Skip to content
AI Policy Generator

ESWhat applies

Credit or creditworthiness scoring in United States (federal): related rules

Models that estimate a person's likelihood of default or creditworthiness to approve, deny or price credit. It is high-risk in the EU and Peru and requires explaining denial reasons and allowing human review in almost every jurisdiction.

Risk classification

JurisdictionLevelDateNote
United States (federal)Sector rules—ECOA/Reg B: adverse action notice with specific reasons even for complex models; FCRA when consumer reports are used.
ColoradoConsequential decisionJanuary 1, 2027SB 26-189: financial or lending services are a consequential decision.
CaliforniaConsequential decisionJanuary 1, 2027CCPA ADMT: financial or lending services are a significant decision.

Obligations related to this use case

Give specific reasons when AI denies or worsens credit

ECOA / Reg B15 U.S.C. § 1691(d)(2)-(3); 12 CFR 1002.9(a)(2), (b)(2)In force

Already applicable

When it relates
Applies if you use AI or scoring models to make credit decisions.
What the rule provides
  • Notify the adverse action within 30 days of a completed application.
  • State the specific principal reasons for the decision; "failed to meet our internal standards" is not enough.
  • Be able to translate model variables into accurate, understandable reasons.
Typical evidence
  • Adverse action notice template
  • Documented method for deriving reasons from the model
  • Samples of notices sent
Verification
Verified in the official source on November 4, 2026Checked on govinfo (15 U.S.C. § 1691(d)(2)) and eCFR (12 CFR 1002.9(a)(1), 30-day period; 1002.9(b)(2), specific principal reasons). The withdrawal of Circulars 2022-03 and 2023-03 is in the Federal Register (2025-08286, May 12, 2025).

Adverse action notice based on third-party reports

FCRA15 U.S.C. § 1681m(a); § 1681b(b)(3)In force

Already applicable

When it relates
Applies if your credit, insurance or rental decisions rely in whole or part on reports or scores bought from a consumer reporting agency. In hiring it applies only if you use background checks or other third-party reports; the assessment does not assume it just because you use AI in hiring.
What the rule provides
  • Identify the reporting company and state that it did not make the decision.
  • Explain the right to a free copy within 60 days and to dispute inaccurate data.
  • In employment, send a pre-adverse action notice with a copy of the report before the final decision.
  • If a credit score was used, disclose it with its key factors.
Typical evidence
  • Pre-adverse and final adverse action templates
  • Contract with the reporting vendor
Verification
Verified in the official source on November 4, 2026Checked on govinfo: 15 U.S.C. § 1681m(a)(1)-(4) (notice, agency identity, statement that it did not make the decision, free copy and right to dispute) and § 1681b(b)(3) (employment: copy of the report and summary of rights before the adverse action).

Risk assessment before using ADMT or other high-risk processing

CCPA ADMT and risk assessments11 CCR §§ 7150, 7151, 7152, 7155In force

Applies from January 1, 2026

When it relates
Applies to CCPA-covered businesses (revenue threshold, 100,000 residents or 50% of revenue from selling data) that use ADMT for significant decisions, infer traits of employees, applicants or students through systematic observation, process sensitive data, or train ADMT or facial recognition. Training models on your own data is not enough by itself. For processing that began before 2026 the deadline is December 31, 2027.
What the rule provides
  • Conduct and document the assessment before starting the processing.
  • Describe the specific purpose, data, concrete benefits, negative impacts and safeguards; involve the staff who take part.
  • Have it approved by a person with authority over the processing.
  • Review it at least every three years and update it within 45 days of a material change.
  • Keep it while the processing continues or for five years after completion, whichever is later.
  • For processing that already existed before January 1, 2026, the deadline is December 31, 2027.
Typical evidence
  • Signed, versioned risk assessment
  • List of contributors and approver
Verification
Verified in the official source on November 2, 2026Checked against the approved text published by CalPrivacy (§§ 7150 and 7155).

Submit assessment information to the agency with a signed attestation

CCPA ADMT and risk assessments11 CCR § 7157Adopted, applies later

Applies from April 1, 2028

When it relates
Applies to businesses that conducted risk assessments in 2026 or 2027.
What the rule provides
  • Submit the required information on 2026 and 2027 assessments by April 1, 2028, and every April 1 after that.
  • Include an attestation signed by an executive under penalty of perjury.
  • Provide the full assessment within 30 days if the agency or Attorney General requests it.
Typical evidence
  • Submitted form and confirmation
  • Signed attestation
Verification
Verified in the official source on November 2, 2026Checked against the approved text (§ 7157(a)(1)).

Pre-use notice for ADMT

CCPA ADMT and risk assessments11 CCR §§ 7200(b), 7220Adopted, applies later

Applies from January 1, 2027

When it relates
Applies to CCPA-covered businesses that use ADMT for significant decisions on lending, housing, education, employment or health care.
What the rule provides
  • Before using ADMT, explain the specific purpose, the right to opt out or appeal, the right of access, and how the ADMT works.
  • Explain in plain language which data affect the output and how the decision would be made if the person opts out.
  • Uses that began before 2027 must comply by January 1, 2027; new uses from first use.
Typical evidence
  • Published or delivered pre-use notice
Verification
Verified in the official source on November 2, 2026Date checked against the approved text (§ 7200(b)); notice content per § 7220.

Offer an ADMT opt-out or a human appeal

CCPA ADMT and risk assessments11 CCR § 7221Adopted, applies later

Applies from January 1, 2027

When it relates
Applies to CCPA-covered businesses that use ADMT for significant decisions.
What the rule provides
  • Offer at least two ways to opt out, without requiring an account.
  • Or, instead, offer an appeal reviewed by a person with authority to change the decision, if the exception's conditions are met.
  • State in the notice which exception you rely on.
Typical evidence
  • Opt-out or appeal form and request log
Verification
Verified in the official source on November 2, 2026Checked against the approved text (§§ 7220 and 7221).

Respond to ADMT access requests

CCPA ADMT and risk assessments11 CCR § 7222Adopted, applies later

Applies from January 1, 2027

When it relates
Applies to CCPA-covered businesses that use ADMT for significant decisions.
What the rule provides
  • Explain the specific (not generic) purpose for which ADMT was used about that person.
  • Explain the ADMT's logic, the output produced and how it was used in the decision.
Typical evidence
  • Access response template and response log
Verification
Verified in the official source on November 2, 2026Checked against the approved text (§ 7222).

Clear consumer notice of ADMT use

Colorado SB 26-189SB 26-189 (C.R.S. 6-1-17xx), obligaciones del deployerAdopted, applies later

Applies from January 1, 2027

When it relates
Applies if you use ADMT that materially influences decisions on employment, housing, health care, education, lending or insurance for Colorado consumers.
What the rule provides
  • Give a clear and conspicuous notice at the point of interaction that ADMT is used.
Typical evidence
  • Published notice and screenshots of interaction points
Verification
Verified in the official source on November 2, 2026Signing, dates and obligations checked on leg.colorado.gov on Nov 2, 2026. Exact content will depend on the Attorney General's rules, still pending.

Explanation within 30 days after an adverse decision

Colorado SB 26-189SB 26-189, obligaciones del deployerAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to ADMT deployers in consequential decisions about Colorado consumers.
What the rule provides
  • Within 30 days of an adverse outcome, explain in plain language the decision and the role of ADMT.
  • Explain how to request information about the system, its data and the rights of correction and review.
Typical evidence
  • Explanation template and delivery log
Verification
Verified in the official source on November 2, 202630-day period checked on leg.colorado.gov; details subject to Attorney General rules.

Data correction and human review

Colorado SB 26-189SB 26-189, derechos del consumidorAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to ADMT deployers in consequential decisions about Colorado consumers.
What the rule provides
  • Let consumers access their personal data and correct inaccurate data.
  • Offer meaningful human review and reconsideration after an adverse outcome, by a trained person with authority to change it.
Typical evidence
  • Review procedure and log of requests and outcomes
Verification
Verified in the official source on November 2, 2026Checked on leg.colorado.gov.

Developer technical documentation for deployers

Colorado SB 26-189SB 26-189, obligaciones del desarrolladorAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to those who develop or sell ADMT used in consequential decisions about Colorado consumers. Selling an AI product is not enough: in the assessment, select the type of decision your product supports.
What the rule provides
  • Give each deployer documentation on intended uses, training data categories, known limitations and instructions for use and human review.
  • Notify deployers of material updates.
Typical evidence
  • Delivered technical documentation and version log
Related base documents
Verification
Verified in the official source on November 2, 2026Checked on leg.colorado.gov.

Keep compliance records for three years

Colorado SB 26-189SB 26-189, conservación de registrosAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to developers and deployers covered by the law.
What the rule provides
  • Keep records showing compliance for at least three years, with version identifiers.
Typical evidence
  • Decision log and system version log
Related base documents
Verification
Verified in the official source on November 2, 2026Three-year period checked on leg.colorado.gov.

Related base documents

Related kits

Includes 7 documents

Credit and Insurance Kit

Model risk with inventory and materiality, adverse-decision explanation letters, human review, a decision log, technical model documentation and the EU AI Act Art. 26 checklist for high-risk systems.

USD 139USD 253

Complete kit · available to buy

Find out what applies to you (free)United States (federal)