Colorado Rewrites Its AI Law. Congress Is About to Overwrite All of Them.
What happened
Colorado's legislature passed SB 26-189 on Tuesday, replacing the state's 2024 landmark AI accountability law with a significantly narrowed version. The original law required companies to disclose how AI systems made consequential decisions about hiring, housing, healthcare, and credit. The new version applies only to a narrower category of 'automated decision-making technology,' carves out large classes of business use, and delays enforcement until January 2027. Governor Jared Polis is expected to sign it. Meanwhile, House Republicans have advanced a federal AI preemption proposal that would nullify all state AI regulations, and the National Association of Attorneys General has begun coordinating resistance.
Colorado spent two years building the first real AI accountability framework in the US, then spent another two years dismantling it. The federal preemption bill waiting in Congress would make the whole exercise retroactively irrelevant.
The Hidden Bet
The watered-down Colorado law still provides meaningful protection against algorithmic harm
The original law's power was its breadth: any AI system making a consequential decision about a person had to be disclosed and auditable. The rewrite replaced 'consequential decision' with 'automated decision-making technology' and added exemptions that cover most of the practices consumer advocates were most worried about, including AI used in financial risk scoring and content moderation.
Federal preemption is a genuine effort to create a unified national AI framework
The House Republican preemption bill does not propose federal rules to replace state ones: it proposes to prohibit state rules without substituting federal ones. This is not regulatory rationalization. It is deregulation by jurisdictional shell game.
Tech industry opposition killed the strong version of the Colorado law
Elon Musk's lawsuit was the visible pressure. But Colorado business groups, insurance companies, and healthcare systems had been lobbying to narrow the law since 2024. Musk's intervention gave legislators political cover for a retreat they had already privately decided to make.
The Real Disagreement
The real fork is this: should AI accountability rules be set nationally, or should states be allowed to experiment and compete on standards? The case for federal preemption is genuine: a patchwork of 50 different AI compliance regimes would impose real costs on companies that operate nationally, and inconsistent standards would be worse than no standards. The case for state authority is equally genuine: federal AI regulation in the current Congress means no meaningful consumer protection for the foreseeable future, because the federal bill is explicitly designed to block state action without replacing it. I lean toward allowing states to regulate for now. The cost of premature federal preemption is locking in the absence of rules during the period when AI is doing the most consequential hiring, lending, and sentencing. That cost is higher than the cost of regulatory patchwork.
What No One Is Saying
The companies that lobbied hardest to weaken Colorado's law are the same companies deploying AI systems in hiring and credit decisions that disproportionately affect lower-income workers and minority applicants. The law did not ban those systems. It required disclosure. Killing disclosure requirements while citing regulatory burden is a tell: the burden they are protecting against is not compliance cost, it is accountability.
Who Pays
Job seekers and loan applicants screened by AI in Colorado and nationally
Ongoing; accelerates as AI screening expands into more hiring and lending decisions over the next 2-3 years
Without disclosure requirements, people denied jobs or credit because of an algorithmic decision have no right to know the decision was automated, no right to review the criteria, and no basis for challenge. The harm is invisible by design.
State attorneys general
Immediate if federal preemption passes; the NAAG is already treating this as an emergency
Federal preemption strips state AGs of the consumer protection tools they currently have for policing AI harms. Without state authority, the only enforcement mechanism is federal agencies whose leadership has signaled they will not aggressively pursue tech companies.
Scenarios
Preemption Passes, Vacuum Locked In
The House Republican bill becomes law, nullifying Colorado and the dozen other states that had enacted or were advancing AI consumer protection rules. No federal rules replace them. AI hiring and credit systems operate without disclosure requirements nationally for at least 3-5 years.
Signal Senate Majority Leader advances the preemption bill for floor vote before the midterm recess
Preemption Stalls, Colorado Becomes the Floor
Federal preemption fails or stalls in the Senate. Colorado's weakened law takes effect in January 2027 and becomes the de facto national standard as other states adopt similar frameworks. Companies standardize on Colorado compliance to avoid 50 different regimes.
Signal Senate AGs' coordinated opposition generates enough Republican defections to kill the preemption bill in committee
Polis Vetoes, Resets the Clock
Governor Polis decides the compromise law is weaker than no law at all and vetoes SB 26-189, forcing the legislature back to the original framework or nothing. Colorado becomes the test case for whether meaningful AI accountability can survive industry pressure.
Signal Polis delays signing past the session end date and requests further amendments
What Would Change This
If the federal preemption bill included a minimum floor of consumer protections that states could exceed but not fall below, that would be evidence of genuine regulatory rationalization rather than deregulation by preemption. No version of the bill currently does this.