Colorado and California AI rules for financial firms: what changes on January 1, 2027

Two state AI laws point to the same date. Colorado's automated decision-making law, still widely called the Colorado AI Act, takes effect on January 1, 2027. California's CCPA rules on Automated Decision-Making Technology (ADMT) apply from the same day. Both reach AI that helps decide who gets credit, insurance, or other financial services.

Neither date is as simple as it looks. Colorado's enforcement depends on a federal court case. California's rules may barely touch some lending decisions because of the Gramm-Leach-Bliley Act (GLBA) exemption, yet fully cover others.

Law firms have already summarized what each law says. This guide focuses on what lenders, insurers, and advisers need to build to meet both, whatever the court decides. For the wider picture on AI governance and regulation, see our guide to the AI governance in financial services.

The Colorado AI Act (SB 26-189) at a Glance

Colorado repealed its original AI Act, SB 24-205, before it took effect. Governor Polis signed the replacement, SB 26-189, on May 14, 2026, according to Holland & Knight. It drops the earlier duty of care and impact assessments and focuses on transparency.

The law covers automated decision-making technology that "materially influences" a consequential decision. Those decisions include financial or lending services and insurance. Fraud prevention, anti-money laundering, sanctions screening, and identity verification are excluded, as Davis Wright Tremaine notes.

Firms that deploy covered technology must do five things.

• Tell consumers before it's used. A prominent public notice with a link can be enough.

• Send a plain-language explanation within 30 days of an adverse outcome, such as a denial or materially worse pricing or terms.

• Let consumers correct inaccurate personal data.

• Offer meaningful human review where commercially reasonable, by someone with authority to change the decision.

• Keep compliance records for at least three years.

Will Colorado Enforce on January 1, 2027?

Possibly not. xAI sued Colorado in April 2026, and the US Justice Department moved to intervene. Under an April 27 court order, the Attorney General won't bring enforcement actions for violations that occur up to 14 days after the court rules on xAI's preliminary injunction motion. xAI has 28 days after the final rules are adopted to file that motion, as Jones Walker explains.

The rules themselves are still being written. The Attorney General's office filed draft rules on August 11, published an interim draft on October 6, and held a public hearing on October 26, according to its rulemaking page. Final rules must be adopted before January 1, 2027. At the October 26 hearing, banks, credit unions, and lenders argued that a draft presumption about when AI "materially influences" a decision is too broad. Affirm said it makes 37.8 million credit decisions a year and declines about 15% of applicants, which could mean 11 human reviews a minute.

Even once enforcement starts, the Attorney General must give 60 days to cure most violations until January 1, 2030. None of this is a reason to wait. The controls both states expect take months to build.

California ADMT Regulations for Financial Firms

California's privacy regulator finalized its ADMT rules in September 2025. Businesses that use ADMT to make significant decisions must comply from January 1, 2027, according to the California Privacy Protection Agency. Significant decisions include the provision or denial of financial or lending services.

ADMT means technology that uses personal information to replace, or substantially replace, human decision-making. A decision isn't substantially replaced if a person who knows how to interpret the output reviews it, along with other relevant information, and has authority to change it, as Thompson Coburn explains.

Covered businesses must do four things.

• Give a pre-use notice explaining the use and the consumer's rights.

• Offer an opt-out, or a human appeal handled by someone who can overturn the decision.

• Answer access requests about how ADMT was used within 45 days.

• Complete a risk assessment before the processing starts. Attestations are due to the agency by April 1, 2028.

The GLBA question decides how much of this applies to you. The CCPA exempts personal information collected under GLBA, and that exemption follows the data, not the firm, as Capco points out. A credit decision built only on application data may be largely exempt. One that also uses device, location, or behavioral data may not be. Insurers face a similar test. They must comply for personal information not covered by the California Insurance Code.

Colorado vs California AI Rules Side by Side

How to Build Colorado and California Compliance into Your AI Systems

The two laws use different words, but they ask firms for the same capabilities. Build these five once and you cover both.

1. Inventory every AI-influenced customer decision

List every place a model, score, or AI tool shapes a decision about a customer, including vendor tools and rules engines with a model inside. Most firms have made a start. In the IAA, ACA Group, and YCC survey, 86% of 411 US adviser firms keep an inventory of AI tools. Few inventories record which decisions each tool influences, and that's what both laws care about.

2. Tag the data behind each decision

For each decision, record every input and where it comes from. Mark which inputs are covered by GLBA and which aren't. That tells you, decision by decision, whether California's rules apply, and it's the evidence you'll need if anyone questions the exemption.

3. Keep a decision record

Log one record per decision with the model version, the policy version, the inputs, the output, the reason codes, the notice sent, and the outcome of any human review. Keep it for at least three years. A record like this lets you answer a regulator, a consumer, and your own auditors from the same data. Our AI governance checklist post shows who should own each stage.

4. Generate explanations from the record

Colorado gives you 30 days to explain an adverse outcome. California gives you 45 days to answer an access request. Neither works if someone has to rebuild each decision by hand. Generate plain-language explanations from the reason codes in the decision record, and test them on people outside the model team.

Mukul Juneja, Founding Partner & CTO, Muoro.

5. Route human review to someone who can change the decision

Both laws expect reviewers with real authority. California's test also requires that the reviewer understands the output and considers other relevant information. Plan volumes and service levels now, especially for high-volume lending. Only 48% of adviser firms in the same survey have a formal human-in-the-loop oversight policy.

What Each State's Notices Must Cover

These are the required elements, not model wording. Your final notices should come from counsel once Colorado's rules are final.

Get Ready for January 1, 2027

Not sure which of your AI decisions these laws cover? Muoro's AI governance assessment maps your AI-influenced decisions, the data behind them, and the records you keep, then gives you a prioritized plan to close the gaps before January. Book your AI governance assessment.

Frequently Asked Questions

Is the Colorado AI Act still in effect?

The original law, SB 24-205, was repealed before it took effect. Its replacement, SB 26-189, was signed on May 14, 2026, and takes effect on January 1, 2027. It's narrower, focusing on notices, explanations, and human review.

Why is xAI suing Colorado, and does it change the deadline?

xAI sued in April 2026 to block the state's AI law, and the US Justice Department moved to intervene. The statutory date hasn't changed. Under a court order, though, the Attorney General won't enforce until 14 days after the court rules on xAI's injunction motion.

Does the Colorado AI Act apply to banks and credit unions?

Decisions about financial or lending services are covered, and the sources we reviewed don't describe a blanket exemption for banks or credit unions. Banks and credit unions took part in the October 2026 rulemaking hearing. Confirm your position with counsel.

Can lenders reuse their ECOA and FCRA adverse action notices for Colorado?

Partly. Creditors that already send ECOA or FCRA notices can adapt them instead of sending separate, duplicate disclosures. The adapted notice still needs to cover what Colorado requires, so check the wording with counsel once the final rules are out.

Does the GLBA exemption cover California's ADMT rules?

Only for data covered by GLBA. The exemption follows the data, not the firm. A decision that also uses other personal data, such as device or behavioral data, can still fall under the ADMT rules.

Which financial firms must comply with California's ADMT rules?

Businesses that meet the CCPA's definition of a business, for example by having annual gross revenue over $26,625,000, and that use ADMT for significant decisions about California consumers. The GLBA exemption then decides how much applies.

Do California's ADMT rules apply to insurers?

Yes, for personal information not covered by the California Insurance Code. The CCPA regulations say insurers that meet the definition of a business must comply for that information, as Faegre Drinker notes.