Insights

The Equal Credit Opportunity Act (the "Act") and its implementing regulation, Regulation B ("Regulation B," and together with the Act, "the ECOA") prescribes the federal requirements for adverse action notifications. In addition, the Fair Credit Reporting Act (the "FCRA") requires a user to provide notice of adverse action when the user takes adverse action on a consumer based upon on information, whether in whole or in part, from a consumer report.

On May 14, 2026, Colorado enacted the Automated Decision-Making Technology Act (the "ADMT Act"), which repeals and replaces the state's 2024 AI Act prior to its implementation date. The new law takes effect on January 1, 2027. The ADMT Act governs the use of "automated decision-making technology", which is defined as technology designed to use personal data inputs to produce an automated result, including a credit decision ("ADMT").

If ADMT materially and adversely influences the credit decision, then the creditor (called a "deployer" under the ADMT Act) must provide special disclosures as part of the adverse action notification process. The ADMT Act includes a safe harbor for creditors whose adverse action notices already comply with the FCRA and the ECOA if it also satisfies the additional disclosure requirements imposed by the ADMT Act.

So, what does the ADMT Act actually require? It mandates a relatively substantial set of disclosures (the "Colorado AAN"), including a brief statement that the ADMT materially influenced the decision, instructions on the ADMT (such as name, version number, inputs, etc.), details on how the applicant may obtain information about the sources of the personal data used by the ADMT, and an explanation of the process for the applicant to correct any factual mistakes in that personal data. Finally, the applicant must be informed of how to get a "human reconsideration" of the unfavorable decision.

How do these requirements fit with the ECOA and the FCRA adverse action disclosures? Not necessarily well. A model form of adverse action notification (the "Model AAN") is provided under Regulation B for compliance with both the ECOA and the FCRA. Regulation B Official Interpretations provide that a creditor's adverse action notice will be deemed in compliance with the regulation if it is "substantially similar" to the Model AAN. While Regulation B permits an adverse action notice to contain a reference to a similar state statute or regulation and to a state enforcement agency, that permission is limited to a reference to the state law. It does not extend to any state disclosures. It's important to note that Regulation B only authorizes the inclusion of one other law's required disclosures (outside of Regulation B); specifically the FCRA. The Model AAN serves as a safe harbor for creditors to satisfy their adverse action requirements under both the ECOA and the FCRA and it would not extend to state disclosures.

Furthermore, Regulation B specifically requires clear and conspicuous disclosures and the Regulation B Official Interpretations further state that such mandatory disclosures cannot be obscured. Consequently, unless Regulation B specifically permits including Colorado's disclosure within their version of the Model AAN, any creditor who inserts the ADMT Act disclosures risks violating the ECOA, and the resulting adverse action notice would certainly not be eligible for the safe harbor protections afforded by the Model AAN. Therefore, the ADMT Act appears to be a foe of ECOA.

Trisha J. Cacciola is a partner in the New York office of Hudson Cook, LLP. She can be reached at 516.252.2140 or by email at tcacciola@hudco.com. Patricia E.M. Covington is a partner in the Virginia office of Hudson Cook, LLP. Patty can be reached at 804.212.1201 or by email at pcovington@hudco.com.