When Colorado passed its first-in-the-nation AI law in 2024, the state put itself at the center of a national debate over how artificial intelligence should be regulated. The law was praised by consumer advocates, criticized by many in the tech industry, and questioned even by some officials who supported its goals.
Now Colorado has rewritten much of that approach.
Senate Bill 26-189, signed by Gov. Jared Polis on May 14, repeals and reenacts key provisions of the 2024 Colorado AI Act, moving the state toward a framework focused on automated decision-making technology, or ADMT, when it is used to materially influence consequential decisions. Those decisions include areas such as employment, education, financial services, insurance, health care, housing, and essential government services.
Tyler Thompson is a Denver-based partner in Reed Smith’s Emerging Technologies group. In his words, he focuses on “nerd law," a practice that includes data privacy, AI compliance, and technology transactions. His clients range from Fortune 500 firms to startups, and for the last three years, he's been named a "Top Lawyer" by 5280 Magazine.
For Thompson, the rewrite is both a retreat and a reset. He believes the new version gives businesses more certainty and provides consumers protections that are more likely to take effect, but he remains skeptical that Colorado was the right jurisdiction to lead the country into broad AI regulation in the first place.
This interview has been slightly edited for length and clarity.
1. CO AI News: For readers who haven’t followed every twist and turn of the state’s AI legislation over the last two years, what did Colorado actually decide with this new law? Is this best understood as a broad AI law, a narrower automated decision-making law, a consumer protection law, or something else?
Tyler Thompson: Originally, the Colorado AI Act was really unique. There was some overlap with other regulatory schemes, particularly the EU AI Act, but for the most part, it was a very unique law. I would say it was the first comprehensive AI law in the United States.
Pretty much from the jump, it was very controversial. Even the state attorney general and the Democratic governor, who are the same party as the legislators who pushed the original law, were saying, “We don’t know how this is going to work. How are we going to enforce it?”
So, it has been a journey. A lot of people in the industry were asking, “Does this make sense as a regulatory scheme? Does it make sense for Colorado to do it? What does all this mean?”
Now, with the new version, it’s trying to align more closely with something that I won’t say is more reasonable but is more familiar. Rather than creating a brand-new comprehensive AI regulatory scheme, it’s aligning more with automated decision-making technology rules.
That’s something we’ve seen before, typically in privacy laws. Europe’s GDPR has ADMT rules. California recently strengthened its ADMT rules in its privacy law. So, Colorado is now trying to adhere a bit more closely to that. It saw that what it originally wanted to do was too aggressive and too early, and now it’s bringing it back, if not to the realm of sanity, at least to the realm of the familiar.
2. CO AI News: The law was signed just last week, but the Colorado Attorney General’s Office, led by Phil Weiser, still has rulemaking work to do before the law takes effect on Jan. 1, 2027. For businesses trying to plan, how much of the law is settled now, and how much remains unresolved?
Thompson: I would say it’s probably 75%. The very important basics are there, and some really key concepts. There’s a lot that can happen in that last 25%, and the devil is in the details, but we have enough of a path forward now. Compared to what we’ve been dealing with, we have a lot more certainty.
There is still going to be a lot of discussion with the attorney general’s office. I think you can analogize this to privacy legislation. We’ve seen it with the Colorado Privacy Act and California’s privacy law. That rulemaking element is going to be a big piece of this.
Even though the new rules focusing on ADMT are clearer and use a more established framework, there’s still a lot of uncertainty. There are still gray areas. Some things are specifically left to the rulemaking process.
With privacy laws, we’ve seen situations where a law comes out and everyone feels pretty good about it, but then once you get to rulemaking, there are surprises. Some things help consumers. Some things help businesses. Some things may be negatives to one or the other.
There’s still plenty of learning left to be done, and still plenty of room for surprises and new developments.
3. CO AI News: What was gained with this rewrite?
Thompson: What was gained was the ability for Colorado to regulate AI, quite honestly.
The old framework was so controversial, and we had gone through so many iterations, that people like me in this space did not have a lot of confidence that it was ever going to take effect at all.
The largest thing gained was the ability for this to move forward, and for us to say, “OK, we are going to have a solid AI rule in Colorado.”
That’s the biggest gain, especially from the consumer standpoint. It’s easy for people to say this is less consumer-friendly, but I would disagree with that. The old formulation was so unlikely to take effect, to stay in effect after it was challenged, to be workable, or to be enforced by the attorney general, that under the old rule, I don’t know if you really had anything there as a consumer.
Now consumers do have something. They have a lot more than people in pretty much every other state in the country, except perhaps California.
On the business side, you gained certainty. You gained more alignment with a framework that, again, I won’t say is the best, and I won’t even say is business-friendly, but at least it’s a known framework.
It’s not so much that businesses want to avoid regulation. Businesses know how to handle regulation. It’s about certainty: What do they need to do? That uncertainty can be the dangerous thing and the cost driver.
4. CO AI News: And what was lost?
Thompson: Some of it is intangible. If it mattered to people that Colorado was an AI leader on regulation, or had the most protective rules in the country, or was bucking the administration and saying, “We’re going to do things our way,” I think those things are largely lost.
If you’re a strong consumer advocate, you could say that a more aggressive framework that theoretically could have become the framework for other states was also lost.
We’re no longer first because of all the delays. We’re no longer unique because this really adheres to rules that already exist in some form in other places. So, we lost both of those, to the extent anyone cared about that.
5. CO AI News: Some of the debate around the rewrite touched on whether Colorado was becoming too difficult a place for AI companies to build or grow. Do you think business-climate concerns helped drive this compromise, or was something else going on?
Thompson: A lot of this is speculation, but candidly, I don’t think business-climate concerns were a big part of what drove the compromise. I wish there had been more of a discussion about whether Colorado wants to be a leader in AI business, not just AI regulation, but I don’t think that was the main consideration for the key decision-makers.
Certainly, pro-business concerns were highlighted by some people in the legislature, especially Republicans, but that had been their position the whole time. I don’t think that changed with this new wave.
My sense is that the people pushing the bill were more focused on saying, “We definitely want regulation, and this is a way to get it done and avoid some of the trauma we’ve had.” I don’t think there was really anyone in a position of power saying, “We need to be more pro-business.”
At the same time, big tech’s presence and opposition were real. That had been part of the dynamic for a couple of years. But I’d separate that from saying the compromise itself was mainly driven by a broader concern about Colorado’s business climate.
6. CO AI News: For ordinary Coloradans – people applying for jobs, mortgages, housing, insurance, health care, or trying to get into college – what should they understand about what this law does for consumers?
Thompson: Consumers should look at this as a win. Despite some of the talk about whether this is less protective, Coloradans are still in one of the very few states that has an ADMT rule that is going to take effect. Compared to most other Americans, Coloradans have vastly more protections.
I also think consumers should understand that I didn’t think the old formulation was going to last. So, when people portray this as a watered-down law that’s not as protective, I don’t think that’s right. I think we had to water it down, or we were going to end up with nothing.
When I talk to people who aren’t in this space, they have very understandable fears about AI making decisions on important things outside their control. You don’t get the mortgage. You don’t get the job. You don’t get into the university. An insurance claim is denied. You can’t reach a human being on the other end of the phone.
This law is really targeted at those kinds of things. It adds controls and transparency around companies that might be using AI for those big decisions.
So, I think it’s definitely a win for consumers. Is it as much of a win as some people wanted? Maybe not. But I’d still say it’s a big win.
7. CO AI News: From a business-climate perspective, what does the rewrite mean for companies and startups? Does it make Colorado more attractive by being less risky, or will we be seen as simply more predictable?
Thompson: I certainly don’t think it’s going to entice anybody to come to Colorado. It’s still regulation. It’s not helping business.
My hope would be that it is neutral, or maybe a very slight negative.
The more interesting group is companies that are already here and were worried about what was going to happen. Is Colorado really going to become like California as a strong leader in AI regulation? How is that going to affect our business moving forward?
If you are a business leader in that space in Colorado, hopefully you are more optimistic now. You might still be worried long-term about being in a state that is seen as a regulatory leader in a very competitive and dynamic space. But I think you’re at least getting a little better sleep at night.
They started out very aggressive. It took them a while. It was a painful process. But they landed in a place that I think is more reasonable, and a place that many experts would have expected AI laws in the United States to look like at the state level.
I get asked a lot how the Colorado AI Act is going to hurt AI job creation or AI company formation in Colorado. My candid response is that I don’t think this is a big enough law, even in its original version, to override all the other factors people consider when deciding where to start a company.
Talent is a huge issue right now. Taxes matter. Depending on what you’re doing in AI, the cost of energy can be very persuasive.
I never thought even the first iteration was going to be a huge red flag by itself. If anything was going to be a red flag, it was perception: the idea that Colorado, like Europe or perhaps California, is not a place that is pro-AI business. Hopefully landing in a more reasonable spot has made that perception a bit better.
8. CO AI News: For companies that may have to comply with the revised law, where do you expect the biggest practical challenges – inventory, governance, impact assessments, documentation, or something else?
Thompson: The simple answer is that a lot of companies will look at the seven months they bought and say, “We’re not going to think about this at all.” Seven months in AI is an eternity. They may say, “This is a problem for a later version of me.”
But larger clients are already looking at how to build general AI compliance programs. How do we put something in place that satisfies Colorado, has some futureproofing, checks the boxes we need to check, and will still work if 10 more states enact similar laws?
The first step is understanding how your organization is using AI. If you’re not a developer and you’re more of a deployer, do you have an inventory? How is AI being used? For what purposes? What are the needs?
Then there’s internal AI governance. How are you going to govern AI? Who is making decisions about it?
The third step, especially for larger clients, is impact assessment. You look at specific uses of AI, document those uses, assess the risks that come from them, and then look at the remaining risk after controls are in place.
On the developer side, I think developers are a little happier because more of the compliance burden has shifted to deployers. For developers, the question is how to put standard documentation together so they can give deployers the information they need.
If you’re a developer, you’re going to get questions. How does this work? How are decisions made? If we need to do an appeal, how does that work? How do we provide transparency to the consumer?
Developers should have consistent documentation that explains the system, how it works, and how it doesn’t work, without giving away confidential information or the keys to the kingdom.
9. CO AI News: Stepping back, did Colorado land in the right place, especially in how it balances responsibility between AI developers and the companies that deploy or use their systems?
Thompson: Overall, I have been pretty cynical about the Colorado AI Act.
I don’t think Colorado is the right jurisdiction to be leading this. I very much fear a state patchwork, like we’ve seen in privacy. If you have a smaller state, compared to some of the big GDP states, leading this, I think you have a higher likelihood of that patchwork. You have a higher likelihood of what we saw: big money flooding in, litigation, and very expensive litigation.
Overall, I never really thought Colorado should do this. I didn’t think it was the right jurisdiction. I didn’t think the timing was right. Candidly, I thought it was too early. That goes for California’s rules and the EU AI Act, too.
If you were going to do anything, I think a more sector-specific approach to things like deepfakes would have been reasonable. That said, we landed in a place that is more reasonable.
I think the risk balance between developers and deployers is largely right. The challenge is that developers are often much larger and have more bargaining power, more resources, and more protection from the federal government than deployers.
So, putting deployers in a position where they have to chase developers for information, understand complex systems, and put risk controls in place can be difficult, especially when the other party may be a behemoth.
At the same time, you do have to protect developers. If you made developers responsible for everything deployers did with their systems, it could damage the ecosystem. Developers also don’t always know what deployers are doing with their systems.
I think the balance is largely right. But as far as whether Colorado landed in the right place overall, I’d say we landed in a better place. I just wish we hadn’t gone down this road in the first place.
10. CO AI News: After all the controversy and revisions, could Colorado’s final approach become a model for other states – or more of a cautionary tale?
Thompson: If other states are going to go down this road, and that’s a key “if,” I think this model is a very viable path. It’s arguably the likely path other states will take.
That said, I don’t think you can really call this the Colorado model. ADMT rules existed in GDPR, and California recently did something similar. So, I think it’s maybe partially Colorado’s model, but I don’t think people are going to call this the Colorado model moving forward. Where Colorado is 100% the model is as a model of what not to do.
Colorado took a really aggressive tack early on. It created a ton of time, energy, and drama, and then we ended up with ADMT rules. If I were another state looking at Colorado, I’d say, “I don’t want to repeat that path.”
You’ve really disincentivized anyone trying to do their own thing, especially if their own thing is more burdensome or more consumer protective.
The model we ended up with is something known. I’m not going to say it’s reasonable. I’m not even going to say it’s good. Maybe that remains to be seen. But it is known, and there is momentum behind it.
11. CO AI News: Many businesses would prefer one national standard instead of complying with different AI rules in different states. What do you expect from the federal government? Are we headed toward one national AI law, a state-by-state patchwork, or something more targeted?
Thompson: If I had to bet, unfortunately, I think the most likely outcome is a state patchwork.
We saw that with state data breach laws, and we’re seeing it with state privacy laws. Every issue in the privacy law debate is also in the federal AI law debate. The only difference is that the AI law debate has many more issues.
We’ve been talking about a federal privacy law for years, and I don’t think there’s any real chance of that in the near future.
Now apply the AI use case on top of that. You have people saying this is a national security issue and that AI companies need little regulation because we have to win the AI race. You have a lot of money involved. You have the government’s own use of AI. I don’t see a clear path for comprehensive federal AI legislation.
What could happen is more targeted federal legislation. We saw that with the Take It Down Act. There is agreement in certain niche areas that AI needs to be regulated and controlled.
So maybe the patchwork is a state patchwork, but it could also be a federal patchwork in specific areas. That’s something we’ve seen in privacy. We don’t have one uniform federal privacy law, but we have HIPAA, GLBA, COPPA, and FERPA for specific areas. That could happen with AI too: specific federal legislation in specific high-risk areas.
And it’s not clear to me that that’s unworkable. It may be a decent way to get the regulation you need by targeting the highest-risk things. It’s also not clear to me that Americans disagree with that approach. When I talk to people, they are worried about very specific things happening with AI. There are many uses of AI that the average American is not only not worried about but doesn’t think about or comprehend.
12. CO AI News: Beyond legal compliance, what haven’t we discussed that Coloradans should be thinking about as AI policy develops?
Thompson: There are a lot of AI-adjacent issues that consumers care about that Colorado has largely ignored.
Look at data centers. When I talk to average people, there are a lot of concerns that are really data center concerns. But I think people correctly attribute the rise in data centers to the rise of AI.
That’s something Colorado has largely ignored. And when you look at Colorado, this is a beautiful place where people care deeply about natural resources, water, and what gets built on the land.
Besides the concern that AI might make a consequential decision about them, the next thing I hear from people is data centers. It’s not a separate issue for them.
I’d like to see Colorado address that more. I also think Colorado is having a bit of an identity crisis. Since the COVID boom, are people realizing or thinking that Colorado is not pro-business enough, or that jobs are leaving? You saw it with some recent large tech company departures.
A lot of people in Colorado may be anti big-tech, but it’s also fair to say that those organizations bring in significant jobs and tax revenue.The idea that Colorado can be a huge tech leader and also a major regulatory leader is already starting to fail in California. California has the history, the talent pool, and many advantages that Colorado doesn’t have.
People here are going to have to think about that. Are we going to be a tech leader state? Are we going to be a more pro-consumer state? Are we going to be a more pro-environment state?
There’s no right answer. But I think, from what you hear from government, Colorado has an identity crisis. And I don’t think you can do all of those things at once, at least not right now.
