Should we plan against what we read about it?

Only after checking when that material was written. The commencement was extended and the provisions were then repealed and reenacted with different requirements, so a well-researched article can be entirely accurate about a version that no longer stands, and nothing in how it reads will warn you of that.

Why did it get so much attention?

Because it put duties on organisations deploying these systems, not only on those building them, and because the deployer obligations were operational rather than declaratory: risk management policies, impact assessments, annual reviews, and telling consumers when such a system had been involved in a decision about them.

What is the durable lesson here?

That state-level AI law is moving faster than the guidance written about it. Anything you rely on should be checked against the legislature's own record for the bill rather than against commentary, because commentary is written once and rarely announces later that it has been overtaken.

Glossary

Colorado AI Act

The popular name for a Colorado law on automated decisions, whose commencement was pushed back and whose provisions were then rewritten.

In plain terms

A Colorado law about software making decisions that seriously affect people. It became famous quickly, then lawmakers pushed back when it would start and rewrote what it says, so most of what has been written about it describes a version that no longer stands.

Why it matters

Because it was widely reported as a template other places would copy, and a great deal of guidance was written on that basis. Anybody working from that material is working from a version the legislature has since replaced, which makes reading the date on your source the first step rather than an afterthought.

How it works

The popular name is not the official one. The law that started this was titled Consumer Protections for Artificial Intelligence, and the shorter name attached to it in coverage rather than in the statute, which is worth knowing when searching for what actually applies.

The original duty was reasonable care against algorithmic discrimination. Developers and deployers were both required to use reasonable care to protect consumers from known or reasonably foreseeable risks of that kind, which put obligations on organisations using these systems and not only on those building them.

The deployer side had real operational content: risk management policies, impact assessments, annual reviews and telling consumers when these systems were involved. That combination is what made the law significant, because it was ordinary businesses rather than model builders who would have to do it.

Its commencement was then extended by later legislation, which is the first thing that dates any commentary written about it. Guidance produced while the original date stood is describing an obligation that had not begun.

The provisions were subsequently repealed and reenacted with different requirements, framed around automated decision-making in consequential decisions. That is a rewrite rather than a postponement, so the substance changed and not only the timing.

The practical reading rule is to distrust the vintage of anything you find. This is a term where a confident, well-written source can be entirely accurate about a version that has been superseded twice, and nothing in the writing itself will tell you.

Why most writing about it is out of date

The volume of writing peaks at the second step and almost none of it is revised at the third or fourth. That is not carelessness on anybody's part: a briefing note is written to answer a question being asked at the time, it is accurate when published, and nobody is paid to go back and mark it superseded. The result is a body of material that is confident, detailed, well sourced and describing a version of the law that has been replaced, with nothing in the text to signal it. Search rewards that material too, because it accumulated links while the topic was current. The defence is unglamorous and works: for anything at this level of movement, check the legislature's own record for the bill rather than reading about it, and treat every secondary source as carrying an invisible expiry date. The same pattern is worth expecting wherever AI legislation is moving quickly, which at present is most places it exists.

Seen in the wild

Guidance written about employment screening obligations that describes a superseded version.
LinkedIn Recruiter
Asking an assistant what the law requires and receiving a fluent answer about the original text.
ChatGPT
Scoping an automated decision workflow against requirements that have since been rewritten.
Relevance AI

Common misconceptions

People assume

It is a settled law you can plan against.

In fact

Its commencement was extended and its provisions were then repealed and reenacted with different requirements. Planning against what was originally reported means planning against text the legislature has replaced.

People assume

Colorado AI Act is its name.

In fact

That is what coverage called it. The original law was titled Consumer Protections for Artificial Intelligence, and the rewrite that replaced its provisions carries a different name again, which matters when you are trying to find what currently applies.

Questions

Should we plan against what we read about it?: Only after checking when that material was written. The commencement was extended and the provisions were then repealed and reenacted with different requirements, so a well-researched article can be entirely accurate about a version that no longer stands, and nothing in how it reads will warn you of that.
Why did it get so much attention?: Because it put duties on organisations deploying these systems, not only on those building them, and because the deployer obligations were operational rather than declaratory: risk management policies, impact assessments, annual reviews, and telling consumers when such a system had been involved in a decision about them.
What is the durable lesson here?: That state-level AI law is moving faster than the guidance written about it. Anything you rely on should be checked against the legislature's own record for the bill rather than against commentary, because commentary is written once and rarely announces later that it has been overtaken.