C.R.S. § 6-1-1704: Deployer disclosures - point-of-interaction notice - public posting option - post-adverse outcome disclosures - legislative declaration - trade secrets - compliance with other law - accessibility - rules.

(1) Prior to a deployer using a covered ADMT to materially influence a consequential decision, the deployer shall provide a clear and conspicuous notice to a consumer that the deployer used or will use a covered ADMT in a consequential decision affecting the consumer and instructions regarding how the consumer may obtain the additional information described in this section.

(2) A deployer complies with subsection (1) of this section by maintaining a prominent public notice that is reasonably accessible at points of consumer interaction, including through a link or posting that is reasonably proximate to the interaction or transaction in which a consequential decision may occur.

(3) If a deployer uses a covered ADMT to materially influence a consequential decision that results in an adverse outcome for a consumer, the deployer shall provide within thirty days after making the decision:

(a) A plain language description of the consequential decision and the role the covered ADMT played in the consequential decision;

(b) Instructions and a simple-to-follow process to request additional information about the covered ADMT and the inputs, including the name of the covered ADMT, the covered ADMT version number, if applicable, the covered ADMT developer, and the types, categories, and sources of personal data used, to the extent the deployer receives the necessary information from the developer in compliance with section 6-1-1702; and

(c) An explanation of the consumer rights described in section 6-1-1705 and how to exercise them.

(4)

(a) The general assembly finds that the specific content and format of post-adverse outcome disclosures may vary across consequential decision domains. The general assembly intends that the specific elements of post-adverse outcome disclosures be further clarified through rule-making that accounts for sector-specific practices while ensuring that consumers receive meaningful and understandable information about consequential decisions.

(b) On or before January 1, 2027, the attorney general shall adopt rules to clarify and implement the post-adverse outcome disclosure requirements set forth in subsection (3) of this section. Rules adopted pursuant to this subsection (4) may include, as appropriate:

(I) Rules clarifying the content of required disclosures related to the types, sources, or categories of personal data that a deployer must provide to a consumer following an adverse outcome involving a covered ADMT pursuant to subsection (3) of this section;

(II) Sector-specific guidance or illustrative examples tailored to different covered domains;

(III) Standards for describing the role of the covered ADMT in a consequential decision in a manner that is reasonably understandable to a consumer; and

(IV) Guidance addressing how the disclosure requirements described in this section interact with federal or state laws that require or govern notices, explanations, or adverse outcome disclosures.

(5) Nothing in this section requires a deployer to disclose a trade secret or information protected from disclosure by state or federal law. If a deployer withholds information pursuant to this subsection (5), the deployer shall notify the consumer.

(6)

(a) A creditor, with respect to a consequential decision involving the offering, the denial, the pricing, the servicing, or other material terms of credit, that is required to provide and that provides a notice to a consumer pursuant to the federal "Equal Credit Opportunity Act", 15 U.S.C. sec. 1691 et seq., and its implementing regulations, including Regulation B, 12 CFR 1002, and, when applicable, the federal "Fair Credit Reporting Act", 15 U.S.C. sec. 1681 et seq., complies with the notice or disclosure requirements of this section that relate to the same decision or adverse outcome if the notice provided to the consumer pursuant to the federal laws and regulations described in this subsection (6)(a) also satisfies the notice or disclosure requirements of this section.

(b) If a creditor complies with the federal laws and regulations described in subsection (6)(a) of this section and complies with subsection (6)(a) of this section, the creditor is not required to provide a separate or duplicative notice pursuant to this section.

(c) Nothing in this subsection (6) shall be construed to require a creditor to provide any notice or disclosure in a manner that is prohibited by federal law.

(d) For purposes of this subsection (6), a notice that complies with the federal laws and regulations described in subsection (6)(a) of this section and complies with subsection (6)(a) of this section may include a brief statement indicating that a covered ADMT was used to materially influence the consequential decision and instructions for how the consumer may obtain any additional information or exercise any rights provided under this part 17.

(7) This part 17 shall not be construed to require a person to make a disclosure, provide an explanation, or furnish information to a consumer to the extent doing so would be prohibited by federal law or would compromise the confidentiality or integrity of cybersecurity, fraud prevention, anti-money laundering, counter-terrorist financing, or economic sanctions compliance programs required by law.

(8) A deployer or developer shall provide the notices and disclosures required by this part 17 in a manner that is reasonably accessible to consumers with disabilities and consumers with limited English proficiency, consistent with applicable state and federal law.

(9)

(a) For a consequential decision relating to education, a deployer that is subject to FERPA satisfies the notice and disclosure requirements of this section by providing notice and disclosures through processes and channels that are consistent with FERPA and the deployer's FERPA notices and student record access procedures, including, where applicable, notice to a parent or guardian or an eligible student.

(b) A deployer that is subject to FERPA is not required to establish a separate or duplicative notice or disclosure process if the deployer has established a notice or disclosure process to comply with FERPA.