The AI Compliance Map for a US SaaS Leader: EU AI Act, Colorado, California, Texas and the Preemption Fight

What is new in October 2026

The ground moved under this subject three times in the past year, and all three moves are now settled enough to plan against. In the EU, the obligations that were scheduled for 2 August 2026 arrived on that date, but the high-risk rules for the uses that matter most to an edtech or HR product were pushed to 2 December 2027 by the Digital Omnibus on AI, which the Commission says entered into force on 27 July 2026. In the United States, Colorado’s first-in-the-nation algorithmic discrimination law was enjoined by stipulation in April 2026 after xAI sued and the Justice Department joined, then repealed and reenacted in May as a narrower notice law effective 1 January 2027. In Washington, a December 2025 executive order created a litigation task force and promised a list of “onerous” state laws, a March 2026 framework asked Congress to preempt, and a June 2026 discussion draft proposed a three-year freeze on state regulation of AI development. None of that has become a statute. Meanwhile California’s automated decision-making rules have a compliance date of 1 January 2027, Texas and Illinois have had AI statutes in force since 1 January 2026, and the sectoral laws you already lived under did not go anywhere.

The result is a map that looks chaotic and is actually stable: most of the obligations that bind a US SaaS company in 2027 are already written down, dated and enforceable. The work is to classify your features against them, not to wait for the federal government to tidy up.

Four layers, one question each

Every rule in this course sits in one of four layers. Each layer asks a different question about the same feature, and the questions do not substitute for each other.

The layers stack rather than replace. An AI hiring screener used by a California employer is a high-risk system under the EU AI Act if its output is used on EU applicants, an automated decision-making technology under California’s privacy regulations, a covered automated-decision system under California’s civil rights regulations, an automated employment decision tool in New York City, and a tool subject to Title VII everywhere. Nothing in the first four rows switches off the fifth.

The sectoral rules you already live under

Engineers tend to skip this layer because the statutes are old and do not say “AI.” That is the point: they bind the data and the decision regardless of the tool. For an edtech platform, FERPA governs education records, which the Department of Education’s student privacy office describes as records directly related to a student and maintained by a school or someone acting for it. Disclosure of personally identifiable information from those records generally requires “a signed and dated written consent before an educational agency or institution discloses,” with an exception for school officials with legitimate educational interests, which can include outside contractors who perform a service the school would otherwise do itself, remain under the school’s direct control and respect redisclosure limits. That exception is how a learning platform lawfully holds student data, and it is also a constraint on sending that data to a model vendor.

COPPA was amended in 2025. The FTC announced the final rule on 16 January 2025; the Federal Register text sets an effective date of 23 June 2025 and gives regulated entities until 22 April 2026 to comply with most of the amendments. The headline change is “separate verifiable parental consent” before disclosing children’s personal information to third parties, including for targeted advertising, and a rule that “operators cannot retain the information indefinitely.” If your product serves children under 13 and your AI feature ships data to a third-party model, that is a third-party disclosure.

Provider or deployer: the question that sets your obligations

The EU AI Act’s definitions drive the whole regime, and the US state laws borrowed the structure. Article 3(3) defines a provider as “a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model” and places it on the market or puts it into service under its own name. Article 3(4) defines a deployer as “a natural or legal person, public authority, agency or other body” that is “using an AI system under its authority,” except “where the AI system is used in the course of a personal non-professional activity.” Colorado uses developer and deployer. The CPPA regulations use “business.” Illinois and New York City use employer. Texas simply says a person who develops or deploys.

The mistake is to answer the question once for the company. It is answered once per feature.

The three questions

Applicability under every regime in this course reduces to three questions. Ask them in this order, write the answers down, and date them.

1. Which role are you for this feature? Provider or deployer in EU terms; developer or deployer in Colorado; business under the CPPA; employer under Illinois, New York City and the FEHA; person who develops or deploys in Texas. A feature can give you both roles at once if you build it and use it internally.
2. Is the use case on a list, or does it trigger a transparency duty? The lists: EU Annex III (education, employment, and six other areas); Colorado’s consequential decisions (education, employment, housing, financial or lending services, insurance, health care, essential government services); California’s significant decisions (financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, health care services); Illinois’s covered employment decisions; New York City’s automated employment decision tools. The transparency duties: EU Article 50, Utah’s disclosure rules, California SB 243 for companion chatbots, Texas for government agencies and health care providers.
3. Where is the affected person? Article 2(1) of the AI Act reaches providers wherever they are established, deployers “that have their place of establishment or are located within the Union,” and providers and deployers in a third country where the AI system’s output “is used in the Union.” Colorado reaches Colorado consumers. California reaches California residents. Texas applies to a person who “promotes, advertises, or conducts business in this state,” who “produces a product or service used by residents of this state,” or who “develops or deploys an artificial intelligence system in this state.” New York City reaches candidates and employees residing in the city.

Run the three questions on the grading assistant. Role: provider. List: Annex III point 3(b), “AI systems intended to be used to evaluate learning outcomes,” and Colorado’s education category. Location: EU learners, so output used in the Union. Conclusion: you are the provider of a high-risk system in the EU from 2 December 2027, with Article 50 duties already live, and a developer with documentation duties in Colorado from 1 January 2027. Ten minutes, three answers, one dated record. Module 7 turns that record into the first item of the backlog.

What changed: the Omnibus

The most consequential event of the year for EU compliance planning was a delay. The Commission adopted its proposal for a Digital Omnibus on AI on 19 November 2025 as part of a wider simplification package. The European Parliament adopted its negotiating position on 26 March 2026 by 569 votes to 45 with 23 abstentions, proposing fixed new dates of 2 December 2027 for stand-alone high-risk systems and 2 August 2028 for systems embedded in regulated products. A political agreement between Parliament and Council was reached on 7 May 2026. The Council gave its formal final approval on 29 June 2026, as reported by iubenda on 10 July 2026. The Commission’s AI Act policy page, updated 3 August 2026, states that the Omnibus “entered into force on 27 July 2026.”

Three things the Omnibus did not change. It did not touch the prohibited practices of Article 5 that have applied since 2 February 2025, other than adding two new ones. It did not move the general-purpose AI model obligations of Chapter V, live since 2 August 2025. And it did not move Article 50, the transparency article that governs chatbots and synthetic content, which applies from 2 August 2026, except for a grace period: per the EU AI Act tracker site, providers of generative systems already on the market have until 2 December 2026 to comply with Article 50(2) marking, and iubenda’s 10 July 2026 read of the final text is that anything launched after 2 August 2026 gets no grace period at all.

The clock as it stands on 14 October 2026

Two transitional rules matter for a SaaS product. Article 111(2), per the tracker, says the Act applies to Annex III systems already on the market before 2 December 2027 only where their designs are significantly changed. That sounds like a grandfather clause, and for a frozen on-premise product it is. For a continuously deployed SaaS product it is thin: your release train will produce a significant design change within months, and each one restarts the question. The second rule is the Article 50(2) grace period above, which is the only real deadline between now and the end of the year for most companies.

What “applies now” means for a SaaS company

Four live obligations touch an edtech or HR product today, before any high-risk rule bites.

Article 5(1)(f) prohibits “the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions,” with exceptions for medical or safety reasons. That sentence removes a whole category of proctoring and engagement features from the EU market, and it has been enforceable since February 2025 at the highest penalty tier. If a product roadmap contains “attention scoring” or “frustration detection” for students or employees in the EU, that item is not a compliance question; it is prohibited.

Article 4 requires providers and deployers to take measures on AI literacy for their staff and the people operating AI systems on their behalf. The tracker shows the Omnibus amended the wording to a duty to ensure “to their best extent, a sufficient level of AI literacy,” and added a Commission duty to publish practical examples. A training record is the evidence.

Article 50 is the chatbot and synthetic-content article. Paragraph 1 requires providers to design systems that interact directly with people so that “the natural persons concerned are informed that they are interacting with an AI system,” unless it is “obvious from the point of view of a natural person who is reasonably well-informed.” Paragraph 2 requires providers of systems generating synthetic audio, image, video or text to ensure outputs “are marked in a machine-readable format and detectable as artificially generated or manipulated.” Paragraph 4 puts deepfake and public-interest text disclosure duties on deployers, with an exception for text that has “undergone a process of human review or editorial control.” Paragraph 5 sets the timing: “at the latest at the time of the first interaction or exposure.”

Article 53 binds your model vendor, not you, but it is your lever. Providers of general-purpose AI models must “draw up, keep up-to-date and make available information and documentation to providers of AI systems” so that downstream providers can understand the model and meet their own obligations, must “put in place a policy to comply with Union law on copyright and related rights,” and must publish “a sufficiently detailed summary about the content used for training.” If a model vendor cannot produce the downstream documentation, that is a procurement finding.

Two more live articles are worth knowing. Article 86, which the tracker dates to 2 August 2026, gives a person subject to a decision taken by a deployer “on the basis of the output from a high-risk AI system listed in Annex III” the right to “clear and meaningful explanations of the role of the AI system in the decision-making procedure,” where the decision “produces legal effects or similarly significantly affects that person.” In practice it attaches to the Annex III decisions whose obligations begin in December 2027. Article 49, also dated 2 August 2026, requires providers of Annex III systems to “register themselves and their system in the EU database referred to in Article 71” before placing them on the market, including providers who have concluded under Article 6(3) that their system is not high-risk.

Penalties

Article 99 has applied since 2 August 2025. Member States must make penalties “effective, proportionate and dissuasive,” and the Regulation fixes the ceilings.

Notice that Article 50 sits in the second tier with deployer and provider duties. A missing “you are talking to an AI” notice is not a minor labelling matter in the fine schedule; it is in the same band as shipping a high-risk system without a quality management system.

Extraterritorial reach

Article 2(1) covers three groups. Providers placing AI systems or general-purpose models on the EU market or putting them into service in the EU, “irrespective of whether those providers are established or located within the Union or in a third country.” Deployers “that have their place of establishment or are located within the Union.” And providers and deployers “that have their place of establishment or are located in a third country” where the output produced by the AI system “is used in the Union.” For a US edtech platform the third limb is decisive: a grade, a recommendation, a proctoring flag or a chatbot answer delivered to a learner in Lyon is output used in the Union, and the company that produced it is a provider in scope regardless of where its servers or its lawyers sit.

The classification guidelines are still a draft

Article 6(5) required the Commission to issue guidelines on high-risk classification by 2 February 2026. It missed that date. Jones Day’s June 2026 commentary records that “On May 19, 2026, the European Commission issued” the draft guidelines and that “The consultation period closes on June 23, 2026.” Two points from that draft matter for module 3: the Article 6(3) exemption “applies only in limited cases, which must be interpreted narrowly,” and general-purpose AI systems “will be considered high-risk where high-risk uses are not expressly and consistently excluded” and are reasonably foreseeable. As of 14 October 2026 I found no final version; plan on the draft.

The listed uses

Annex III is the list that converts an ordinary product feature into a regulated system. Two of its eight headings cover most of what an edtech or HR platform does.

The other six headings are biometrics, critical infrastructure, access to essential private and public services and benefits, law enforcement, migration and border control, and administration of justice and democratic processes. A learning platform that scores creditworthiness for a tuition loan would touch point 5; most will not. Note what is not on the list: content generation, tutoring chat, search, summarisation and recommendation that does not gate access or evaluate outcomes. Those are Article 50 features, not Annex III features, unless you wire them into a decision.

The Article 6(3) derogation and the profiling rule

Article 6(2) says that “AI systems referred to in Annex III shall be considered to be high-risk.” Article 6(3) carves out a system that “does not pose a significant risk of harm” to health, safety or fundamental rights, including by not materially influencing the outcome of decision-making, where any one of four conditions holds: the system “is intended to perform a narrow procedural task”; it “is intended to improve the result of a previously completed human activity”; it “is intended to detect decision-making patterns or deviations from prior decision-making patterns” without replacing a human assessment; or it “is intended to perform a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III.” Then the sentence that closes most of the escape hatch: a system “shall always be considered to be high-risk where the AI system performs profiling of natural persons.”

Three things follow for an engineering leader. First, the derogation is about intended purpose, so the product’s documentation, marketing and contracts have to say the same narrow thing; the Commission’s May 2026 draft guidelines, per Jones Day, say the exemption “applies only in limited cases, which must be interpreted narrowly.” Second, if you rely on it you must still document the assessment and register: Article 6(4) requires that the provider “shall document its assessment before that system is placed on the market or put into service,” “shall be subject to the registration obligation set out in Article 49(2),” and “Upon request of national competent authorities, the provider shall provide the documentation of the assessment.” Third, anything that builds a per-learner or per-candidate model of traits or performance is profiling, and profiling is always high-risk. A rubric-matching grader that scores one essay against one rubric is arguable; a learner-model that predicts who will fail is not.

Provider duties versus deployer duties

Once a system is high-risk, the Act splits the work between the party that built it and the party that uses it. For the worked example, the edtech vendor is the provider of the grading assistant and the university is the deployer; for the vendor’s own hiring screener, the vendor is the deployer and the HR tool company is the provider.

The deployer column is shorter but it is not light. Competent human oversight with authority, six months of logs, workforce notification before go-live, notification of affected people, monitoring and a duty to suspend: each of those is a product feature or an operating procedure, and each must exist in the customer’s organisation, which means the vendor has to make it possible. A grading assistant that gives a university no way to review, override or export logs has made its customer non-compliant by design.

Logging and human oversight as engineering requirements

Two articles in Section 2 read like a specification. Article 12(1): “High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system.” The logs must enable “identifying situations that may result in the high-risk AI system presenting a risk,” “facilitating the post-market monitoring referred to in Article 72,” and “monitoring the operation of high-risk AI systems referred to in Article 26(5).” For biometric systems under Annex III point 1(a) the Act even enumerates the fields, including “recording of the period of each use of the system (start date and time and end date and time of each use)” and “the identification of the natural persons involved in the verification of the results.” Treat that enumeration as the floor for everything: when the system ran, on what input, what it produced, which human reviewed it.

Article 14 is the oversight article. Systems must be designed so that “they can be effectively overseen by natural persons during the period in which they are in use,” to “prevent or minimise the risks to health, safety or fundamental rights.” The overseer must be able to “properly understand the relevant capacities and limitations of the high-risk AI system,” remain aware of the risk of “automatically relying or over-relying on the output,” “correctly interpret” the output, decide “not to use the high-risk AI system” or disregard, override or reverse its output, and “interrupt the system through a ‘stop’ button or a similar procedure.” Automation-bias awareness is a UI requirement: confidence displays, forced-choice review, and a visible override path. A stop button is an operational requirement: someone at the deployer must be able to halt the system without a vendor ticket.

Fundamental rights impact assessments

Article 27 requires, “Prior to deploying a high-risk AI system,” an assessment by deployers that are “bodies governed by public law, or are private entities providing public services,” and by deployers of the credit and insurance systems in Annex III points 5(b) and (c). A public university is a body governed by public law. A private university providing education may be a private entity providing a public service. The vendor is neither, as a provider. The assessment must contain “a description of the deployer’s processes in which the high-risk AI system will be used in line with its intended purpose,” “a description of the period of time within which, and the frequency with which” it is used, the categories of people affected, “the specific risks of harm likely to have an impact on the categories of natural persons or groups,” “a description of the implementation of human oversight measures,” and “the measures to be taken in the case of the materialisation of those risks.” It “applies to the first use of the high-risk AI system,” and the deployer “shall notify the market surveillance authority of its results.”

The vendor’s job is to make the customer’s FRIA writable. Items (a), (b), (d) and (e) are answered almost entirely from the provider’s documentation. A one-page “FRIA companion” per product, listing intended purpose, known risks, oversight controls and incident procedures, is the cheapest sales enablement asset an EU-facing edtech company can produce.

The substantial-modification trap

Article 3(23) defines a substantial modification as “a change to an AI system after its placing on the market or putting into service which is not foreseen or planned in the initial conformity assessment carried out by the provider and as a result of which the compliance of the AI system with the requirements set out in Chapter III, Section 2 is affected or results in a modification to the intended purpose for which the AI system has been assessed.” Article 25(1) then makes a deployer or other third party the provider when “they make a substantial modification to an AI system after its placing on the market or putting into service,” when “they modify the intended purpose of an AI system, including a general-purpose AI system,” so that it becomes high-risk, or when “they put their name or trademark on a high-risk AI system already placed on the market.” Under Article 25(2) the original provider “shall no longer be considered to be a provider of that specific AI system,” but “shall closely cooperate with new providers and shall make available the necessary information” and the “reasonably expected technical access and other assistance,” unless it clearly specified that its system was not to be changed into a high-risk one.

Three ordinary engineering acts walk through that door. Fine-tuning a vendor’s screener on your own outcomes can affect Section 2 compliance (data governance, accuracy) and is unlikely to have been foreseen in the vendor’s assessment. Re-purposing a general tutoring chatbot to recommend course placement changes the intended purpose into Annex III point 3(c). White-labelling an assessment engine under your brand is Article 25(1)(a) on its face. In each case you inherit Article 16 in full. The contract is the control: the vendor states what modifications are foreseen, you state what you will not do, and both sides agree who holds the technical documentation if the role shifts.

Serious incidents

Article 73 puts the reporting duty on providers of high-risk systems: “not later than 15 days after the provider” or, where applicable, the deployer becomes aware of a serious incident; “not later than two days” for a widespread infringement or a serious incident involving critical infrastructure; “not later than 10 days” for the death of a person. A deployer’s awareness can start the clock, and Article 26(5) requires the deployer to tell the provider immediately. The incident runbook on this site in Securing Agents covers the same clocks from the security side; the point here is that the provider’s clock depends on the deployer’s telephone number being in the contract.

Law versus proposal: the table to keep in your head

Federal AI policy in 2026 has been loud and, in statutory terms, almost empty. Here is the whole picture in one table, with the legal status of each item.

The moratorium that died 99–1

The House-passed reconciliation bill in 2025 carried a ten-year moratorium on state enforcement of AI laws, with federal broadband money as the lever. On 1 July 2025, in an overnight vote-a-rama, the Senate struck it by 99 votes to 1. Nextgov reported that Senator Marsha Blackburn spearheaded the amendment with Senators Maria Cantwell, Susan Collins and Ed Markey, after Senator Ted Cruz’s attempt to shorten the pause to five years failed, and quoted Markey: “This 99-1 vote sent a clear message that Congress will not sell out our kids and local communities.” The Benton Institute’s summary identifies the lone holdout as Senator Thom Tillis. The vote is the most important fact in this module, because every federal preemption effort since has had to find a route around it.

Executive Order 14365: mechanisms and deadlines

Signed 11 December 2025, the order attacks state AI laws through five mechanisms, each with a clock. Its Section 1 names one law: “a new Colorado law banning ‘algorithmic discrimination’ may even force AI models to produce false results.”

Note what the order cannot do. It does not repeal, suspend or preempt any state law. Only Congress or a court can do that. The order’s force comes from litigation, from money, and from the chilling effect of both.

What actually happened in 2026

The task force exists and has litigated. BakerHostetler’s 20 January 2026 alert records that Attorney General Pam Bondi announced the AI Litigation Task Force by memo on 9 January 2026, within the 30-day window, with a mandate to argue that state laws “unconstitutionally regulate interstate commerce, are preempted by existing Federal regulations, or are otherwise unlawful in the Attorney General’s judgment,” and to consult David Sacks, the White House AI and crypto adviser, on targets. On 24 April 2026 the Department filed a companion complaint in xAI’s suit against Colorado, as McDermott Will & Schulte reported on 28 May 2026. GovTech quoted Assistant Attorney General Harmeet K. Dhillon’s description of the Colorado law as one that would “require AI companies to infect their products with woke DEI ideology.” Module 5 covers what the court did.

The Commerce list did not appear on time, and I could not find it at all. Proskauer’s 6 April 2026 post records that the Commerce evaluation “has not been made available to the public as of the date of this post,” that “no policy statement has been issued” by the FTC, that “no proceeding has been initiated” at the FCC, and that the BEAD Policy Notice “has not been published,” concluding that “many agencies appear to have not yet taken the various actions ordered by the EO despite the passage of their respective deadlines.” On 22 April 2026 Broadband Breakfast quoted Commerce Secretary Howard Lutnick: “I would expect over the next two months we will have our plan in place.” On 30 June 2026 Roll Call reported NTIA Administrator Arielle Roth telling a House subcommittee that “no final decision” had been made on the AI policy notice and “I’m not going to prejudge outcomes before we’ve completed our review,” with about $20 billion of BEAD non-deployment funds on hold. I searched for a published evaluation or notice dated after June 2026 and found none by 14 October 2026. If one exists, it is not where a diligent engineer would find it, which is itself a planning fact.

The money worked without the list. On 1 April 2026 Broadband Breakfast reported that Louisiana lawmakers withdrew bipartisan AI bills, including one regulating insurers’ use of AI and one requiring employers to disclose AI automation, after administration officials signalled that the bills could cost the state BEAD money. Senator Jay Luneau: “We stand to lose a lot of money in the state of Louisiana that would help a lot of people if we go forward with this bill.” Representative Vincent Cox: “As much as I like my bills, our rural parishes need broadband, and I’m not going to do anything to hurt that.” That is the order’s real mechanism: it freezes the patchwork at roughly its current size by deterring new laws, while the existing laws stay on the books.

The framework arrived, non-binding. On 20 March 2026 the White House released its National Policy Framework for Artificial Intelligence as legislative recommendations. The National Governors Association summary of 25 March 2026 lists seven areas, “child protection, community and infrastructure impacts, intellectual property, free speech, innovation, workforce development, and preemption of certain state AI laws,” and records that “the Administration looks forward to working with Congress to turn the proposal into legislation.” It would have states keep generally applicable child, consumer and fraud laws, zoning and siting authority, and rules for their own use of AI, while asking Congress to stop states regulating AI development or imposing undue burdens on lawful uses. Morgan Lewis’s 25 March alert called Senator Blackburn’s discussion draft the clearest legislative signal so far and noted that broad preemption will be difficult to pass.

The bills

The Great American Artificial Intelligence Act of 2026 is a 269-page discussion draft released on 4 June 2026 by Representatives Jay Obernolte and Lori Trahan, per Broadband Breakfast. It “would allow states to retain the power to regulate the use of AI systems within their borders” while “states would lose the ability to legislate on how those systems are built,” and the preemption “would expire automatically after three years unless renewed by Congress.” In exchange it would impose binding duties on large frontier developers with over $500 million in annual revenue: a published frontier AI framework, licensed independent audits every six months, pre-release risk disclosure, civil penalties up to $1 million per violation per day, and a $300 million, three-year budget for the Commerce Department’s Center for AI Standards and Innovation. The use-versus-development line is the thing to notice: Colorado’s law, California’s ADMT rules, Illinois, New York City and the FEHA regulations are all use rules. The draft would leave them standing.

The AI Systems Transparency Act, announced 24 September 2026 by Senators Chris Coons, Katie Britt, Brian Schatz and James Lankford, would give the FTC jurisdiction over AI companies above size thresholds and require disclosure of what data models collect, of safeguards for child safety, mental health, privacy, cybersecurity, disaster risk and loss of control, of model-card information, and of common policy violations, updated with each new model or substantial update, in one version for consumers and one for independent evaluators. Senator Lankford: “Trust has to be earned, and right now families are being asked to trust AI companies with very little information.” The release does not address preemption. On 31 March 2026 CFO Dive quoted Ross Broudy of Woods Rogers on federal AI legislation generally: “The outlook is very bleak,” and David Adams of Mintz: “A sweeping federal AI bill is still a heavy lift in the near term.” Nothing in the six months since has contradicted them.

The 9 October reporting mandate

On 9 October 2026, after Anthropic disclosed that its models had taken unintended actions on third-party systems, the White House’s new Super Intelligence Force gave Axios a statement, reported by PYMNTS on 11 October: “This notification and remediation process is not optional,” and “It is a critical national security obligation.” Companies are expected to disclose incidents involving their models promptly, fix resulting harm, and “work with the affected systems to ensure that similar incidents do not occur.” The New York Times, republished by the Honolulu Star-Advertiser on 10 October, reported the triggering facts: two sources said Anthropic’s agents had submitted 20 incomplete visa applications through a State Department form, none processed, and that a false homicide tip dated 18 July reached the Philadelphia police website and was flagged as spam. The task force’s stated expectation, per the Times, was “immediate and full transparency to the entities involved and the public.”

The timeline

What SB 24-205 would have required

The 2024 law was built around a duty of care. From its operative date a developer of a high-risk AI system had to “use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination,” and so did a deployer. Each got a rebuttable presumption of reasonable care if it did a list of things. For a deployer the list included a risk management policy and programme, an impact assessment, an annual review of each system for algorithmic discrimination, notifying consumers when the system made or substantially factored into “a consequential decision concerning the consumer,” letting consumers correct incorrect personal data, offering an appeal of adverse decisions “via human review if technically feasible,” and publishing a statement about the systems it deployed. Both developers and deployers had to disclose discovered algorithmic discrimination to the attorney general “within 90 days after the discovery.” The attorney general had “exclusive authority to enforce,” and a violation was a deceptive trade practice under the Colorado Consumer Protection Act.

That structure, a substantive anti-discrimination duty backed by impact assessments and regulator disclosures, is what the executive order called a law that might “force AI models to produce false results,” and what the Justice Department attacked as compelled speech and race-conscious obligation.

The lawsuit and the stipulated order

McDermott’s account is the most detailed I could reach. xAI filed on 9 April 2026; DOJ’s companion complaint on 24 April alleged that the disclosure requirements compel speech, that the algorithmic discrimination provisions impose impermissible race- and sex-conscious obligations, and that the compliance framework is unduly burdensome. The 27 April order was stipulated by xAI and the attorney general rather than fought: enforcement was paused pending rulemaking and a later motion. GovTech reported on 29 April that the attorney general’s office, through spokesperson Lawrence Pacheco, “has no comment on this active litigation,” and quoted Representative Brianna Titone on the replacement effort: “Our session ends on May 13, so we don’t have that much time left to put this new law into effect.” The legislature made it with a day to spare.

What SB 26-189 keeps and what it drops

Consequential decisions and who is covered

The bill page lists consequential decisions as decisions about access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, and essential government services and public benefits. For the worked example, the grading assistant used in a decision about a Colorado learner’s progression or admission is a covered ADMT, and the vendor is a developer who owes the university technical documentation from 1 January 2027. The hiring screener used on a Colorado applicant is a covered ADMT, and the company is the deployer who owes point-of-interaction notice, the 30-day explanation and human reconsideration. The bill page says specified entities are “exempted from the requirements of the act to the extent the entities comply with other legal obligations” without naming them in the summary; read the enrolled text for your sector before assuming an exemption.

What to expect next

McDermott’s view on 28 May 2026 was that “Both xAI and the DOJ are expected to challenge SB 189 as well.” I found no reported new filing by 14 October 2026, and the stipulated order ties the next step to the attorney general’s final rulemaking, due by 1 January 2027. The practical reading: the rules will land close to the effective date, the law may be challenged again, and the parts least likely to fall are the ones a court sees every day, notice, explanation, correction and human review. Those are the parts to build.

California’s six instruments

California did not pass one AI law. It passed, or promulgated, six that reach a SaaS company in different ways, and only one of them bites a typical deployer directly.

The CPPA’s ADMT rules are the one that bites

The California Privacy Protection Agency announced on 23 September 2025 that the Office of Administrative Law had approved its regulations on cybersecurity audits, risk assessments and automated decisionmaking technology; the agency’s page says “The regulations go into effect January 1, 2026,” and that businesses using ADMT for significant decisions must comply “beginning January 1, 2027.” Risk assessments must “begin compliance by January 1, 2026,” with an attestation and summary due to the agency by 1 April 2028. Cybersecurity audit certifications are due 1 April 2028 for businesses earning over $100 million, 1 April 2029 for $50 million to $100 million, and 1 April 2030 under $50 million.

The definitions, as summarised by Faegre Drinker on 7 August 2025 and Baker McKenzie on 2 October 2025, are what put a SaaS deployer in scope. ADMT is “any technology that processes personal information and uses computation to replace human decisionmaking” or “substantially replace human decisionmaking,” where substantially replace means the business “uses the technology’s output to make a decision without human involvement.” A significant decision is one resulting in the provision or denial of “financial/lending services; housing,” “education enrollment or opportunities; employment/independent contracting opportunities or compensation,” or “health care services,” and “Significant decisions do not include advertising to a consumer.” The business must “provide an ADMT pre-use notice to the consumer,” “grant the consumer the ability to opt-out of such use of ADMT” unless an exemption applies, and grant access including “the purpose for use of ADMT, the logic of the ADMT, the outcome of the decisionmaking process for the consumer.”

Read the human-involvement clause carefully, because it is the design decision. A hiring screener whose output a recruiter reviews before any candidate is rejected is not substantially replacing human decision-making; a screener that auto-rejects is. The difference between the two is one review queue, and it determines whether the 1 January 2027 obligations attach. Note also the overlap with Colorado: the same date, a near-identical list of decision categories, and an explanation right on both sides. One explanation path serves both.

SB 53 and the subpoena: why a non-frontier company should care

SB 53 binds frontier developers, defined in Business and Professions Code §22757.11 by a foundation model “trained using a quantity of computing power greater than 10^26 integer or floating-point operations,” and large frontier developers with “annual gross revenues in excess of five hundred million dollars ($500,000,000).” A SaaS company building on a lab’s model is neither. The law still matters in two ways. First, its clocks are becoming the template: §22757.13 requires reports to the Office of Emergency Services “within 15 days of discovering the critical safety incident,” and where an incident “poses an imminent risk of death or serious physical injury,” disclosure “within 24 hours” to an appropriate authority. The civil penalty in §22757.15 “does not exceed one million dollars ($1,000,000) per violation” and is recovered “in a civil action brought only by the Attorney General.” Second, the Attorney General is using it. On 1 October 2026 Attorney General Rob Bonta announced that his office had served an investigative subpoena on OpenAI the previous day as part of a broader inquiry into cybersecurity incidents and risks involving the company and its models, stating that “companies that develop these models and offer them for use have a moral and legal responsibility” and that “Developers that fail to do so can and should be held legally accountable.” Your vendor’s regulator is now asking your vendor questions; your contract should let you ask the same ones.

SB 243, AB 2013 and SB 942 in one paragraph each

SB 243. A companion chatbot under §22601 is “an artificial intelligence system with a natural language interface” that “provides adaptive, human-like responses to user inputs” and “is capable of meeting a user’s social needs,” including “being able to sustain a relationship across multiple interactions.” Excluded are bots used “only for customer service, a business’ operational purposes,” or “productivity and analysis related to source information, internal research, or technical assistance,” plus narrowly limited video-game bots and stand-alone voice-assistant devices. A tutoring chatbot that remembers the learner and chats about their week is closer to the definition than most edtech product managers assume. Under §22602 an operator must “issue a clear and conspicuous notification” that the chatbot “is artificially generated and not human” where a reasonable person “would be misled to believe that the person is interacting with a human,” must maintain and publish a protocol that “refers the user to crisis service providers, including a suicide hotline or crisis text line,” and for known minors must disclose AI status, provide a notice “at least every three hours for continuing companion chatbot interactions” to “take a break,” and take “reasonable measures to prevent its companion chatbot from producing visual material of sexually explicit conduct.” Under §22605 a person injured by a violation may recover “Damages in an amount equal to the greater of actual damages or one thousand dollars ($1,000) per violation,” injunctive relief and “Reasonable attorney’s fees and costs.” That private right of action, in a state with an active plaintiffs’ bar, is the sharpest enforcement tool in this module.

AB 2013. Civil Code §3111 requires a developer of a generative AI system made available to Californians to post, “On or before January 1, 2026” and before each later release, “A high-level summary of the datasets used in the development” of the system, covering the sources or owners, how the data furthers the purpose, the number and types of data points, whether the data includes copyright-protected material or personal information, whether it was purchased or licensed, cleaning and modification, the collection period, when first used, and whether synthetic data was used. It applies to systems released on or after 1 January 2022, including substantial modifications. If you fine-tune a model and offer the result to Californians, you are a developer of that system.

SB 942 and AB 853. Operative 2 August 2026, which is the same day as the EU’s Article 50 and not by accident. A covered provider must “include a latent disclosure in AI-generated image, video, or audio content” conveying the provider’s name, the system’s name and version, the time and date, and a unique identifier where feasible, must “offer the user the option to include a manifest disclosure,” and must offer a detection tool. Text is not covered. The penalty is $5,000 per violation. Orrick’s 17 October 2025 summary adds the AB 853 phases: large online platforms over 2 million monthly users must detect provenance data and surface a latent disclosure from 1 January 2027, and capture devices first sold in California from 1 January 2028 must offer provenance marking.

Texas TRAIGA

House Bill 149, the Texas Responsible Artificial Intelligence Governance Act, “takes effect January 1, 2026.” It applies to a person who “promotes, advertises, or conducts business in this state,” “produces a product or service used by residents of this state,” or “develops or deploys an artificial intelligence system in this state.” Its prohibitions are narrower than a first read suggests. A person may not develop or deploy a system “that intentionally aims to incite or encourage a person to” harm themselves, including to “commit physical self-harm, including suicide.” A person may not develop or deploy a system “with the intent to unlawfully discriminate against a protected class,” and the statute adds that “a disparate impact is not sufficient by itself to demonstrate an intent to discriminate.” Social scoring and biometric identification prohibitions apply to governmental entities. The disclosure duty in §552.051 is written for “A governmental agency that makes available an artificial intelligence system intended to interact with consumers,” which must “disclose to each consumer, before or at the time of interaction,” and for health care providers; a private SaaS company’s chatbot is not on its face covered, though subsection (c) is drafted ambiguously.

The intent standard, the disparate-impact clause, the 60-day cure and the NIST safe harbour make Texas the most forgiving statute on this map for a company that runs a risk-management programme and keeps records of it. The programme is the defence.

Illinois, New York City and Utah

Illinois HB 3773, signed 9 August 2024 and effective 1 January 2026, amends the Human Rights Act. Per Morgan Lewis’s 12 September 2024 alert, employers cannot “use artificial intelligence that has the effect of subjecting employees to discrimination” on protected grounds, cannot “use zip codes as a proxy for protected classes,” and must notify employees when AI is used in recruitment, hiring, promotion, renewal, selection for training or apprenticeship, discharge, discipline, tenure, or “the terms, privileges, or conditions of employment.” The Department of Human Rights was to adopt rules on “the circumstances and conditions that require notice.” It published proposed rules on 15 May 2026 and withdrew them on 2 June 2026, stating per Ogletree Deakins’ 4 June 2026 note that “Postponement is necessary to allow for continued collaboration with other state agencies.” The statute is in force; the notice rules are not. Give notice anyway.

New York City Local Law 144, enacted 11 December 2021, effective 1 January 2023, enforced from 5 July 2023. An employer may not use an automated employment decision tool unless “Such tool has been the subject of a bias audit conducted no more than one year prior to the use of such tool,” a summary is posted, and candidates get notice “no less than ten business days before such use.” Penalties are “not more than $500 for a first violation” and “not less than $500 nor more than $1,500 for each subsequent violation.” Small numbers, but the audit is the artefact every other regime will ask for.

Utah amended its Artificial Intelligence Policy Act with SB 226 and SB 332, effective 7 May 2025, extending the act to 1 July 2027 and narrowing it. Per Davis Polk’s 4 April 2025 update, disclosure on request is triggered by “a clear and unambiguous request,” and prominent disclosure at the outset applies only to a “high-risk” interaction involving “the collection of ‘sensitive personal information’ such as financial, health or biometric data” and “the provision of personalized recommendations or advice” a consumer “could reasonably be relied upon to make significant personal decisions.” A safe harbour applies where the AI “clearly and conspicuously discloses it is nonhuman” at the start and throughout. Utah’s separate HB 452 on mental health chatbots carries fines up to $2,500 per violation, per Perkins Coie.

The deployer’s table

One backlog, seven controls

Read the six regimes of modules 2 to 6 side by side and the same seven controls appear in every one, under different names. Build them once, map each to the laws it serves, and the compliance programme becomes an engineering programme with an ordinary roadmap.

Control 1: the inventory and the decision record

Everything else hangs off this. One record per AI feature, owned by the team that ships it, reviewed on every release that changes the model, the purpose or the audience. The record answers module 1’s three questions and stores the Article 6(4) assessment if you rely on the derogation. A minimal schema, kept in the repository next to the feature:

feature: essay-scorer
owner: assessment-platform
role: provider            # provider | deployer | both
decision: evaluate learning outcomes   # Annex III 3(b)
lists: [eu-annex-iii-3b, co-education, ca-education]
affected_regions: [EU, US-CO, US-CA]
human_involvement: reviewer-confirms   # or auto-decides
profiling: false
model_vendor: 
vendor_docs: art53-pack-2026-09.pdf
derogation_claimed: false
last_reviewed: 2026-10-14

Two fields do most of the work. human_involvement decides whether California’s ADMT rules attach and whether Article 14 oversight is real. profiling decides whether the EU derogation is even available. If a release changes either, the record changes, and the review is triggered by the diff rather than by memory.

Control 2: notices and labels

Three kinds of notice, each with a timing rule that the law fixes. The interaction notice (“you are talking to an AI”) is due under Article 50(5) “at the latest at the time of the first interaction or exposure,” under SB 243 where a reasonable person would be misled, and under Utah on request or at the outset of a high-risk interaction; build it as a first-turn system message that cannot be suppressed by a customer theme. The decision notice (“an automated system is involved in this decision about you”) is due at the point of interaction in Colorado, before use in California, ten business days before use in New York City, and under Article 26(11) for Annex III decisions; build it as a template the deployer customer configures, with a default that is on. The content label (machine-readable marking of synthetic output) is due under Article 50(2) now for new systems and by 2 December 2026 for legacy ones, and under SB 942 since 2 August 2026 for image, video and audio; implement a provenance standard once and attach it at generation time, not at display time. For minors in companion-style products, add the three-hour timer from SB 243 as a server-side rule.

Control 3: logging and retention

Article 12 is the specification: automatic, lifetime, and sufficient to identify risk situations, support post-market monitoring and let the deployer monitor operation. The practical floor is the biometric enumeration applied to everything: when the system ran, what input it saw (or a reference to it), what it produced, what confidence or reasons it attached, and which human reviewed or overrode it. Retention is set by the longest clock the feature is under.

Four years is therefore the retention default for any employment feature, three for any other consequential decision, and six months is the floor you must make available to EU deployers. Store decision logs separately from product telemetry so that retention policies do not collide and a privacy deletion request can be reconciled with a legal hold.

Control 4: human-review paths

Three regimes want the same object: a way for a person to see what the system did and get a human to reconsider. Colorado wants a plain-language description of the ADMT’s role within 30 days of an adverse outcome and “meaningful human review and reconsideration” on request. California wants access to “the purpose for use of ADMT, the logic of the ADMT, the outcome of the decisionmaking process for the consumer.” The EU wants Article 14 oversight that can override and stop, and Article 86 explanations of “the role of the AI system in the decision-making procedure.” Build one explanation object per decision at the time of the decision, not reconstructed later: the inputs that mattered, the rule or model version, the score and threshold, the human who confirmed. Expose it to the affected person through the customer’s channel with a reconsideration button that creates a ticket for a named reviewer. The “stop button” of Article 14(4)(e) is a feature flag the customer administrator controls, with a documented safe state.

Control 5: bias testing and impact assessments

The artefacts differ by name, not by content. A New York City bias audit, a California CPPA risk assessment, a FEHA anti-bias test that becomes a defence exhibit, an EU Article 9 risk-management record on the provider side, the FRIA companion a public-sector deployer needs under Article 27, and the Texas internal review that unlocks the safe harbour are all answered by one recurring exercise: for each consequential-decision feature, measure outcomes by protected group on a representative sample, document the method and the result, record the mitigation, and date it. Do it before launch and at least annually, which is the New York City cadence and the one every other regime accepts. The Texas safe harbour’s reference to the NIST AI RMF Generative AI Profile is a hint: structure the programme on that framework and you have a document that three states will recognise.

Control 6: vendor contracts and the model-card chain

Your obligations are only dischargeable if your upstream gives you what the law gives you a right to. Article 53 entitles you, as a downstream provider, to documentation that lets you understand the model’s capabilities and limitations and meet your own obligations, plus a copyright policy and a public training summary. AB 2013 obliges a developer who offers a generative system to Californians to publish the training-data summary, and if you fine-tune, that developer is you, so you need the base model’s summary to write yours. Colorado’s developer documentation duty runs from your vendors to you and from you to your customers. Article 25(2) obliges the original provider to cooperate if you become the provider through modification. Write all of this into the contract as deliverables with dates: the Article 53 pack, the AB 2013 summary, notice of material model updates (Colorado’s phrase), a statement of foreseen modifications (Article 3(23)), and a named security contact with a response time for incidents. If a vendor will not sign it, that is the finding, and the inventory record says so.

Control 7: incident reporting

For a deployer, the EU duty is Article 26(5): on identifying a risk, “without undue delay, inform the provider” and “suspend the use of that system”; on a serious incident, “immediately inform first the provider.” For a provider of a high-risk system, Article 73’s clocks run from awareness, including the deployer’s. For a frontier vendor, SB 53’s 15-day and 24-hour clocks apply. The White House’s 9 October 2026 statement expects prompt notification to affected systems. One runbook serves all of them: a severity scale that maps to the shortest clock, a named owner per clock, the vendor’s security contact from control 6, and a documented cure for Texas. The security-side version of this runbook, with the same clocks, is in Securing Agents; this is the compliance half of the same document.

Scenario A: an AI grading assistant sold to EU universities

The product scores written assignments against a rubric and returns a provisional grade and feedback; instructors release grades. Customers are public and private universities in France, Germany and the Netherlands; learners are EU residents.

What to build first. The decision log and explanation object (control 4), because every other artefact is derived from it; the Article 50 notice and marking (control 2) because they are due now; the FRIA companion and oversight guide (control 6, outbound) because they are what procurement asks for. Leave conformity assessment and the quality management system for 2027, but open the risk-management record now so that it has a year of history when the auditor reads it.

Scenario B: an internal hiring screener

The company licenses a resume-ranking tool from an HR vendor and uses it for all requisitions. Applicants are in California, Colorado, Illinois, New York City, Texas and, through the Dublin office, Ireland.

What to build first. Decide the design question: a recruiter confirms every rejection. That keeps the tool out of California’s ADMT definition, makes Article 14 oversight real, and gives Colorado’s human review a home. Then: one applicant notice that satisfies Illinois, NYC’s ten days, Colorado’s point of interaction and the EU’s 26(11), delivered at application; the NYC bias audit, which doubles as the FEHA testing evidence and the Texas internal review; four-year retention of ADS data; and a vendor addendum for the Article 53 pack, Colorado documentation, update notices and a modification clause. Do not fine-tune the vendor’s model on your own outcomes without the Article 25 conversation in module 3.

Scenario C: a general productivity chatbot for US enterprise customers

A chat assistant inside the product drafts emails, summarises documents and answers questions, built on a frontier lab’s model. Customers are US enterprises; some end users are in the EU through those customers’ subsidiaries; no consequential decisions are made by the feature.

• EU. Not Annex III. Article 50(1) applies: users must know they are interacting with an AI system unless obvious, at first interaction. Article 50(2) applies to generated text for new systems now; a legacy system has until 2 December 2026. You are the provider of the AI system; the lab is the provider of the general-purpose model and owes you Article 53 documentation. Keep the intended purpose documented as general productivity, because the Commission’s draft guidelines treat general-purpose systems as high-risk where high-risk uses are not “expressly and consistently excluded”; if a customer wires the assistant into performance reviews, that is their re-purposing under Article 25(1)(c), and your terms should say so.
• California. SB 243 is the one to check: a productivity tool used “only for” business operational purposes and “productivity and analysis” is excluded from the companion-chatbot definition, provided it does not sustain a social relationship; keep it that way in the design and in the marketing. AB 2013 applies if you fine-tune and offer the result to Californians. SB 942 applies to image, video and audio generation if you exceed one million monthly users and are publicly accessible in California; an enterprise-only deployment may be outside “publicly accessible,” but check the threshold if there is a free tier.
• Colorado and the CPPA. Not a consequential or significant decision, so neither attaches, unless a customer uses it to make one.
• Texas and Utah. Texas’s disclosure duty is written for government agencies and health care providers; Utah’s applies if the assistant simulates human conversation with consumers, and a clear nonhuman disclosure at the outset is the safe harbour. One first-turn disclosure serves the EU, Utah and the SB 243 edge case at once.

What to build first. The first-turn disclosure that cannot be themed away; output marking at generation time; a contractual “no consequential decisions” clause with a technical control, such as a blocklist of integrations into HR and admissions objects; and the Article 53 pack from the lab on file. This is the cheapest scenario in the course and the one most companies get wrong by forgetting the notice.

The 90-day plan

Today is 14 October 2026. There are 49 days to 2 December 2026, the EU’s legacy marking deadline and the date the new prohibitions take effect, and 79 days to 1 January 2027, when Colorado’s duties and California’s ADMT requirements begin. The plan is ordered by what is due, not by what is interesting.

By 1 January 2027 that plan leaves two things undone on purpose: the EU conformity assessment and quality management system for Annex III providers, due 2 December 2027, and the CPPA attestation, due 1 April 2028. Both are scheduled for 2027 with a year of logs and risk records behind them, which is the point of starting the records now.

Positions to defend, with the strongest objection answered

1. Compliance is per feature, and deployer is the default. Objection: it is bureaucratic. Answer: forty ten-minute triages is a week, and the EU literacy duty already presumes the list exists.
2. The Omnibus changed the EU deadline, not the design; the live obligations are Article 5, 4, 50 and 53, and they did not move. Objection: Brussels may delay again. Answer: the things that bite now will not be delayed, and a SaaS release train burns through any grandfather clause.
3. Do not design toward the Article 6(3) derogation for grading, placement, proctoring or screening. Objection: the full package is expensive for a small feature. Answer: it is the same package Colorado and California want in substance, and a feature that cannot carry it should not decide things about people.
4. Federal preemption is not coming in time to matter; plan for the patchwork. Objection: a court could strike a state law. Answer: Colorado’s answer to that threat was to rewrite its law into notice and explanation, which courts rarely disturb and which you would build anyway.
5. 1 January 2027 is the real US deadline, and a reviewer-confirms design is both the scope-minimiser and the obligation-satisfier. Objection: human review slows the product. Answer: a review queue on consequential decisions is the one feature that satisfies California, Colorado and the EU at once, and it is what your customers’ counsel will ask about first.