The AI rules that change three times a year

If you're building with AI and genuinely trying to follow the rules, the last year has been whiplash. Watch one law move.

Colorado passed a landmark AI law — SB 24-205, consumer protections against algorithmic discrimination — and set it to take effect in February 2026, then pushed that to June 30. Then, in December 2025, the federal government signed an executive order to preempt state AI laws and centralize oversight in Washington, naming Colorado's law specifically as the kind it was targeting. Then, in May 2026, Colorado blinked: the governor signed a revision that delayed the law again — now to January 2027 — and significantly scaled back what it required.

Tighten, push, preempt, delay, water down. If you were building to that rulebook, your target moved three times in a single year. That's the real situation for anyone shipping AI right now, and it calls for a different strategy than "comply with the law." Let me lay it out.

The rules are a moving target, on purpose

This isn't Colorado being indecisive. It's structural. AI regulation is caught in a tug-of-war between states that want to move first and a federal government that wants one national rule, and the rope is the law you're supposed to follow. Pulled one way, requirements tighten; pulled the other, they get preempted or delayed. The result, from a builder's seat, is a target that won't hold still long enough to aim at.

And it's not just one state. Different jurisdictions are landing in different places at different times, some tightening while others retreat, the federal layer threatening to override all of them. If your plan is "read the applicable statute and implement exactly that," you will be re-implementing every quarter, always a step behind whichever way the politics last swung.

Build to the principle, not the statute

Here's the way out, and it's almost calming once you see it: under all the thrash, the principles barely move. Strip away the specific thresholds and deadlines and effective dates, and essentially every AI regulation — Colorado's, the EU's, the next one — is asking for the same small set of things:

• Don't let your system discriminate. Whatever the statute is called, the core worry is an AI making consequential decisions unfairly. Test for that. It's required somewhere already and it's just good practice everywhere.
• Be transparent about AI. Tell people when a decision was AI-driven and when they're talking to a machine. That's the same direction the disclosure rules are all heading, regardless of which one wins.
• Keep records. Be able to show what your system did and why. Every version of every rule wants an audit trail, and you can't reconstruct one after the fact.
• Give people recourse. A way to question or appeal a consequential automated decision shows up in nearly every framework.

Build those four in, and you are substantially compliant with laws that haven't been written yet — because they're what the laws keep converging on, no matter how the deadlines lurch around.

Don't over-fit to today's deadline

The trap is treating whichever date is currently live as the thing to engineer toward. Teams that raced to hit Colorado's June 30 date built to a specification that, weeks later, got delayed eighteen months and gutted. Effort spent matching the exact letter of a moving statute is effort you may get to throw away.

That's not an argument for ignoring the rules — it's an argument for aiming at the durable part. The deadline is noise; the principle is signal. Solid documentation, bias testing, and clear disclosure are valuable whether the law lands in June, next January, or never, because they also make your product more trustworthy. The compliance is a side effect of building something defensible.

The bottom line

You cannot build to a law that changes three times a year, and 2026 is proving you'll go broke trying. Colorado's rulebook moved under everyone's feet, and it won't be the last one to.

Stop chasing the deadline and build to the principle, because the principle is the part that doesn't move. Don't discriminate, disclose the AI, keep the records, offer a way to appeal. Do those, and you're ready for whichever rule wins the tug-of-war — instead of rebuilding every time the rope moves.