Colorado paused. Texas turned on. California turned on the same day. If your company uses AI in more than a couple of states, you are now running compliance against three different state AI regimes at once — and the federal government is in court trying to make the map shift again. Your auditor does not care which one is the easiest.
The story#
The headline this fortnight was a Denver courtroom. On April 27, a federal judge signed an order pausing enforcement of the Colorado AI Act — the first comprehensive state AI law in the country — while xAI's lawsuit against the state plays out and the U.S. Department of Justice argues the law is preempted by federal policy. The Colorado Attorney General said the same week she would not write rules or chase cases until the legislative session ends. For a lot of teams, that read like a reprieve. It is not.
Here is what the pause actually changed: one state out of fifty got quieter. Texas's Responsible AI Governance Act — TRAIGA, which is what every Texas lawyer now calls it — has been live since January 1. It applies to any company whose AI product touches a Texas resident, which means most companies. If your hiring tool shows a recommendation to a candidate in Austin, you are in scope. Penalties run from $10,000 to $200,000 per violation, plus a daily fine for ongoing ones. There is a 60-day cure window before the Attorney General can pursue penalties — a real gift, but only if someone in your company notices the letter the day it arrives.
California's AB 2013 — the Generative AI Training Data Transparency Act — also turned on January 1. The ask is small: if you build or substantially modify a generative AI system and make it available to Californians, you have to publish a public-facing page describing the data you trained it on. The surface area is large. There is no minimum-user threshold. No "one million customers" line. If you fine-tuned a model on customer data and shipped it to one Californian, you may have just become a "developer" under the law without realizing it.
So the practical map for May looks like this. Texas is enforceable. California is enforceable. Colorado is on ice but the law is still on the books — and the replacement bill the state legislature is already moving through (SB 26-189) will look similar enough that the prep work is reusable. About a dozen other states have bills pending. These laws do not replace each other. They stack. A SaaS company with customers in all 50 states is not "complying with TRAIGA." It is complying with the union of every state law that touches its product, and the pause did not shrink that union — it just changed which slice is enforceable this quarter.
Hot take#
The interesting move from the White House this winter was the bet that federal preemption — Washington overriding the states — would land in time to save companies from the patchwork. Executive Order 14365 directed DOJ to start picking off state AI laws in court. The National Policy Framework dropped in March with a draft for Congress. And then... nothing has been preempted. Congress has not moved. The courts have paused Colorado, not killed it. The framework is a draft.
If your compliance plan for 2026 is "wait for the federal version to land," I think you have already lost the year. That posture was defensible in early 2025 when there was one state law and a quiet federal docket. It is not defensible now. Any company doing AI across more than about three states is now facing more state compliance work than a single federal law could realistically erase even if it passed tomorrow — because the federal framework currently in draft preserves state authority for child safety, consumer protection, and general police powers. Those carveouts are where most of the active state AI rulemaking actually lives. "Wait for federal" is a posture that lets the next eighteen months happen to you.
Curated links#
- X.AI sues, DOJ intervenes, enforcement of Colorado's AI Act suspended (Norton Rose Fulbright) — The cleanest single-page summary of what the April 27 court order did and did not do, and the deadlines that still bind Colorado's AG.
- The Texas Responsible AI Governance Act: What your company needs to know (Norton Rose Fulbright) — A plain-English walk-through of TRAIGA's scope, the 60-day cure period, and how the NIST AI RMF safe harbor actually works in practice.
- California's AB 2013 Takes Effect (Goodwin) — Why the training-data disclosure rule catches a lot more companies than you would guess, and the trade-secret pressure it creates if you fine-tuned on customer data.
- National Policy Framework for AI — Key points (DLA Piper) — What the White House's March 20 framework actually proposes, including the carveouts that mean state AI work does not go away even if Congress acts.
- Colorado AG delays enforcement of Colorado AI Act (Troutman) — The AG's own posture on what gets paused, what does not, and what companies that built Colorado-specific programs should keep doing this quarter.
What's next#
Issue #4 lands in two weeks — pillar rotation back to cybersecurity, and we are writing about the metric most security dashboards still get wrong (and why your board is starting to ask about it by name).