AI Law Tracker

The Colorado attorney general's office holds its rulemaking hearing on the ADMT and Chatbot Safety rules in Denver (10:00 a.m., in person or by Zoom) and takes written comments through this date. An interim redline draft was posted on October 6, 2026. If the hearing runs past October 26, comments stay open until its last day.

The assistant to the president for science and technology must submit proposed legislative language defining Super Intelligence, including whether it should modify or supersede the current statutory definition of AI. The 60 days run from the September 29, 2026 order, so the date is approximate.

Regulation (EU) 2026/1744 adds two prohibited practices to Article 5, applying from December 2, 2026: AI that generates or manipulates realistic images, video or audio of an identifiable person's intimate parts or of an identifiable person in sexually explicit activity without that person's explicit consent (Article 5(1)(ba)), and AI that generates or manipulates child sexual abuse material within the meaning of Directive 2011/93/EU (Article 5(1)(bb)). Placing such a system on the market is banned only where that is its intended purpose or a foreseeable outcome without adequate safeguards; a deployer is banned from using a system for that purpose (Article 5(1a)).

Article 50 transparency obligations apply from August 2, 2026. Under the AI Omnibus (Regulation (EU) 2026/1744), providers of generative AI systems placed on the market before that date have until December 2, 2026 to comply with the Article 50(2) machine-readable marking duty. The Commission published the final Code of Practice on marking and labelling AI-generated content on June 10, 2026.

The new Product Liability Directive applies to products placed on the market or put into service after this date, and "product" includes software. Free and open-source software developed or supplied outside a commercial activity is excluded. Products placed on the market earlier stay under the old rules.

Colorado's replacement AI law takes effect, focused on disclosure, transparency, and targeted consumer protections for automated decision-making in consequential decisions.

Frontier developers must publish a transparency report when they deploy a new frontier model and report critical safety incidents to the DFS oversight office within 72 hours. Large frontier developers, with annual revenue above $500 million, must also publish a frontier AI framework and file a disclosure statement.

Operators of AI companions need a protocol that detects user expressions clearly indicating a risk of suicide, self-harm or imminent physical violence, and must tell users they are talking to an AI, at least hourly for users under 18 (Public Act 26-15, Sec. 5).

Operators of conversational AI services open to the public must disclose that users are talking to AI, run a suicide and self-harm protocol, and apply the protections for known minors. Customer support, internal and business productivity tools are excluded.

Employers covered by Cal/WARN that announce a mass layoff, relocation or termination caused in whole or in substantial part by AI or other automation must head the notice "This notice is for a technology displacement" and list the jobs, functions and type of system involved.

A business that used automated decisionmaking technology for significant decisions, such as hiring, pay or termination, before this date must have the pre-use notice, opt-out (or a permitted exception) and access process in place. New uses must comply from the start.

Last day to respond to Consultation Paper 279, which proposes treating software and AI systems as products under the Consumer Protection Act 1987. Responses go through the online form or to [email protected].

Most operator obligations under SB 1119 begin, including a pre-release risk assessment of harms to children for new or substantially modified companion chatbots.

On and after this date, operators report each year on their suicide and self-harm protocol, including the number of crisis referral notifications issued. The Attorney General's rules may set more of the report's content.

Providers of general-purpose AI models placed on the market before August 2, 2025 must comply with the AI Act's GPAI obligations by August 2, 2027 (Article 111(3)). For newer models the obligations have applied since August 2, 2025, and the Commission's fining powers (Article 101) since August 2, 2026.

Notice obligations to employees and applicants about AEDT use, and the developer information-sharing duty, take effect.

Financial institutions supervised by MAS should meet Sections 3 and 4 of the Guidelines on AI Risk Management (AI oversight; identifying, inventorying and assessing the risk materiality of AI) from this date, and Sections 5 and 6 (life cycle controls, AI capability and capacity) by October 7, 2028.

Stand-alone high-risk AI systems listed in Annex III, including recruitment and credit scoring, must comply under the postponed timeline set by Regulation (EU) 2026/1744.

Processing that began before the CCPA regulations took effect on January 1, 2026 and still continues, including ADMT used for significant decisions, needs a documented risk assessment by this date.

Risk assessment information for assessments conducted in 2026 and 2027 must be submitted through the CPPA website, attested under penalty of perjury by a member of executive management.

High-risk AI embedded in regulated products under Annex I, such as medical devices and machinery, must comply under the postponed timeline.