Does Colorado's AI Law Cover Investment Advice? Read the Text

The Covered-Decision List Is the First Thing to Check

If you build or deploy AI in a financial-services product — advisory, lending, payments, anything that touches a consumer's money — you have probably already asked the question this post answers: does Colorado's Automated Decision-Making Technology Act reach what you do?

For lenders and credit issuers, the answer is an easy yes. For AI-driven investment advisory tools, the honest answer is: probably not, on the text as proposed, but the margin is narrower than a lot of teams assume, and it is worth understanding why before you decide how much weight to put on that conclusion.

SB 26-189 does not regulate "AI" as a category. It regulates automated decision-making technology that is a "substantial factor" in a "consequential decision" — and it defines consequential decision by an exhaustive list of domains. Under C.R.S. § 6-1-1701(3.5), those domains are: education enrollment or opportunity, employment, essential government services, financial or lending services, healthcare services, housing, insurance, and legal services.

Eight buckets. If your product's AI-assisted output does not fall into one of them, the Act's core disclosure and human-review machinery — the pieces that are expensive to build — does not apply, whatever else the technology does.

That makes "financial or lending service" the bucket every fintech AI team has to check first. And Colorado, sensibly, did not leave that phrase to be argued from scratch. The Colorado Attorney General's proposed implementing rule, 4 CCR 904-6, Rule 2.2, defines "Financial or Lending Service" as a closed list — and it is not a Colorado invention.

Why the Closed List Points Away From Investment Advice

The definition is lifted, close to verbatim, from California's CCPA regulations governing automated decision-making technology, 11 C.C.R. § 7001(ddd). California's list — and Colorado's copy of it — covers things like the extension of credit, loan origination and servicing, deposit accounts, debt collection, and check-cashing services. It does not include investment advice, portfolio management, or securities recommendations as a listed category.

That omission is not incidental. California's Privacy Protection Agency built its ADMT regulations through a multi-year notice-and-comment process with an extensive administrative record. The Final Statement of Reasons for that rulemaking — the CPPA's own accounting of the comments it received and how it resolved them — shows no commenter proposing that "financial or lending service" be expanded to reach investment advice. Colorado's rule drafters had that history in front of them when they borrowed the definition wholesale rather than writing their own. When a state agency imports another regulator's defined term rather than drafting fresh language, that is itself evidence of what the term was understood to mean.

The Attorney General's own illustrative examples in the proposed rules point the same direction. Rule 6.5's worked examples of "financial or lending service" consequential decisions are all credit decisions — a loan denial, a reduction in an existing credit line. Nothing in the rule's own explanatory material treats a portfolio recommendation, a rebalancing suggestion, or an AI-generated market commentary as the kind of decision the rule is aimed at.

The Harder Argument: Why the Closer Read Matters

None of that means the question is closed, and a comment letter FinTech Law submitted to the Colorado Attorney General's rulemaking docket earlier this month makes the harder version of the argument rather than the easy one. The reason the harder version is necessary is a phrase that shows up throughout the statute: "the provision of" a covered service. Read quickly, "provision of a financial service" could be stretched to cover anything a financial firm does for a customer — including telling them what to buy.

Three textual points cut against that stretch, and they are worth knowing even if you never plan to read the statute yourself.

• The phrase is used consistently, not loosely. "Provision of" is used the same way elsewhere in § 6-1-1701(1)(a) to describe the underlying act of supplying a good or service — originating the loan, opening the account — not advice or recommendations incidental to it.
• Differentiated recommendations are already carved out. Section 6-1-1701(3)(b)(II) expressly excludes "differentiated product recommendations" from the definition of automated decision-making technology in the first place. The legislature anticipated that AI systems recommend and rank options for consumers all the time — search results, product suggestions, tailored offers — and carved that activity out rather than trying to regulate it as a consequential decision. A recommendation engine that suggests which ETF might fit a stated goal looks a great deal like the kind of differentiated recommendation the statute already excludes.
• The gate vocabulary is "decision." The statute's defined term is "decision," and its structure throughout assumes something is being decided for the consumer — approved or denied, hired or not, admitted or rejected — rather than by the consumer with the benefit of AI-assisted input. A tool that surfaces analysis and leaves the investment decision entirely in the client's hands sits differently, functionally and textually, from a tool that outputs the decision itself.

We want to be candid about the limits of that argument. "Recommendation" and "decision" blur in practice as advisory tools get more directive, and a regulator focused on consumer protection could reasonably push back that a sufficiently confident, sufficiently personalized AI recommendation functions as the decision for most consumers who follow it. That is precisely the kind of interpretive question a comment letter is supposed to put on the record before a rule locks in — not something to resolve by assertion in a blog post.