DENVER — America’s Credit Unions is urging Colorado regulators to revise proposed rules governing automated decision-making and conversational artificial intelligence, warning that the requirements could duplicate federal regulations, complicate fraud prevention and impose costly obligations on credit unions.
In an Oct. 25 letter to the Colorado attorney general’s office, the trade association said it supports consumer protections that allow people to understand and challenge consequential automated decisions. But it argued that the rules implementing Senate Bill 26-189, the Automated Decision-Making Technology in Consequential Decisions Act, and the Chatbot Safety Act must better reflect existing financial-services regulation.
The association acknowledged changes in the state’s Oct. 6 interim draft, including revisions involving vendor arrangements, consumer rights and human review, while seeking additional changes before the scheduled Jan. 1, 2027, effective date.
Concerns Over Lending, Vendors and Consumer Appeals
Among America’s Credit Unions’ principal recommendations:
- Implementation time: Provide a delayed-enforcement period or other relief for institutions acting in good faith, allowing time to update vendor systems, disclosures and staff training.
- Vendor accountability: Let credit unions reasonably rely on documentation supplied by technology developers and other vendors, rather than requiring them to recreate proprietary testing or records they cannot access.
- Covered decisions: Limit the rules to automated technology that materially influences decisions covered by the statute, rather than treating routine servicing, collections or tools used only to organize information as automatically covered.
- Federal notices: Establish a clear safe harbor for individualized adverse-action notices that comply with the Equal Credit Opportunity Act and Fair Credit Reporting Act, avoiding duplicative Colorado disclosures.
- Human review: Permit qualified staff to correct errors, reconsider outcomes and use existing appeal procedures without requiring a separate reviewer in every case or assuming an unchanged result means review was inadequate.
- Fraud and Security Protections
America’s Credit Unions warned that broad disclosure and appeal requirements could expose fraud-detection methods, suspicious-activity monitoring, sanctions screening and other sensitive security practices. It asked for exemptions or safeguards protecting information restricted by federal privacy, Bank Secrecy Act, anti-money-laundering and law-enforcement obligations.
It also said pausing an adverse outcome during an appeal should not force a credit union to approve a denied transaction, remove a fraud hold or override security controls. Credit unions should be allowed to identify a direct data provider and the type of information used when they cannot obtain the original sources behind an aggregator, the letter said.
For mortgage underwriting, America’s Credit Unions sought clarification that credit unions may correct inputs and rerun systems used in Fannie Mae, Freddie Mac, FHA and VA programs while complying with those programs’ eligibility standards.
Routine Chatbots and Financial Education
The association also urged Colorado to distinguish basic member-service chatbots from open-ended AI services. It asked that routine balance inquiries, branch information, account management and transactional commands be recognized as narrow tasks, and that low-risk tools be exempt from annual reporting when they do not simulate personal relationships or target minors.
Other requested revisions would recognize age verification already performed during authenticated banking sessions, make AI disclosures legible without tying their font size to the largest text on a mobile screen, and exempt financial-literacy badges, savings streaks and similar educational milestones from restrictions on engagement rewards.
America’s Credit Unions said its proposals would preserve consumer safeguards while reducing overlapping or conflicting compliance requirements, particularly for smaller, community-based institutions.
The full letter can be found here.
