Colorado's AI Act hands banks a January deadline to name every data broker

The hardest sentence in the statute is the one about naming. A denied consumer can demand that every data source be identified by name, including data brokers and intermediaries, along with the specific pieces of personal data used, a way to correct inaccurate data, and meaningful human review ^[7]. At a typical bank, none of those data relationships belong to the bank. Credit and account-opening decisions run through a core system, most likely from FIS, Fiserv or Jack Henry, with account-opening software such as Alloy's alongside it, and Frank Trotter, CEO of Battle Bank in Avon, Colorado, says all of the vendors banks use are using AI ^[9][17]. The list a Colorado bank hands a rejected applicant is therefore assembled out of its vendor's suppliers, and quite possibly its vendor's suppliers' suppliers ^[12]. Trotter expects the vendors to build automated processes for it ^[17].

Scott Kosnoff of Faegre Drinker told American Banker that the source-naming granularity is a big deal, and that data correction and meaningful human review may require new infrastructure ^[14]. That sits oddly beside the fact that AI decisioning software usually ships with explainability already in it: Trotter says he can open any denial in his own system and see every factor, an address that does not match a driver's license, or 20 Social Security numbers associated with one license, which reads as fraud ^[10]. The model is not the gap. The gap is the plumbing around it, an identity-checked request channel and a correction route that writes back into whatever the model consumed ^[13].

Trotter's own example shows why handing that detail over is uncomfortable. An explanation naming the fraud signal that fired tells whoever receives it exactly which check to defeat next time, and Trotter raised the risk of a criminal impersonating the applicant to get it ^[18].

The front-end obligation is cheaper, and still not free. Obrea Poindexter of Orrick says "clear and conspicuous" is contextual, and that nine times out of ten the disclosure will not sit in a footnote ^[1]. Kosnoff says the proposed regulations get specific: plain, straightforward language, readable on all devices including mobile, and no smaller than 12-point font in print ^[2]. That is a change to the application screen itself, made before the model is consulted rather than after it decides ^[4][11].

Regulation B already obliges a bank to say why it said no ^[5]. Colorado adds a second envelope inside the first, carrying instructions on how to ask for the system's name, its developer, and the categories and sources of data behind the outcome ^[6]. "The concept is fair," Trotter said. "If you've been denied for one reason or another, you should at least have the opportunity to know why" ^[8]. The bill for that fairness is a file format, an audit trail and a human reviewer, and it is due in January ^[3].