This is part three of a four-part series highlighting key learnings from the IAPP Privacy. Security. Risk. + AI Governance Global conference.

State AI Laws: Compliance Deadlines and Requirements

The compliance calendar for automated decision-making is another area in which legal teams face near-term decisions. California's automated decision-making technology (ADMT) requirements have a Jan. 1, 2027 compliance date for existing covered uses in significant decisions involving employment, housing, education, financial services, and healthcare.

The regulations focus on technologies that replace or substantially replace human decision-making. A qualifying human reviewer must understand and evaluate the output, consider relevant information, and have authority to change the decision.

The regulations also provide exceptions to certain consumer opt-out obligations, including where a qualifying human appeal process is available. Narrower exceptions apply to specified hiring and employment decisions, subject to additional conditions.

Although the ADMT-specific compliance deadline is January 2027, California's risk assessment requirements are already in effect and may apply to the use of ADMT in significant decisions.

Colorado's SB 26-189, signed in May 2026, repealed and replaced the state's earlier AI Act framework. The replacement establishes requirements beginning Jan. 1, 2027, for covered automated decision-making technology used to materially influence consequential decisions.

Developers must provide deployers with technical documentation addressing intended uses, categories of training data, known limitations, and appropriate human review. They must also notify deployers of material updates or modifications to covered systems.

Deployers face consumer notice obligations, including a plain-language description of the technology's role within 30 days after a covered consequential decision produces an adverse outcome. Affected consumers may request access to certain personal data and correction of inaccurate personal data, along with meaningful human review and reconsideration to the extent commercially reasonable. Both developers and deployers must retain compliance records for at least three years.

Federal Challenges Complicate State AI Enforcement

The federal government's challenge to state AI regulation complicates planning.

Executive Order 14365, issued in December 2025,directed the Department of Justice (DOJ) to establish an AI Litigation Task Force.

In April 2026, DOJ intervened in federal litigation challenging Colorado's original AI law. On April 27, the court entered a stipulated order barring the Colorado Attorney General from initiating enforcement, including investigations, for alleged violations of the original law or its 2026 replacement occurring on or before 14 days after the court rules on the plaintiff's forthcoming preliminary injunction motion.

That motion is due within 28 days after Colorado adopts its final implementing regulations. Rulemaking remains underway, with a public hearing scheduled for Oct. 26, 2026. The court's order limits enforcement during the specified period; it does not invalidate the statute.

The FTC separately proposed a policy statement addressing potentially deceptive practices involving AI systems whose outputs are steered toward undisclosed objectives. The proposal also argues that some state restrictions affecting AI output accuracy may conflict with Section 5 of the FTC Act. The comment period closed July 31, 2026. As of mid-October, the FTC continues to list the statement as proposed.

These developments may ultimately affect how state AI laws are enforced. Legal teams should account for the current limits on Colorado enforcement while continuing to assess applicable requirements and monitor further court and agency action.

EU AI Act: Revised Deadlines and New Obligations

For companies with EU operations, Regulation (EU) 2026/1744 amended the EU AI Act's timetable. The principal high-risk obligations for Annex III systems now apply Dec. 2, 2027, while those for high-risk systems covered by Annex I product legislation apply Aug. 2, 2028.

Other AI Act requirements are already in force, including certain prohibited practices, AI literacy obligations, general-purpose AI model requirements, and transparency rules.

The amended Act also introduces two additional prohibitions concerning AI-generated nonconsensual intimate material and child sexual abuse material, effective Dec. 2, 2026. Providers of generative AI systems placed on the EU market before Aug. 2, 2026, also have until Dec. 2, 2026, to meet certain machine-readable content-marking requirements.

Practical Takeaway

For inventory AI systems involved in consequential decisions, document which laws apply, whether meaningful human review or another exception is available, and what notices or review rights are required. For EU-facing AI products, check the December 2026 obligations as well. Monitor the federal challenges and state rulemaking as implementation proceeds.