Your Loss Mitigation Platform Is Already in Scope. Are You Ready?

The Regulation Just Caught Up to Mortgage Servicing

The rules governing AI just caught up to mortgage servicing – and most servicers don’t know it yet.

California and Colorado aren’t the first states to pass Automated Decision-Making Technology legislation. But they are the first to set a deadline that falls inside your current planning cycle: January 1, 2027. And the coverage is broader than anyone in this industry is treating it. This isn’t about machine learning or generative AI. It’s about any system that produces a recommendation, score, or classification that influences a consequential financial decision.

“Your loss mitigation platform almost certainly qualifies.”

The industry will follow its familiar pattern – six months debating whether this applies, three months scrambling before the deadline. That cycle has a cost. This time, I think the cost will be higher than most servicers expect.

On January 1, 2027, two major Automated Decision-Making Technology statutes take effect simultaneously: California’s ADMT regulations under the CPPA, and Colorado’s Senate Bill 26-189. The industry conversation has mostly framed these as AI laws. They are not, strictly speaking, AI laws. They are decisioning governance laws. And that distinction changes who is in scope in ways that most servicers and their vendors have not yet absorbed.

The “AI” Misconception That Will Catch Servicers Off Guard

Here is the question I hear most often when I raise this topic with servicing executives:

“We don’t use AI in our loss mitigation decisioning. Does this even apply to us?”

The answer, under both statutes, is almost certainly yes – and the reason matters.

California’s framework covers any technology that replaces or substantially replaces human decision making. Colorado’s SB 189 goes further: it defines Covered ADMT as any technology using computation to generate outputs – predictions, recommendations, classifications, rankings, or scores – that materially influence a consequential decision. Crucially, Colorado’s definition requires no inference at all.

Think about what that means in practical terms. A waterfall logic engine that evaluates a borrower’s income and hardship data against eligibility criteria and produces a modification recommendation is, by the statutory definition, generating output that materially influences a consequential financial services decision. A net present value calculator that scores workout options is doing the same. An eligibility screening tool that classifies a borrower’s situation and routes the file accordingly is doing the same.

This is not a fringe interpretation. Colorado’s own guidance confirms that a system qualifying a decision need not involve inference from data – a system that checks whether an answer falls within an acceptable range qualifies. The exclusions for things like spreadsheets are narrow and apply only to systems that do not produce decision-influencing outputs. Loss mitigation decisioning tools are not spreadsheets.

California vs. Colorado: Two Frameworks, One Deadline

While these two statutes share a coordinated effective date and a common purpose, they are not identical. The table below captures the key distinctions most relevant to a mortgage servicer:

The most significant structural difference is Colorado’s treatment of technology vendors. California places all compliance duties on the business deploying the ADMT. Colorado creates separate and distinct obligations for developers – the companies that build, sell, license, or substantially modify decisioning systems – and voids any contract clause that indemnifies a party for its own discriminatory ADMT-related conduct.

For servicers, this means if your vendor cannot provide you with the documentation Colorado requires developers to produce – intended uses, known limitations, training data categories, material update notices – you have a compliance gap regardless of how well your own internal processes are designed.

What Servicers Need to Do Before January 1, 2027

Seven months is not a long runway when you factor in vendor implementation, workflow redesign, staff training, and legal review. Here is a practical framework for getting started:

• Map your decisioning systems. Identify every platform, tool, or automated workflow that produces a recommendation, classification, score, or routing decision in the loss mitigation lifecycle. Do not limit this exercise to systems you call ‘AI.’ Include waterfall engines, NPV tools, eligibility screeners, document classification systems, and any vendor-supplied automation.
• Assess the disclosure infrastructure. For each system identified, ask: can we produce a plain-language explanation of how this system reached a particular outcome? Can we document the categories of data it used? Can we name the system version and produce a changelog? If the answer to any of those is no, you have work to do.
• Review your vendor contracts. Identify any AI or automation vendor providing services that touch loan outcomes. Require your vendors to produce the developer documentation SB 189 mandates – or establish a timeline for them to do so.
• Build or validate your pre-decision notice workflow. Both statutes require that borrowers be notified before ADMT is used to make a consequential decision affecting them. This needs to be a documented, auditable process – not an ad hoc communication.
• Establish a post-adverse-action disclosure process. Colorado requires a plain-language explanation within 30 days of an adverse outcome. California requires it upon request. Either way, you need a repeatable process for generating compliant, borrower-readable explanations of automated decisions.
• Maintain three years of records.  As required by Colorado, document decisioning activity, system versions, and changelogs in a format that can withstand regulatory examination.

None of these steps are technically exotic. But they require deliberate design – and the platforms you use to execute loss mitigation need to support them natively. A system that cannot produce an audit trail of its decisioning logic, or cannot document version changes, or cannot generate compliant borrower notices, is not a system that will get you to January 1, 2027 without exposure.

The Governance Bar Has Already Been Set

At Outamation, we have been building toward exactly this standard. Not because we anticipated these specific statutes, but because we believe that transparent, auditable, explainable decisioning is the right way to operate in a regulated industry – full stop.

OutamateMods, our loss mitigation decisioning platform, operates on rule-based logic with comprehensive audit trails, version tracking, and workflow-driven compliance checks built in from the start. It does not use AI in its decisioning framework – which means it operates on the kind of transparent, inspectable logic that regulators can examine and that servicers can explain to borrowers. And Outamation’s ISO/IEC 42001 certification – the first awarded to a US mortgage technology company – demonstrates that our organizational governance, risk assessment, and documentation practices meet the international standard for managing decision-making technology responsibly, whether or not AI is involved.

OutamateDocs provides the borrower notice infrastructure these statutes require: a self-service document generation system with integrated mailing capabilities, complete versioning, and a full audit trail of every notice generated and delivered. When a loss mitigation decision triggers a disclosure obligation, OutamateDocs closes the loop – consistently, compliantly, and with documentation to prove it.

California and Colorado are almost certainly not the last states to adopt this framework. The coordinated timing, the breadth of the covered domain definitions, and the alignment of core obligations across very different statutory schemes all point in one direction. Federal attention to algorithmic accountability in financial services is growing. State legislatures have shown a renewed appetite for consumer protection frameworks modeled on California’s regulatory leadership.

The signposts are evident. The governance bar has been set. The question for every servicing executive and every technology vendor in this industry is a simple one: are you already there, or do you have seven months to get there?