Beyond FCRA and GLBA: Financial Institutions, State AI Laws, and Missing Exemptions

This CLE course will guide financial services counsel through emerging state AI and automated decision-making technologies (ADMT) laws that lack Fair Credit Reporting Act (FCRA) and Gramm-Leach-Bliley Act (GLBA) exemptions. The panel will explain how these frameworks differ from federal law, where new obligations begin, and what steps institutions should take now to reduce compliance and litigation risk.

The financial services industry is experiencing an AI revolution, but with innovation comes risk. As banks increasingly deploy AI for everything from fraud detection to loan decisions, a new wave of regulations and compliance requirements is evolving, especially at the state level.

State regulators are moving quickly to establish new requirements for AI and ADMT—and unlike state privacy laws, many of these frameworks do not include FCRA and/or GLBA exemptions. For consumer reporting agencies and financial institutions, this creates a new layer of complexity and uncertainty that cannot be ignored.

The FCRA regulates the use and furnishing of consumer reports. It also mandates specific credit score disclosures when a credit score is used to take adverse action against a consumer. In some cases, proprietary machine-driven loan scores and AI-influenced decisions may qualify as credit scores, triggering disclosure requirements under the FCRA.

The GLBA imposes privacy notice and information security obligations on financial institutions with respect to nonpublic personal information. AI systems that collect, synthesize, or transmit consumer financial data—including through integrations with third-party model providers or APIs—may be subject to GLBA requirements.

Listen as Roshni Patel and Alex Cox of Troutman Pepper Locke unpack the emerging state regulatory AI landscape and its direct impact on financial institutions. After attending, you'll gain a clear understanding of where state laws are headed, how they differ from existing frameworks, and what steps financial institutions should be taking now to improve governance strategies, align compliance efforts, and mitigate risk.