Colorado's AI Governance Retreat Didn't End the Story — It Changed the Battlefield

⚖️ Colorado’s AI Governance Retreat Didn’t End the Story

Last month I wrote about Colorado’s AI Governance Retreat: What SB 26-189 Means for Enterprises, focusing on why Colorado replaced its original AI Act (SB 24-205) with the much narrower SB 26-189 and what that meant for enterprise compliance programs.

Since then, however, the story has evolved into something arguably more significant.

The legislative rewrite was not the end of Colorado’s AI governance journey—it became the opening chapter of a broader constitutional and political battle over who gets to regulate AI in the United States.

The question is no longer simply what Colorado’s AI law requires.

It is increasingly whether states will ultimately be allowed to regulate frontier AI in the first place.

🏛️ A Different Kind of Regulatory Challenge

Colorado’s original AI Act was widely viewed as the nation’s first comprehensive state framework governing high-risk AI systems used in consequential decisions such as employment, housing, lending, healthcare, insurance, education, and government services under SB 24-205.

Instead, events unfolded remarkably quickly.

On April 9, 2026, xAI filed a federal lawsuit challenging the law on First Amendment, Dormant Commerce Clause, Due Process, and Equal Protection grounds.

Two weeks later, the U.S. Department of Justice intervened in support of the constitutional challenge—the first time the federal government had joined litigation seeking to invalidate a state AI law. oai_citation:1‡Department of Justice

Meanwhile, Colorado lawmakers enacted SB 26-189, replacing the original framework before its scheduled June 30 effective date.

Then came perhaps the least discussed development.

The federal district court approved a joint stay of enforcement, preventing the Colorado Attorney General from enforcing SB 24-205—or any legislation replacing or amending it, including SB 26-189—until after future rulemaking and a ruling on xAI’s forthcoming preliminary injunction motion. oai_citation:2‡Justia Dockets & Filings

The result is unusual.

The original law never took effect.

Its replacement has also been paused before enforcement.

🧭 The Story Is Bigger Than Colorado

Viewed individually, these events could be dismissed as ordinary litigation.

Taken together, they suggest something broader.

President Trump’s Executive Order on Eliminating State Law Obstruction of National Artificial Intelligence Policy established a federal policy favoring a “minimally burdensome” national AI framework, directed agencies to identify state AI laws that could conflict with federal priorities, and created a DOJ AI Litigation Task Force to support appropriate legal challenges.

Colorado quickly became the first major test case.

To be clear, this is not yet federal preemption in the legal sense.

Congress has not enacted a federal AI statute overriding state law, and no court has ruled that Colorado’s AI legislation is unconstitutional.

What we are seeing instead is an emerging strategy in which executive policy, constitutional litigation, DOJ participation, and state legislative negotiations interact to reshape AI regulation before courts ever reach the merits.

Whether this approach succeeds elsewhere remains to be seen.

But Colorado demonstrates that litigation itself may become an increasingly important part of AI governance.

⚖️ Governance Must Survive Regulatory Volatility

One lesson stands out.

Traditionally, organizations have treated governance as a compliance exercise:

• understand the law;
• build required controls;
• prepare for enforcement.

Colorado suggests that assumption is becoming outdated.

Organizations may now invest heavily in governance programs only to see the governing statute rewritten, delayed, or challenged before enforcement even begins.

The compliance target itself is becoming dynamic.

That does not mean those investments were wasted.

Many organizations aligned their governance programs with the NIST AI Risk Management Framework, strengthened model inventories, documented oversight processes, and improved accountability. Those capabilities remain valuable regardless of whether one particular AI statute survives.

Existing civil-rights, employment, lending, consumer-protection, and privacy laws continue to apply even if AI-specific legislation changes.

Good governance increasingly needs to survive regulatory uncertainty, not merely satisfy today’s statute.

🌎 Colorado May Be the First—Not the Last

Colorado is unlikely to be unique.

Across multiple jurisdictions, ambitious AI governance proposals are already encountering political negotiation, implementation challenges, litigation, or delayed enforcement.

I’ve previously written about similar implementation pressures surrounding the EU AI Act and the growing role of international coordination through the UN Global Dialogue on AI Governance.

Taken together, these developments point toward a broader shift.

AI governance is becoming increasingly iterative.

Legislation is no longer simply enacted and implemented.

Instead, it evolves through cycles of legislation, litigation, rulemaking, amendment, and judicial review.

For practitioners, understanding the statute is becoming only the beginning.

🔍 What I’m Watching

To me, the most interesting question is no longer whether SB 24-205 or SB 26-189 represents better policy.

Instead, it is whether Colorado becomes the template for challenging future state AI laws.

If constitutional litigation becomes a routine response to major AI legislation, regulatory uncertainty could last years rather than months.

Ironically, that makes strong governance even more valuable.

Not because one particular law requires it.

But because laws, litigation, technologies, and regulatory expectations are all evolving faster than enterprises can rebuild governance programs from scratch.

Colorado may ultimately be remembered less for the law it enacted than for demonstrating that AI regulation itself has become part of the governance challenge.