable presumption of reasonable care for firms meeting the statutory obligations; affirmative defense for those following a recognized risk framework
• C.R.S. 6-1-1705: banks, out-of-state banks, and credit unions were deemed in full compliance if subject to examination by a state or federal prudential regulator under published guidance or regulations at least as stringent as the Act and requiring regular anti-discrimination audits of high-risk AI
• Exclusive enforcement by the Colorado Attorney General as a deceptive trade practice; no private right of action; AG rulemaking authority

What did SB 24-205 change for banks?

It was the first US statute to name credit and lending AI as a regulated 'high-risk' category with a duty of care, impact assessments, and appeal rights — an EU AI Act-style model. For banks the headline was the prudential safe harbor, which effectively deferred to federal fair-lending and model-risk supervision. The law never took effect: business opposition, a December 2025 White House executive order naming it, and a DOJ-backed federal lawsuit led to its repeal and replacement by SB 26-189 in May 2026.