Pre-Rulemaking Considerations Document for the Colorado Automated Decision-Making Technology Act

Summary

SIFMA ¹ provided comments to the Colorado Department of Law on its Pre-Rulemaking Considerations Document regarding the Colorado Automated Decision-Making Technology Act.

Excerpt

The Act directs the Attorney General to adopt implementing regulations, and the Considerations Document specifically invites input on provisions best addressed through generally applicable rules, sector-specific guidance, and clarification of statutory ambiguities. SIFMA supports the Attorney General's stated commitment to clarity, efficient and expeditious compliance, interoperability with analogous state and federal frameworks, and ensuring that innovation is not unduly burdened.

SIFMA is a national trade association representing over 350 large, medium, and small broker-dealers, investment banks and asset managers, many of whom have a strong presence in Colorado. In fact, almost 113,000 people in the state work in the finance and insurance industries, more than 26,700 of them work at securities firms, and 59 broker-dealer main offices call Colorado home. ²

A. Executive Summary

SIFMA's comments are limited to matters the Attorney General can address through rulemaking and regulatory guidance, consistent with the statutory text, in support of the five principles identified in the Considerations Document. SIFMA believes that the Department should consider the following when promulgating rules under the Act:

• Clarify that covered Automated Decision-Making (ADMT) is limited to technology used to make, replace, or materially drive a final Consequential Decision, and that an ADMT output does not "Materially Influence" a Consequential Decision where a qualified human reviewer meaningfully considers and can override the output. Provide objective indicators distinguishing covered ADMT from operational, fraud-prevention, cybersecurity, compliance, and workflow functions;
• Clarify that "Consequential Decision" means the final decision affecting access to, eligibility for, pricing of, terms of, or continuation of a covered product, service, benefit, or opportunity, and does not include preliminary triage, quality review, fraud alerts pending investigation, document processing, or internal operational support;
• Issue financial-services-specific guidance recognizing existing supervisory, privacy, cybersecurity, fair lending, adverse action, complaint-handling, vendor oversight, and other sector-specific frameworks based on the Gramm-Leach Bliley Act ("GLBA"), Fair Credit Reporting Act ("FCRA"), Equal Credit Opportunity Act ("ECOA"), Bank Secrecy Act and anti-money laundering ("AML") or other sector specific laws, may satisfy overlapping ADMT requirements where they provide substantially similar consumer protections;
• Promote standardized disclosures, model notices, and safe harbors for adverse outcome and consumer-rights notices to avoid duplicative or inconsistent disclosures that could create UDAP/UDAAP-type consumer confusion, particularly where a consumer already receives an adverse action notice under the ECOA and FCRA;