{
 "slug": "colorado-sb-26-189-implementing-algorithmic-discrimination-protections",
 "topic_id": "TOPIC-054",
 "cluster": "Regulatory & Sovereign AI",
 "tier": "Tier B",
 "title": "Adverse action under algorithmic discrimination law",
 "summary": "State AI acts require deployers to explain adverse decisions and demonstrate they guarded against discriminatory outcomes. Both obligations attach to individual decisions.",
 "lede": "An explanation obligation is easy to state and hard to satisfy retrospectively. If the system did not record what drove a particular decision and what the reviewer considered, the explanation produced later is a reconstruction.",
 "date": "2024-04-16",
 "category": "Compliance",
 "author_id": "constance-ibe-whitmore",
 "tags": [
  "Colorado AI Act",
  "algorithmic discrimination",
  "adverse action",
  "state regulation",
  "deployer obligations",
  "compliance"
 ],
 "image_title": "Adverse Action Algorithmic Discrimination",
 "schema": "Article",
 "key_takeaways": [
  "Deployer obligations are per-decision: explain this outcome, to this person, with the factors that drove it.",
  "Impact assessments operate at the system level and do not answer questions about individual decisions.",
  "A record capturing the output, what the reviewer saw, and their reasoning serves both the explanation duty and the diligence defence."
 ],
 "body": [
  {
   "type": "h2",
   "text": "Two obligations at two levels"
  },
  {
   "type": "diagram",
   "kind": "compare",
   "alt": "System-level obligations are familiar work; decision-level obligations are where the gap sits",
   "caption": "Organisations invest heavily in the left column because it resembles a privacy impact assessment.",
   "nodes": [],
   "left": {
    "title": "System level",
    "items": [
     "Impact assessment",
     "Risk management programme",
     "Disclosure",
     "Reviewed periodically"
    ]
   },
   "right": {
    "title": "Decision level",
    "items": [
     "Explain this adverse outcome",
     "To this person",
     "With the factors that drove it",
     "Captured at decision time"
    ]
   }
  },
  {
   "type": "table",
   "head": [
    "Level",
    "Obligation",
    "Artefact"
   ],
   "rows": [
    [
     "System",
     "Impact assessment, risk management programme, disclosure",
     "Documents, reviewed periodically"
    ],
    [
     "Decision",
     "Explanation of an adverse outcome, opportunity to correct or appeal",
     "<strong style=\"font-weight:600\">Per-decision records</strong>"
    ]
   ]
  },
  {
   "type": "p",
   "html": "Organisations preparing for these laws tend to invest heavily in the first row, because it is familiar work that resembles a privacy impact assessment. The second row is where the operational gap sits."
  },
  {
   "type": "h2",
   "text": "What an explanation has to contain"
  },
  {
   "type": "p",
   "html": "Statutory phrasing varies; the substance is consistent. A consumer subject to an adverse decision should learn the principal reasons, the data used, and how to correct it or seek review."
  },
  {
   "type": "p",
   "html": "That requires knowing, for a specific decision, which inputs were present and which factors drove the outcome. If the system logs only an outcome, an explanation generated afterwards is inferred from a model's general behaviour rather than from that decision."
  },
  {
   "type": "h2",
   "text": "Why reconstruction is fragile"
  },
  {
   "type": "ol",
   "items": [
    "<strong style=\"font-weight:600\">The model changed.</strong> Retraining, version updates and feature changes mean the current model is not the one that decided.",
    "<strong style=\"font-weight:600\">The inputs changed.</strong> Source data is updated. Re-scoring today produces different values.",
    "<strong style=\"font-weight:600\">The explanation method is approximate.</strong> Post-hoc attribution gives an approximation of factor influence, and different methods disagree.",
    "<strong style=\"font-weight:600\">The human step is unrecorded.</strong> If a reviewer confirmed the outcome, their reasoning is usually nowhere."
   ]
  },
  {
   "type": "p",
   "html": "Each of these is defensible individually. Together they mean a business explaining a decision from eight months ago is describing what the system probably did."
  },
  {
   "type": "h2",
   "text": "Capturing at decision time"
  },
  {
   "type": "code",
   "text": "{\n  \"decision_id\": \"D-2026-88213\",\n  \"at\": \"2026-01-14T09:41:00Z\",\n  \"system\": { \"name\": \"underwriting-v4\", \"version\": \"4.2.1\",\n              \"model_digest\": \"sha256:9c1f...a83e\" },\n  \"inputs_digest\": \"sha256:2b7d...4056\",\n  \"outcome\": \"adverse\",\n  \"principal_factors\": [\n    { \"factor\": \"payment_history\",  \"direction\": \"negative\" },\n    { \"factor\": \"credit_utilisation\", \"direction\": \"negative\" },\n    { \"factor\": \"account_tenure\",   \"direction\": \"negative\" }\n  ],\n  \"human_review\": {\n    \"rendered_digest\": \"sha256:d7b2...1f8a\",\n    \"reviewer\": \"[named individual]\",\n    \"considered_alternatives\": true,\n    \"rationale\": \"[free text]\",\n    \"decision\": \"upheld\"\n  },\n  \"signature\": \"...\"\n}"
  },
  {
   "type": "p",
   "html": "Recording the model digest and the inputs digest is what makes this durable. Years later you can state exactly which model version and which input set produced the outcome, without needing either to still exist in production."
  },
  {
   "type": "h2",
   "text": "The diligence dimension"
  },
  {
   "type": "p",
   "html": "These statutes typically provide that a deployer who exercised reasonable care is in a better position. Reasonable care is demonstrated by evidence, not asserted."
  },
  {
   "type": "ul",
   "items": [
    "Impact assessments performed and acted upon",
    "Outcome monitoring across protected categories, with results",
    "Human review at defined points, with records showing it operated",
    "Override rates that indicate review is substantive",
    "Response to identified disparities, with dates"
   ]
  },
  {
   "type": "p",
   "html": "The third and fourth items are where per-decision records do double duty. They serve the explanation obligation and they evidence that the oversight programme functioned."
  },
  {
   "type": "h2",
   "text": "What to do without waiting for final rules"
  },
  {
   "type": "p",
   "html": "Rulemaking under these statutes is ongoing and effective dates have moved. Three things are worth doing regardless, because every plausible version requires them."
  },
  {
   "type": "ol",
   "items": [
    "Record the model version and inputs digest with every consequential decision. Cheap, and it makes everything else possible.",
    "Capture what human reviewers were shown, as a digest of the rendered content.",
    "Make rationale mandatory on adverse outcomes and overrides."
   ]
  },
  {
   "type": "p",
   "html": "None of these depends on how the final rules read. All of them are difficult to add retrospectively, which is the argument for doing them now."
  },
  {
   "type": "p",
   "html": "This describes regulatory structure at a general level and is not legal advice. Applicability, definitions, exemptions and effective dates vary and change; take specifics to counsel."
  },
  {
   "type": "h2",
   "text": "Why reconstruction fails"
  },
  {
   "type": "table",
   "caption": "Four reasons an explanation produced later is a description rather than a record",
   "head": [
    "Reason",
    "Effect"
   ],
   "rows": [
    [
     "The model changed",
     "Retraining and version updates mean the current model is not the one that decided"
    ],
    [
     "The inputs changed",
     "Source data is updated; re-scoring today produces different values"
    ],
    [
     "Attribution is approximate",
     "Post-hoc methods give an approximation, and different methods disagree"
    ],
    [
     "The human step is unrecorded",
     "If a reviewer confirmed the outcome, their reasoning is usually nowhere"
    ]
   ]
  },
  {
   "type": "p",
   "html": "Each is defensible on its own. Together they mean a business explaining a decision from eight months ago is describing what the system probably did."
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Our impact assessments cover this.”</strong> They operate at the system level. An explanation obligation attaches to an individual decision, and no assessment answers it."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“The rules are not final, so we should wait.”</strong> Recording a model version and inputs digest is cheap, survives any rulemaking outcome, and cannot be added retrospectively. Waiting costs you the decisions made in the meantime."
  },
  {
   "type": "p",
   "html": "Reasonable care is demonstrated by evidence, not asserted. Outcome monitoring across protected categories, human review with records showing it operated, override rates indicating the review is substantive, and dated responses to identified disparities."
  }
 ],
 "faq": [
  {
   "q": "Do impact assessments satisfy the explanation duty?",
   "a": "No. They operate at the system level. Explanation obligations attach to individual decisions and require per-decision records."
  },
  {
   "q": "Why can't we reconstruct explanations later?",
   "a": "The model version and input data change, post-hoc attribution is approximate and method-dependent, and the human reviewer's reasoning is usually unrecorded."
  },
  {
   "q": "What is the cheapest first step?",
   "a": "Record the model version and an inputs digest with every consequential decision. It is small work and makes durable explanation possible."
  },
  {
   "q": "Is this legal advice?",
   "a": "No. Applicability, definitions, exemptions and effective dates vary by state and continue to change. Take specifics to counsel."
  },
  {
   "q": "Why can't explanations be reconstructed later?",
   "a": "Model versions and input data change, post-hoc attribution is approximate and method-dependent, and the reviewer's reasoning is usually unrecorded."
  }
 ],
 "sources": [
  {
   "t": "Colorado SB24-205 — Consumer Protections for Artificial Intelligence (signed act)",
   "u": "https://leg.colorado.gov/sites/default/files/2024a_205_signed.pdf"
  },
  {
   "t": "Regulation B (12 CFR Part 1002) — Equal Credit Opportunity Act",
   "u": "https://www.consumerfinance.gov/rules-policy/regulations/1002/"
  },
  {
   "t": "NIST AI Risk Management Framework 1.0",
   "u": "https://www.nist.gov/itl/ai-risk-management-framework"
  },
  {
   "t": "Published guidance on post-hoc explanation methods and their limitations."
  }
 ],
 "related": [
  {
   "slug": "ccpa-admt-regulations-californias-automated-decision-making-rules",
   "title": "California's automated decision-making rules",
   "category": "Compliance"
  },
  {
   "slug": "eu-ai-act-article-14-human-oversight-playbook",
   "title": "Article 14 asks who the natural person was",
   "category": "Compliance"
  },
  {
   "slug": "nist-ai-rmf-1-0-vs-cryptographic-reality",
   "title": "Mapping NIST AI RMF to real controls",
   "category": "Comparison"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Adverse%20Action%20Algorithmic%20Discrimination/1500_900/blog.jpg",
 "wordcount": 873,
 "url": "/blog/colorado-sb-26-189-implementing-algorithmic-discrimination-protections.html",
 "reading_time": "4 min read",
 "meta_description": "State AI acts require deployers to explain adverse decisions and demonstrate they guarded against discriminatory outcomes.",
 "hub": {
  "slug": "topics/ai-oversight-regulation",
  "title": "AI oversight and regulation"
 },
 "answer": "A per-decision explanation: the principal reasons, the data used, and how to correct it or seek review. That requires knowing which inputs were present and which factors drove the outcome for that specific decision — which is only possible if it was captured when the decision was made.",
 "answer_q": "What do algorithmic discrimination laws require for an adverse decision?",
 "entities": [
  {
   "name": "Colorado AI Act (SB24-205)",
   "type": "Thing",
   "url": "https://leg.colorado.gov/sites/default/files/2024a_205_signed.pdf",
   "primary": true
  }
 ],
 "glossary": [
  {
   "term": "Algorithmic discrimination",
   "def": "An unlawful differential outcome produced or contributed to by an automated system, which these statutes require deployers to guard against."
  },
  {
   "term": "Deployer",
   "def": "The party using a high-risk system in its own decisions, as distinct from the developer. Most obligations attach here."
  },
  {
   "term": "Principal reasons",
   "def": "The factors that drove an adverse outcome, which an explanation obligation requires be communicated to the affected person."
  }
 ],
 "checklist": {
  "title": "Three things worth doing before the rules settle",
  "id": "now",
  "desc": "All three survive any final text and none can be backdated.",
  "steps": [
   {
    "name": "Record the model version and inputs digest.",
    "text": "With every consequential decision. Cheap, and it makes durable explanation possible."
   },
   {
    "name": "Capture what human reviewers were shown.",
    "text": "As a digest of the rendered content."
   },
   {
    "name": "Make rationale mandatory on adverse outcomes and overrides.",
    "text": "These are the decisions that get examined."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav's decision receipt fixes the model digest, the inputs digest, the principal factors and the reviewer's rationale at the moment of the decision, so an explanation years later is a retrieval rather than a reconstruction.",
  "href": "../docs.html",
  "label": "See decision receipts"
 }
}