{"id":6994,"date":"2026-10-07T02:23:55","date_gmt":"2026-10-07T02:23:55","guid":{"rendered":"https:\/\/blogs.luc.edu\/compliance\/?p=6994"},"modified":"2026-10-07T02:23:55","modified_gmt":"2026-10-07T02:23:55","slug":"what-colorados-ai-rewrite-tells-us-about-the-future-of-ai-compliance","status":"publish","type":"post","link":"https:\/\/blogs.luc.edu\/compliance\/?p=6994","title":{"rendered":"What Colorado\u2019s AI Rewrite Tells Us About the Future of AI Compliance"},"content":{"rendered":"

Luke Lister<\/span><\/i>\u00a0<\/span><\/p>\n

Associate Editor<\/span><\/i>\u00a0<\/span><\/p>\n

Loyola University Chicago School of Law, JD 2028<\/span><\/i>\u00a0<\/span><\/p>\n

The <\/span>Colorado AI Act<\/span><\/a> (CAIA), formally known as the \u201cConsumer Protections for Artificial Intelligence\u201d Act, was set to take effect on June 30, 2026. It would have required companies deploying high-risk AI (AI that makes, or is a substantial factor in making, a consequential decision about a person, unlike a low-risk tool such as a spam filter) in hiring, lending, housing, healthcare, and other areas to run a <\/span>review<\/span><\/a> of how an AI system affects the people subject to it, operate an AI-focused risk-management program, and satisfy a reasonable care duty to avoid discrimination. But on May 14, 2026, Governor Jared Polis signed <\/span>SB 26-189<\/span><\/a> (the AI Replacement Law), scrapping the CAIA before any of the burdensome requirements came due. Because the AI Replacement Law lets companies deploy AI first and only offers protection after someone has been harmed, it is an insufficient safeguard for the people affected by AI-driven decisions.\u00a0<\/span>\u00a0<\/span><\/p>\n

From CAIA to the AI Replacement Law<\/span><\/b>\u00a0<\/span><\/p>\n

The AI Replacement Law <\/span>shifts<\/span><\/a> focus from regulating how AI is built and implemented to regulating what is disclosed. Specifically, it <\/span>drops<\/span><\/a> the original bill\u2019s key operational mechanisms, such as the impact assessment and the risk-management program. <\/span>Taking their place<\/span><\/a> are requirements relating to pre-consumer notices, human review for adverse decisions, and developer documentation duties. Developers must also <\/span>retain compliance records<\/span><\/a> for at least three years from the date of recording and will have 60 days to cure any violations before facing enforcement.<\/span>\u00a0<\/span><\/p>\n

The rewrite did not happen in a vacuum. <\/span>Over the past two years<\/span><\/a>, company compliance departments built programs to comply with the incoming law. Then, in April 2026, the AI company xAI sued to block CAIA\u2019s enforcement, and the <\/span>federal government intervened<\/span><\/a> on xAI\u2019s side, the first time federal authorities had joined a challenge to a state AI law. Colorado\u2019s Attorney General agreed to suspend enforcement while the case played out, and the legislature rewrote the law instead.<\/span>\u00a0<\/span><\/p>\n

The cost to consumers<\/span><\/b>\u00a0<\/span><\/p>\n

While the CAIA would have required companies to <\/span>proactively prevent<\/span><\/a> discriminatory AI decisions before they happened, the AI Replacement Law doesn\u2019t require action from companies until after someone has been harmed. This means a person has to be <\/span>denied a job, a loan, or housing<\/span><\/a> by AI before they are entitled to an explanation and human review. There is no requirement for companies to test their <\/span>systems<\/span><\/a> for bias before deploying them.<\/span>\u00a0<\/span><\/p>\n

Furthermore, the limited protections do not apply to every affected individual. The law only protects you if AI <\/span>materially influenced<\/span><\/a> the adverse decision, a phrase that is not yet defined. Additionally, companies only have to offer human review <\/span>to the extent commercially reasonable<\/span><\/a>, a standard that is also not yet defined. While the determination of the standard will be left to the discretion of the state\u2019s <\/span>Attorney General<\/span><\/a>, regulators have proposed that serious, irreversible harm shall presumptively be reviewed. Regardless, even when the standard applies, there is <\/span>no private right of action<\/span><\/a>. Only the Attorney General can act on an individual\u2019s behalf, and only after the individual files a complaint.<\/span>\u00a0<\/span><\/p>\n

Protection after the fact<\/span><\/b>\u00a0<\/span><\/p>\n

The legislature\u2019s retreat from the CAIA to a more company-friendly AI Replacement Law should cause concern for not only those in Colorado, but all American citizens. For Coloradans, the concern is immediate. The CAIA would have made companies prove their AI was safe before making consequential decisions, while the AI Replacement Law lets companies use AI first and only requires review and correction after someone has been negatively impacted. With critical terms still undefined, a company could argue that AI was not substantially involved in a decision, leaving the person harmed without an explanation or a human review. And because only the Attorney General can enforce the law, an office that will likely be overwhelmed with complaints from across the state, even a valid claim may go unanswered.<\/span>\u00a0<\/span><\/p>\n

For those not in Colorado, the concern is what comes next. Colorado\u2019s rewrite came after a lawsuit and federal pressure, and with Congress unable to pass its own AI framework, other states facing the same pressure may follow suit and build an AI compliance program similar to Colorado\u2019s. This will result in companies having an easier compliance path and consumers left waiting for things to go wrong.<\/span>\u00a0<\/span><\/p>\n

Ultimately, a law that waits for harm to happen before offering protection, and leaves its most important terms undefined, is an insufficient safeguard against harmful AI-driven decisions. By shifting the burden from companies proving their AI is safe to consumers proving, after the fact, that it was not, the AI Replacement Law leaves the people affected to carry the burden of proving harm that the original law could have helped prevent.<\/span>\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

The Colorado AI Act (CAIA), formally known as the \u201cConsumer Protections for Artificial Intelligence\u201d Act, was set to take effect on June 30, 2026. It would have required companies deploying high-risk AI (AI that makes, or is a substantial factor in making, a consequential decision about a person, unlike a low-risk tool such as a spam filter) in hiring, lending, housing, healthcare, and other areas to run a review of how an AI system affects the people subject to it, operate an AI-focused risk-management program, and satisfy a reasonable care duty to avoid discrimination. But on May 14, 2026, Governor Jared Polis signed SB 26-189 (the AI Replacement Law), scrapping the CAIA before any of the burdensome requirements came due. Because the AI Replacement Law lets companies deploy AI first and only offers protection after someone has been harmed, it is an insufficient safeguard for the people affected by AI-driven decisions.\u00a0\u00a0<\/p>\n","protected":false},"author":183,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[2457],"class_list":["post-6994","post","type-post","status-publish","format-standard","hentry","category-artificial-intelligence","tag-consumer-protections"],"_links":{"self":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts\/6994","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/users\/183"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6994"}],"version-history":[{"count":1,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts\/6994\/revisions"}],"predecessor-version":[{"id":6995,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts\/6994\/revisions\/6995"}],"wp:attachment":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6994"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6994"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6994"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}