Will Colorado’s Revised AI Act be Preempted?

For some time, the federal government has toyed with the idea of limiting state authority to regulate AI. After legislative measures to pass a “state law moratorium” failed, the administration turned to preemption theories. The White House issued an Executive Order calling for a national AI policy framework that would preempt state laws.

Colorado’s AI Act was one of the first pieces of state legislation regulating AI on a broad scale. This made it a common target for those opposing state regulation. However, Colorado’s legislature got cold feet and replaced the law with a less ambitious regulatory scheme. Despite this, the FTC’s recent proposed policy statement postures the agency against the watered-down law. A recent Arnold & Porter memo discusses how the policy statement addresses Colorado’s AI law:

“In early July, just over one month after the Revised Act’s passage, the FTC issued a Proposed Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems. The Proposed Policy Statement warns against a ‘balkanized or patchwork regulatory approach’ and cites Colorado’s original AI statute as an example of state regulators ‘requiring American companies to embed ideological bias within their AI models.’ While the Proposed Policy Statement acknowledges the changes made in SB 26-189, it states that even ‘the new version poses many of the same concerns’ as Colorado’s original act and may be preempted by Section 5 of the FTC Act. The Proposed Policy Statement cites SB 26-189’s liability provisions as applying ‘pressure’ on AI developers to “alter” model outputs in ways that may themselves violate Section 5.”

Thus far, a national AI policy framework like the one proposed in the Executive Order has failed to materialize. In its absence, it appears the federal agencies may challenge state laws on existing preemption grounds. How such a challenge will play out in the courts is unclear, but the looming threat of preemption leaves companies in a less-than-ideal scenario.

Compliance under Colorado’s AI Act is required on January 1, 2027. Companies investing time and resources in compliance may be wasting their efforts if the law is enjoined. However, there is no way to know when or if a legal challenge from the FTC will emerge. This makes compliance preparation the safest path forward. Even if the law is challenged, there is no guarantee it will be enjoined. Litigation could take years, and in those intervening years, Colorado will likely expect compliance from AI developers and deployers.