What does SB 26-189 say about AI in banking?

What are the key points of SB 26-189?

• Introduced May 1, 2026, passed both chambers by May 9, signed May 14, 2026 — two weeks start to finish, ahead of the June 30, 2026 date on which SB 24-205 would have taken effect
• 'ADMT' = technology that processes personal data to generate recommendations, rankings, or scores used to make decisions about an individual; 'covered ADMT' is ADMT used to materially influence a consequential decision, including decisions affecting access to financial services
• Developers must provide deployers documentation of intended and known harmful uses, categories of training data, limitations and known risks, instructions for meaningful human review, and notice of material updates (from January 1, 2027)
• Deployers must give clear and conspicuous notice at points of consumer interaction and, within 30 days of an adverse outcome (denial, termination, material reduction, or materially worse pricing), explain the decision, the ADMT's role, the data used, and the consumer's rights
• Consumers may access and correct personal data used and request meaningful human review by trained staff with authority to override the outcome, to the extent commercially reasonable
• Strikes the SB 24-205 safe harbor for banks, credit unions, and entities complying with federal agency standards; no GLBA entity-level exemption
• A financial institution that provides a required ECOA/Regulation B and, where applicable, FCRA notice complies with the Act's notice and disclosure requirements for that decision or adverse outcome
• Violations are deceptive trade practices under the Colorado Consumer Protection Act (up to $20,000 per violation); AG exclusive enforcement; no private right of action; 60-day notice and cure before January 1, 2030; three-year record retention; AG must adopt implementing rules by January 1, 2027

What did SB 26-189 change for banks?

Colorado moved from an EU-style governance statute to an FCRA-style disclosure statute. For banks the trade is unfavourable on scope but favourable on burden: the prudential-regulator exemption is gone, so AI-influenced credit, deposit, and pricing decisions for Colorado consumers are squarely covered, but the obligations largely map onto existing adverse action notice processes. The genuinely new work is documenting what vendors' models do, standing up a human-review channel that meets the AG's standards, and handling data-correction requests within the Act's timelines.