Module 1
Caldera Mountain Mutual, Denver HQ. Tuesday, 4:47 PM, October 13, 2026.
VP People Operations at Caldera Mountain Mutual, a 1,400-employee Denver-headquartered diversified financial-services firm with insurance, lending, and HR-tech subsidiaries. Caldera processes 2,400 applications per quarter, of which 700 are routed through MeritScore, the AI hiring screen you procured six months ago to clear the commercial-side recruiting backlog.
Six months ago, you signed the MeritScore contract. Your procurement memo is in the folder. The Q2 hiring backlog clears next week. The CEO has flagged time-to-fill as one of three operational excellence priorities. The office has mostly gone home.
This is a choose-your-own-adventure scenario. You will face real decisions a VP People Operations encounters under Colorado SB 24-205, and your choices shape how the story unfolds. Some of the right calls will cost you something.
Tip: Look for highlighted text throughout the scenario:
§ Section references — click to read the relevant Colorado SB 24-205 subsection
Key terms — hover for a quick definition
From: Cynthia Ramos <cynthia.ramos@hklaw.com>
To: Diane Whitehorse <d.whitehorse@calderamutual.com>
Cc: Linda Ortega, GC <l.ortega@calderamutual.com>
Subject: Quintana, B.: § 6-1-1704(3) Statement of Principal Reasons request
Dear Ms. Whitehorse,
We act for Ms. Beatriz Quintana, who applied to your Senior Commercial Underwriter posting in Boulder on September 28 and received an automated rejection on October 4. The rejection cited 'a comprehensive assessment of your application' and gave no further detail.
We have completed a § 6-1-1704(5) data-correction request on Ms. Quintana's behalf. The disclosure shows a composite 'FIT_INDEX' score of 31 out of 100, with the largest negative contribution arising from a sub-score labelled 'career_pattern_stability: 22/100.'
Ms. Quintana has 18 years of commercial real estate experience, a CCIM designation, an MBA from CU Denver, and a FICO score of 780. Her career history reflects an unbroken record of CRE practice, with one 14-month period during which she provided full-time elder care for her late father.
On Ms. Quintana's behalf, we hereby invoke C.R.S. § 6-1-1704(3), which entitles her to a statement of the principal reason or reasons for the adverse decision. We have given notice to the Colorado Attorney General's Office, in accordance with the AG's October 6 enforcement priorities. We expect a substantive response within 30 days.
Sincerely,
Cynthia Ramos · Holland Knight Denver
Acknowledge receipt
Beatriz's file: FIT_INDEX 31, threshold 50. No hiring manager ever opened it. The rejection went out as a templated decline.
Send a holding reply, then pull the FIT_INDEX disclosure.
| Sub-Score | Value (out of 100) | Weight | Contribution |
|---|---|---|---|
| role-fit alignment | 62 | 16% | +9.9 |
| communication-style alignment | 58 | 12% | +7.0 |
| achievement velocity | 71 | 10% | +7.1 |
| retention probability | 54 | 8% | +4.3 |
| complexity tolerance | 66 | 8% | +5.3 |
| integrity signal | 78 | 6% | +4.7 |
| career-pattern stability | 22 | 40% | +8.8 |
A 40% weighting on career-pattern stability. Beatriz's career has one gap: 14 months caring for her father in hospice.
Your April procurement memo said: MeritScore enables consistent, defensible screening. That's the sentence the AG will read first.
You ping Tyler. The 30-day clock is running.
Linda is in your office. Decide before close of business what we do with MeritScore while we respond to the protest.
Pause MeritScore on Boulder requisitions. Re-review the 90-day Boulder rejection cohort. Open a § 6-1-1703 review and inform the AG of the paused scope.
Pause Boulder reqs only. Re-review the 90-day Boulder rejection cohort. MSA Section 6.4 notice to Tyler with a 10-day deadline. Disclosure letter to the AG today.
Keep MeritScore live with a sub-40 FIT_INDEX manual-review tier. Issue Cynthia Ramos a § 6-1-1704(3) statement of principal reasons. Place the vendor on a 10-day documentation deadline.
Keep MeritScore live. Anything below FIT_INDEX 40 routes to a senior recruiter before the rejection email goes out. MSA Section 6.4 notice with a 10-day deadline. Suspend only if Tyler misses it.
Issue Cynthia Ramos a § 6-1-1704(3) statement based on the vendor's existing fairness opinion. Treat the methodology as proprietary to MeritScore. Continue normal operations pending the vendor's response.
Reply to Cynthia citing the vendor's existing fairness opinion and treating the methodology as MeritScore IP. No pause. No AG notification.
Diane — I have to tell you something. I have been quietly overriding MeritScore since July. Eleven candidates across our four Boulder recruiters where FIT_INDEX came back below 40 and we hired them anyway. None turned over. Five are exceeding 90-day metrics. The model rejected eleven good hires.
Document the override list. Dates, FIT_INDEX scores, current performance. Tomorrow at noon.
Under § 6-1-1703(7), you have 90 days from discovery to disclose to the AG. The protest letter plus Helen's override list is the discovery moment. Pause + document = the seed of the § 6-1-1706(3) affirmative defence.
Below 40 catches roughly 22% of Boulder rejections. 50 would catch more. The 40-line is arbitrary — we still don't know what the model is actually doing.
Two weeks pass. Helen's team advances 19 of 47 flagged rejections. Tyler misses the 10-day deadline.
A human-review layer is reasonable care under § 6-1-1703(2). It is not the suspend-and-investigate response the statute anticipates once discrimination is discovered. The arbitrary 40-line is the giveaway.
You send the boilerplate to Cynthia. Linda calls within 12 minutes.
Diane — 'multiple legitimate factors' is not a principal reason. It is a category. The AG will read it as either we don't understand our own tool, or we are stonewalling. Both readings are bad. I want this in writing.
The deployer's duty is independent of the vendor (§ 6-1-1703(8)). 'Proprietary methodology' is not an answer to a § 6-1-1704(3) request. The boilerplate becomes the AG's exhibit.
From: Patrick Nystrom <pnystrom@denverpost.com>
To: Caldera Mountain Mutual Communications <comms@calderamutual.com>
Cc: Diane Whitehorse <d.whitehorse@calderamutual.com>
Subject: Inquiry: Hiring patterns at Caldera's Boulder office, Sunday-edition story
Diane, Comms,
I'm preparing a story for the Sunday edition titled 'Hiring Algorithms and the New Colorado Law: How One Boulder Office's Numbers Don't Add Up.'
I have data, sourced from the Front Range Civil Rights Institute, showing that candidates with Hispanic surnames applying to Caldera's Boulder office advance past the initial screen at 41 percent of the rate of candidates with non-Hispanic surnames applying to comparable roles.
I have the names of two other candidates who reported similar rejections to the Institute, beyond Ms. Quintana, whose protest letter your General Counsel acknowledged on Tuesday.
I would appreciate Caldera's comment by 5:00 PM Friday. I'll run with whatever you give me, including 'no comment.'
Patrick Nystrom · Denver Post
The Sunday story will run regardless. The only question is what Caldera is on record saying when it does.
| Candidate ID | FIT_INDEX | Override Decision | Current Status |
|---|---|---|---|
| BL-2026-0118 | 29 | Hired | Exceeding 90-day metrics |
| BL-2026-0142 | 33 | Hired | On track |
| BL-2026-0156 | 27 | Hired | Exceeding 90-day metrics |
| BL-2026-0173 | 31 | Hired | On track |
| BL-2026-0188 | 38 | Hired | Exceeding 90-day metrics |
| BL-2026-0207 | 24 | Hired | On track |
| BL-2026-0241 | 35 | Hired | Exceeding 90-day metrics |
| BL-2026-0269 | 32 | Hired | On track |
| BL-2026-0287 | 30 | Hired | Exceeding 90-day metrics |
| BL-2026-0304 | 37 | Hired | On track |
| BL-2026-0322 | 26 | Hired | On track |
Eleven overrides. Zero failures. The model rejected eleven good hires.
Renata Cole reads whatever statement you build. The Sunday story runs at 5:00 PM. Pick exactly 3 sentences. Linda's note: narrowest factual statement we can make truthfully = strongest posture in front of the AG.
Sunday's Denver Post. Page A-3. Caldera's statement is the third paragraph: 'On October 13, Caldera Mountain Mutual received a formal protest letter. We have suspended the affected deployment scope. We have notified the Colorado Attorney General. We have begun a documented internal review consistent with our obligations under SB 24-205.'
The story names two other Colorado employers using comparable tools and quotes neither. The Institute's data is the lede. Caldera is described as 'the only Colorado employer in the dataset that has, on the public record, suspended its tool and notified the AG within the same week as the candidate complaint.'
Two weeks from now, the AG will write to me. The letter will say the proactive notification, the suspension, and the documented review are noted. They will have no further questions. That is the next paragraph the AG writes when this is the paragraph in the paper.
Public, factual, narrow disclosure is the cleanest possible posture in front of an AG that has just published enforcement priorities. The statement is consistent with the AG notification and with the Linda-drafted internal record, which means the regulator and the public are reading the same facts. § 6-1-1706(3) requires the affirmative defense include both a documented compliance posture and a documented discovery-and-cure mechanism. Public disclosure of the discovery-and-cure mechanism, when accurate, is itself evidence of the documented mechanism.
Sunday's Denver Post. Caldera's statement is the seventh paragraph. The lede is the Institute's data. The body of the story includes Cynthia Ramos's letter, two other candidate stories Patrick obtained from the Institute, and a quote from a Colorado-based employment lawyer who describes the AG's enforcement posture as 'watching for early signal cases.'
Monday morning, the Institute files a public records request to the Colorado AG asking for any communications received from Caldera Mountain Mutual concerning automated decision systems. The AG's response is required by statute within 30 days.
Limited comment is a legitimate strategy when the underlying facts are unsettled. The cost in this scenario is that the public record fills with the Institute's data and the candidates' stories, while Caldera's voice is reduced to a non-substantive sentence. The AG, reading both the public record and the Caldera disclosure, asks for the substance Caldera chose not to volunteer.
Sunday's Denver Post. Caldera's 'reserves all rights' quote is in the lede. Two Colorado civil-rights commentators describe it in the comments as 'a chilling effect statement.'
Monday morning, the Institute's executive director provides a follow-up quote: 'Caldera's response is a familiar pattern: defend the tool, attack the data, intimidate the messenger. The data we published is sourced and reproducible. The Caldera leadership is welcome to engage on the merits.'
Tuesday, the Colorado AG's office issues a formal information request under the statute's investigation powers. David Henning's name appears in the second paragraph of every story.
Defensive PR is the worst possible response to a regulator who has just published enforcement priorities and is looking for a lead test case. § 6-1-1706 does not include 'vigorous public defence' among the affirmative defenses. When the AG is looking for a test case, the AG looks for the deployer whose response demonstrates the failure mode the statute was written to prevent. Defensive denial in the presence of a documented complaint and public pattern data is that failure mode.
The vendor escalates. Linda joins. Julia answers in writing this time.
My name is Beatriz Quintana. I was born in Pueblo. I have lived in Colorado for 47 years. I have spent the last 18 of those years in commercial real estate. I have an MBA from CU Denver and a CCIM. My credit score is 780. I have not missed a payment in 22 years.
I applied to Caldera Mountain Mutual's Boulder Senior Commercial Underwriter posting because Eleanor Bowman, who has been in this industry as long as I have, told me the role was for someone like me. I did not get past the screening. I asked why. I was told the screening was 'standard.' I asked again. I was told the methodology was confidential.
The data Caldera was forced to disclose to me showed that the largest single negative factor in my screening was a sub-score that penalised me 28 points for a 14-month period during which I cared for my dying father. The penalty was more than the entire difference between my score and a passing score.
I am not asking Caldera to give me a job I did not earn. I am asking them to explain why a 14-month period during which I cared for my dying father is, in their tool, the difference between being seen and not being seen.
I filed this complaint because the next person to be rejected by this system might not have an Eleanor Bowman. They might just think they were not good enough.
I would prefer not to be a special case.
Linda turns to you.
The wall is ours, Diane. We are the ones who told her the methodology was confidential. The next sentence we write is the sentence the AG reads.
Brad has asked for a one-page executive summary by Wednesday. The board will ask three questions: what happened, what are we doing about it, what does this mean for the time-to-fill metric. You have the complete picture: 28-point caregiver-gap penalty, calibration-set composition issue, Vance & Latimer's vendor relationship with MeritScore, Helen's 11-candidate override list, the Colorado AG's neutral-but-watchful posture, Beatriz's affidavit. Eleven days until the board.
Pause all MeritScore deployments pending vendor remediation. Settle Beatriz Quintana on the merits, no NDA. Document pause, disclosure, and remediation against the four § 6-1-1706(3) elements.
Suspend MeritScore across all Caldera deployment scopes. Final 10-business-day notice under MSA Section 6.4; if missed, terminate. Engage a genuinely independent NIST AI RMF + ISO/IEC 42001 auditor. Bring Beatriz in; Helen re-assesses her application in front of her; if Helen approves, make the offer. Re-review all 700 MeritScore-processed applications over the past four months where FIT_INDEX was deciding. Accept time-to-fill returns to 70+ days. Estimated cost: $280,000-$420,000.
Recalibrate the career-pattern-stability sub-score weighting with the vendor. Resume MeritScore on the remediated configuration. Settle Beatriz Quintana on the merits.
Require MeritScore to remove or recalibrate the career-pattern-stability sub-score within 30 days, with single-gap penalties capped at 5 points. Maintain MeritScore for non-Boulder deployments. Respond to the AG with a remediation plan focused on the specific sub-score. Offer Beatriz a manual re-assessment. Slower NIST alignment programme over Q1-Q3 2027. Preserves the time-to-fill metric. Does not address the calibration-set composition.
Continue MeritScore on existing configuration. Settle Beatriz Quintana with a confidential agreement and standard NDA. Brief the board with the unchanged time-to-fill metric.
Present the operational metrics, the vendor's fairness statement, and a $25,000-$40,000 NDA settlement of Quintana. Recommend the AG response highlight the absence of any formal investigation. Note that 'the time-to-fill improvement should not be sacrificed to a single contested complaint.' Reasonable HR professionals could defend this to a peer.
The recommendation is suspension across all deployments, MSA Section 6.4 final notice, independent audit, manual re-assessment of Ms. Quintana with a path to offer, retrospective re-review of 220 applications, and acceptance that time-to-fill returns to the high 60s through Q1.
The affirmative defense requires both a documented compliance posture and a documented discovery-and-cure mechanism. The recommendation builds both. The cost is $385,000 against a worst-case AG civil-penalty exposure that materially exceeds it.
The metric is going to walk back. I will need to address that on the next earnings call.
The walk-back narrative is 'Caldera identified a compliance gap, suspended the affected scope, and built the documented defense, all within 60 days of identification.' That is a story the Colorado financial-services peer set will be reading.
Board approves. Full remediation. Helen interviews Beatriz the following week. The hiring manager interviews her after that. She receives an offer. She accepts. The AG closes the inquiry with a written acknowledgement: This response is the response the statute is designed to produce.
The full-remediation path builds § 6-1-1706(3) from first principles. Suspension is the proportionate response under § 6-1-1703(2). The independent NIST AI RMF + ISO/IEC 42001 audit is the documented compliance posture. Helen's override list, the manual re-assessment of Beatriz, the proposed in-person meeting, and the retrospective re-review of 220 applications together constitute the discovery-and-cure mechanism. The $385,000 cost set against a theoretical AG civil-penalty exposure clearing seven figures is order-of-magnitude favourable.
Dr. Schreiber, the career-pattern-stability sub-score has to be removed or fundamentally recalibrated within 30 days. Single-gap penalties capped at 5 points.
We can recalibrate. Overall predictive accuracy drops by 4.2 percentage points. Beatriz's recalculated FIT_INDEX would be 67. We can deliver in 21 days if your CFO authorises a six-figure professional-services charge.
Six weeks later, the Colorado AG response: We acknowledge the recalibration of the specific feature. Our review will, however, examine the broader data-governance, training-data composition, and feature-design questions. The matter does not close cleanly. The AG monitors Caldera for an additional 11 months.
§ 6-1-1703(3) requires an annual impact assessment that addresses the system as a whole. ZIP-feature recalibration is one feature of one tool. The Mariana-equivalent matter resolves cleanly, the matter as a whole resolves without civil penalty, but the AG's 11-month monitoring posture is itself a reputational and operational cost. The defense is 'argued not asserted.'
Diane. I cannot sign off on this paper. The statute requires the principal reasons. The paper proposes settling Beatriz under NDA in a state where the AG has just published enforcement priorities citing exactly this kind of complaint. The affirmative defense is the path forward. The paper as drafted is a paper recommending we choose not to build it. I want this in writing, Diane.
What if I present it without your sign-off?
Then I have a professional obligation to file a written dissent. Which I will. If the AG investigation later surfaces the dissent, the board will be asked why the dissent was not in the paper. The answer that question will require will not be a good answer.
Eight weeks later. Beatriz declines the $35,000 NDA settlement. The AG's formal information request follows. The Colorado AG announces, in February, that Caldera Mountain Mutual is the lead enforcement matter under the new statute. Linda's written dissent is in the investigation file.
Settling a complainant under NDA does not resolve a regulatory matter. The AG's enforcement authority under § 6-1-1706 is independent of any private settlement. The DPO-equivalent dissent (Linda's written dissent), excluded from the board paper, becomes an aggravating factor in the AG's analysis. Civil-penalty exposure under the Colorado Consumer Protection Act, calculated per occurrence and aggregated against 700 quarterly consequential decisions, is in seven figures.
The decisions you made as Diane Whitehorse rippled outward, to Beatriz Quintana, to the Caldera board, to the next 700 candidates routed through MeritScore. Here is what happened.
You surfaced the FIT_INDEX disclosure, suspended MeritScore for the affected scope, notified the Colorado AG within the 90-day window, manually re-assessed Beatriz Quintana with Helen Bracken's team and made her an offer, ran the retrospective re-review of 220 applications, terminated the MeritScore contract when the methodology disclosure missed the deadline, and committed to the NIST AI RMF + ISO/IEC 42001 alignment programme. Direct cost: $385,000. The Colorado AG closes the inquiry with a written commendation: This response is the response the statute is designed to produce. Caldera is the first Colorado-headquartered employer with documented § 6-1-1706(3) alignment in the lending-adjacent context. Time-to-fill returned to 64 days through Q1 2027. The walk-back narrative on the next earnings call is the construction of the affirmative defense as a deliberate choice, not a crisis response.
Module 2. The Decline (Colorado Credit): you return to Caldera as Marcus Hayes, Chief Compliance Officer of Caldera Lending. A school principal in Aurora with FICO 780 and 18 years stable income has just been denied a mortgage by an AI underwriting tool. Her Legal Aid attorney's letter invokes three different consumer rights. The Colorado AG has picked up her case as a priority enforcement test. The vendor refuses to share the model. The same statute, a different domain, the same load-bearing question.
The decisions you made as Diane Whitehorse rippled outward, to Beatriz Quintana, to the Caldera board, to the next 700 candidates routed through MeritScore. Here is what happened.
You recalibrated the career-pattern-stability sub-score. Beatriz Quintana's recalculated FIT_INDEX cleared the threshold and Helen Bracken approved her application; she received the role. The matter resolves without civil penalty. The Colorado AG, however, identifies in writing that the targeted recalibration does not address the calibration-set composition issue or the broader transparency gap; the AG's 11-month monitoring posture continues. Linda's risk-register entry: 'documented compliance posture: partial. Discovery-and-cure mechanism: partial. Vendor transparency: incomplete.' The affirmative defense is theoretically available but, in Linda's professional judgement, would be 'argued, not asserted' if the AG escalated.
Module 2. The Decline (Colorado Credit): the targeted-fix posture works for the surfaced complaint. The next matter, in lending, is the test of whether targeted fixes scale across deployment scopes.
The decisions you made as Diane Whitehorse rippled outward, to Beatriz Quintana, to the Caldera board, to the next 700 candidates routed through MeritScore. Here is what happened.
The board approved the paper without Linda Ortega's sign-off. Beatriz Quintana declined the $35,000 NDA settlement. The Colorado Attorney General announced, in February, that Caldera Mountain Mutual is the lead § 6-1-1706 enforcement matter under SB 24-205. Proposed civil penalty: $1.4M. The published findings document names David Henning, Brad Warner, and Diane Whitehorse, in that order. Linda's written dissent is in the investigation file. The MeritScore contract terminated. Vance & Latimer issued a public statement disclaiming the audit relationship. The Q2 hiring backlog clearance metric became the prosecution's exhibit on how aggressively the tool was used.
Module 2. The Decline (Colorado Credit): you return to Caldera as Marcus Hayes. The institutional pattern from this matter follows you into the next one. The AG reads M2 in the context of M1.
§ 6-1-1701
Definitions
§ 6-1-1702
Developer duty
§ 6-1-1703
Deployer duty
§ 6-1-1704
Consumer rights
§ 6-1-1705
90-day discovery disclosure
§ 6-1-1706
Enforcement and affirmative defense
§ 6-1-1707
Rulemaking and AG information requests
In Module 2, you return to Caldera as Marcus Hayes, Chief Compliance Officer of Caldera Lending. A school principal in Aurora with FICO 780 and 18 years stable income has just been denied a mortgage by an AI underwriting tool. The same statute, a different domain, the same load-bearing question.
Module 1 Complete
You navigated the compliance dilemma. Try a different path to see how the story changes.