Colorado's Revised AI Rules Due September 23 as California Bills Advance; U.S. Governance Patchwork Deepens

Colorado is releasing revised draft rules for its automated decision-making technology law on September 23, opening a public comment window through October 26—while California continues advancing competing AI governance bills and the FTC issued a new algorithmic consumer targeting order this month. For companies operating nationally, September 2026 is producing the most concentrated state-level AI compliance pressure of the year so far.

The divergence between these state frameworks is no longer a future compliance risk. It is an active operational problem for businesses running AI systems across multiple jurisdictions without a federal standard to anchor them.

Colorado: The Revised ADMT Rules

Colorado's Artificial Intelligence Act, signed in 2024, requires developers and deployers of high-risk AI systems to conduct impact assessments, disclose AI use in consequential decisions, and provide consumers with appeal rights. The law targets "high-risk" AI—systems making or substantially influencing decisions in employment, housing, credit, education, healthcare, and insurance.

The original implementation rules drew criticism from business groups for scope ambiguity—particularly around what constitutes a "high-risk" AI system and what disclosure obligations apply to AI systems that assist human decision-makers versus those that make decisions directly. According to Vorp Labs' regulatory tracker, the September 23 draft is expected to address these ambiguities with more specific definitions and clearer thresholds.

The October 26 comment deadline is the window for businesses, civil rights organizations, and technology providers to shape the final rules before they take effect. Companies affected by the Colorado Act—any business deploying high-risk AI affecting Colorado residents, regardless of where the company is headquartered—should treat the September 23 publication as a compliance planning trigger.

California: Multiple Bills, Multiple Timelines

California is advancing several AI governance measures simultaneously through its legislature, each on a different timeline and covering different domains:

• Legislation targeting AI-generated content disclosure requirements, building on existing deepfake laws
• Bills addressing algorithmic employment decision systems, extending protections beyond the narrow employment discrimination framing in existing law
• Consumer protection measures governing AI in insurance and lending decisions

The California bills, if enacted, would create obligations that overlap with but do not map cleanly onto Colorado's ADMT framework. A company deploying an AI system in hiring decisions would face Colorado's impact assessment requirements, California's algorithmic disclosure rules, and potentially different standards for what constitutes adequate human oversight in each state.

This is not a hypothetical compliance scenario. Legal teams at companies using AI in HR, lending, insurance, and healthcare are managing it now—with the added pressure that the regulatory calendar is moving faster than the internal review cycles that would normally precede significant compliance architecture changes. The analysis from In-House Connect published this month specifically flagged that static compliance programs cannot keep pace with this kind of multi-state legislative velocity.

The FTC's CMG Order

The Federal Trade Commission issued a new consent order against a major data broker in September addressing algorithmic consumer targeting practices—using behavioral and inferred data categories to target consumers with products or services in ways that raise discrimination and manipulation concerns. The order does not create new law, but consent orders set operational precedents that other companies in similar businesses treat as effective guidance.

For AI teams building consumer recommendation and targeting systems, the FTC's CMG order signals the agency's current view of which algorithmic practices cross the line from personalization into prohibited discrimination or unfair practice. Legal review of recommendation and targeting AI should benchmark against the specific behaviors the order addresses.

Why Federal Preemption Hasn't Solved This

The White House's June preemption effort attempted to establish federal AI governance primacy over state laws, but it faced the same legislative calendar problem that every federal AI bill has encountered: Congress has not moved a comprehensive federal AI framework to a floor vote, leaving the preemption argument without statutory backing.

Without federal law, there is no override of Colorado's ADMT rules, California's bills, or Texas's AI governance legislation. Each state framework is valid until a federal court or Congress says otherwise. The Great American AI Act, which addresses state preemption, has not advanced past committee in either chamber as of September 2026.

The practical consequence: national companies must either build compliance programs sophisticated enough to satisfy the most demanding state requirements across all operations, or segment their AI deployments geographically—offering different product configurations to users in different states. The second option has its own costs and creates customer experience inconsistencies that product teams resist.

What the Patchwork Costs

A survey of corporate legal departments published earlier this year found that AI compliance is one of the fastest-growing line items in legal operations budgets, driven almost entirely by the multi-state monitoring and assessment burden rather than actual regulatory violations. Companies are spending on compliance infrastructure before regulatory enforcement has materialized in meaningful volume—because the risk of being caught without documented processes when enforcement does arrive is judged worse than the cost of building the processes preemptively.

What to Watch

September 23 is the date to watch immediately—Colorado's revised ADMT draft publication will clarify whether the state's AI law has become materially more workable for businesses or whether the scope ambiguities that drew criticism remain. The October 26 comment deadline follows, and the quality of the business and civil society input submitted in that window will shape whether the final rules reflect real-world AI deployment constraints or remain a compliance framework written in isolation from operational realities. California's legislative calendar runs through mid-September, making the next three weeks a critical window for any of the pending AI bills to advance or stall before the end of the current legislative session.

By Hector Herrera