This cycle was about deadlines becoming reality. Colorado’s high-risk AI rules reached their effective date even as lawmakers reworked the statute, and Brussels moved on both simplification and fresh high-risk guidance. For operators, the throughline is the same: the evidence you can produce now matters more than the policies you filed last year.
Colorado’s AI Act arrives, and shifts under operators’ feet
Colorado’s rules for high-risk AI systems reached their effective date, per Let’s Data Science, putting obligations around consumer-facing and consequential decision systems into force. At the same time, Krieg DeVault via JDSupra reports that SB 26-189 substantially overhauls the original law, meaning teams that built to the first draft may need to revisit their obligations.
Why it matters: A statute that changes on the way to its own start date is a compliance planning hazard. Build your controls to the underlying risk of the system, not to a specific bill version, so a legislative amendment does not reset your program.
The Colorado Sun published an opinion arguing the state’s rollout offers cautionary lessons for other state and federal lawmakers.
Why it matters: Expect other states to borrow Colorado’s structure while trying to avoid its stumbles. Treat this as the template your next high-risk obligation will resemble, and get ahead of the documentation and testing expectations now.
EU splits the difference: simplification plus new high-risk guidance
The EU adopted simplified AI rules under Omnibus VII, according to Digital Watch Observatory, part of a broader effort that EU Today frames as a test of whether Brussels can cut red tape without weakening oversight. In parallel, Covington and DLA Piper report the Commission has published draft guidelines clarifying what counts as a high-risk AI system, including in employment contexts.
Why it matters: Simplification does not mean less proof. Draft high-risk guidance is where classification gets decided, and misclassifying a system is the fastest way to end up under-documented at audit. Read the guidance against your actual use cases before it finalizes.
The Brussels Times reports the EU is banning AI-generated sexual deepfakes even as some high-risk provisions face delays.
Why it matters: Prohibitions and phased obligations are moving on different clocks. Track them separately so a delayed high-risk deadline does not lull you into missing a hard prohibition already in force.
Governance moves closer to the balance sheet
Forbes argues that ungoverned AI use is becoming a financial liability landing on the CFO, not just an IT concern. Separately, Digital Watch Observatory reports Spain’s regulatory sandbox is serving as an early proving ground for biometric AI compliance.
Why it matters: When accountability reaches finance leadership, “we have a policy” stops being an answer. What holds up is a record of tested, monitored, and controlled systems. This is where AI validation earns its keep: proof over paperwork. Sandboxes like Spain’s are a low-risk way to generate that evidence before a live audit forces the question.
The pattern this cycle is clear: rules are firming up faster than most programs are, and the operators who can show their work will fare best.
See how we validate AI systems →
Until the next cycle,
The Third Penguin