Photo of Kim Phan

Kim Phan

Subscribe to Kim Phan's Posts

Kim is a partner in the firm’s Privacy + Cyber Practice Group, where she is a privacy and data security attorney, who also assists companies with data breach prevention and response, including establishing effective security programs prior to a data breach and the assessment of breach response obligations following a breach.

Follow:Read more about Kim PhanKim's Linkedin Profile

On September 16, the Conference of State Bank Supervisors (CSBS) released a new supervisory resource designed to help state examiners assess the use and risks of artificial intelligence (AI) at state-chartered banks and state-licensed nonbank financial institutions. The publicly available framework also gives regulated institutions insight into examiners’ general approach, the types of questions they may ask, and the information they may request regarding an institution’s AI-based products, services, and tools.

In this episode of The Consumer Finance Podcast, host Chris Willis is joined by colleague Kim Phan to break down the proposed regulations recently released by the Colorado attorney general (AG) under the Automated Decision-Making Technology (ADMT) Act, Colorado’s newly amended AI statute, and explain why the financial services industry needs to engage before these rules are finalized.

This article was republished on insideARM on August 19, 2026.

On August 11, the Colorado Department of Law (DOL) filed proposed rules implementing two significant Colorado artificial intelligence laws, the Automated Decision-Making Technology in Consequential Decisions Act (ADMT Act) and the Conversational Artificial Intelligence Services Act (Chatbot Safety Act), both of which take effect January 1, 2027. As we reported in May (here), the Colorado legislature significantly rewrote its earlier 2024 AI law, replacing the prior framework with a more targeted set of obligations focused on automated decision-making technology (ADMT) in consequential decisions. The proposed rules represent the Attorney General’s effort to flesh out that framework before the upcoming effective date. They also begin to answer several of the questions we flagged as unresolved when the new law was signed.

In this episode of FCRA Focus, hosts Kim Phan and Dave Gettings are joined by colleague Tim St. George to unpack major legislative developments impacting employment background screening. They discuss New York’s new statewide ban on the use of consumer credit history in most hiring and employment decisions, Virginia’s upcoming requirements for background screening businesses, and emerging federal proposals that could reshape FCRA liability, reseller obligations, and the reporting of criminal and credit information. The conversation highlights notable litigation trends, preemption and First Amendment issues, and practical steps for employers, CRAs, and resellers navigating rapidly evolving state and federal requirements.

In this episode of The Consumer Finance Podcast, Chris Willis and Kim Phan unpack Colorado’s brand-new Automated Decision-Making Technology (ADMT) Act, which repeals and replaces the state’s much-criticized 2024 AI law. They explain the shift from “high-risk AI systems” to the broader ADMT framework, what it means for consequential decisions in lending and financial services, and how the statute’s “material influence” standard can sweep in tools that do far more than make final credit determinations.

On May 12, the Colorado legislature passed Senate Bill 26‑189, a substantial rewrite of its 2024 law establishing consumer protections for artificial intelligence (formerly referred to as the CO AI Act), and replaced it with a more targeted framework for “automated decision‑making technology” (ADMT). The changes will take effect on January 1, 2027.

The U.S. Department of Justice (DOJ) has issued an interim final rule extending the compliance dates for its 2024 Americans with Disabilities Act (ADA) Title II website and mobile application accessibility regulations for state and local governments. This development is noteworthy for anyone watching the long‑running debate over web accessibility standards, as well as the potential implication of this rulemaking for a future DOJ proposed rule governing public accommodations under Title III of the ADA.

A new discussion draft from Representative Bill Huizenga (R-MI) would significantly update Title V of the Gramm‑Leach‑Bliley Act (GLBA) to reflect how financial data is collected, shared, and monetized in today’s market. Released in connection with the March 17, 2026 House Financial Services Committee (Committee) hearing, “Updating America’s Financial Privacy Framework for the 21st Century,” the draft purports to give consumers greater control over their financial data, impose new limits on financial institutions and data aggregators, and create a more uniform national privacy regime for consumer financial information.

In this episode of FCRA Focus, host Kim Phan is joined by Michael Yaghi, partner in Troutman Pepper Locke’s Regulatory Investigations, Strategy + Enforcement practice group, to unpack the California Department of Financial Protection and Innovation’s (DFPI) latest effort to require registration for the credit reporting industry. They discuss DFPI’s second request for comment, how it fits into California’s broader push to regulate nonbank financial services, and which entities may be swept in beyond the “big three” consumer reporting agencies — such as furnishers, data brokers, specialty credit reporting agencies, resellers, and fintechs. Kim and Michael also explore how narrowly (or broadly) the rules might be drawn, potential overlap and tension with existing FCRA requirements, what registration and reporting could mean in practice for covered entities, and what companies should be doing now as the February 26 comment deadline approaches.

In this special joint episode of The Consumer Finance Podcast and Payments Pros, Taylor Gess and Kim Phan discuss key privacy and data security risks in point-of-sale finance. They dive into regulators’ growing view that every player in the payments chain shares responsibility for protecting data, highlighting best practices for vendor management, PCI DSS oversight, and incident response planning. The episode also touches on the shifting patchwork of state privacy and breach notification laws, GLBA exemptions, and the risks of data monetization, including when packaging and selling transaction data can trigger Fair Credit Reporting Act obligations.