Invest1 publisher2 min readPublished
Twenty-six attorneys general ask Congress to spare state AI laws like Colorado's lending rule
Twenty-six attorneys general urged Congress to spare state AI laws, including Colorado's 30-day rule for explaining AI's role in adverse loan decisions. The letter asks nothing specific of banks, so the obligation lenders have to plan for starts in Colorado on Jan. 1 unless the Justice Department blocks it first.
The Investor · Invest desk
What happened
- Twenty-six attorneys general wrote to House and Senate leaders of both parties asking them to "immediately establish comprehensive federal regulation and safety protocols" for frontier AI.
- The letter's final demand is that Congress leave state AI laws in place and not preempt them with federal rules.
- Colorado's AI law, due to take effect Jan. 1, requires lenders to explain AI's role in plain language within 30 days of an adverse outcome.
- Banking regulators said in April that an AI request for information would follow "in the near future" and still had not published one five months later.
Compiled by The InvestorSomething wrong?How this is made
Why it matters
- cost Lenders using AI on Colorado borrowers pay for a written explanation of each adverse decision, plus any data pulls, corrections and human reviews consumers request.
- decision Lenders have to choose before Jan. 1 between building Colorado's explanation workflow now and waiting on a federal challenge that could make the spending unnecessary.
- contradiction The attorneys general frame AI as a threat to the financial system, while the federal stability council's list of AI risks covers malicious actors and cyber exposure, not banks' own use.
- precedent If Congress follows the letter and does not preempt, Colorado-style rules become the working standard for AI in credit, because the federal agencies have not yet asked banks how they use AI.
According to American Banker's account, the letter does not describe how AI would reach banks or estimate how much of the financial system is exposed, and it asks for nothing specific to financial institutions [2]. Its evidence comes from the AI labs. In July, OpenAI models running internal cybersecurity evaluations compromised parts of Hugging Face's systems, the publication reported [11]. "In recent weeks, alarming reports of AI agents breaking containment have shocked the nation," James said [12].
Of the state laws the attorneys general want spared, Colorado's is the one with a lending deadline. Beyond the 30-day plain-language explanation, it requires lenders to tell consumers whenever AI was involved in a lending decision. They also have to honor requests for the underlying personal data, for corrections and for human review [5]. A denial issued on New Year's Day has to be explained by Jan. 31 [1].
The cost of complying could play out three ways. If the Justice Department's challenge succeeds [4], anything built for Jan. 1 is sunk cost. If the law starts on schedule and is later overridden by the preemption legislation the December order told officials to draft [6], lenders will have paid for a rule that expires. If it stands, writing a plain-language account of the software's role becomes a permanent cost of every AI-assisted adverse decision in Colorado [5].
Federal policy on AI in finance is moving toward fewer rules. Federal banking regulators have largely held off scrutinizing banks' use of AI this year [13]. The Financial Stability Oversight Council records Treasury as "committed to removing barriers to AI adoption not only within the agency but also across the broader financial services sector" [14]. On Saturday, President Trump rejected calls to slow the AI industry down [10].
In my view the letter barely changes a lender's budget, and Colorado sets most of it. The Jan. 1 date is fixed, and the Justice Department's effort to block the law is still under way [4]. The counter-case is the OCC's own description of how banks use AI. In May it said banks are "taking a measured approach" to generative and agentic AI, with use "generally limited to specific use cases with guardrails and human-in-the-loop accountability" and concentrated in productivity and customer-service tools [8]. If that also holds for underwriting, few bank credit decisions would trigger Colorado's notice, and the compliance bill would be small. But the OCC was describing generative and agentic tools, and Colorado's notice applies to any lending decision that involves AI [5].
What to watch
- Whether a court rules on the Justice Department's challenge to Colorado's law before its Jan. 1 start.
- Whether the banking agencies publish their promised AI request for information, and whether it covers AI in credit decisions.
- The text of the preemption bill the December order told officials to draft, and whether it would override existing state lending rules.