Texas, Colorado, and the EU Just Diverged on AI Law. Here's the New Map.

Colorado just redrew the AI compliance map. On May 14, 2026, Governor Polis signed SB 26-189, repealing the state’s original AI Act (SB 24-205) and replacing it with a narrower framework built around disclosure and consumer rights — no impact assessments, no duty of care. For anyone tracking AI regulation from Texas, that repeal moves the reference points. There are now three dominant regimes, and they no longer rhyme.

The new landscape at a glance

What changed, and why Colorado pivoted

The original SB 24-205 mirrored the EU’s risk-tiered model, with deployer impact assessments and a duty-of-care standard. It was delayed twice. After xAI sued and the DOJ intervened on April 24, 2026, the court entered a joint order on April 27 under which the Colorado Attorney General agreed not to begin enforcing SB 24-205, or any replacement enacted that session, until 14 days after a ruling on xAI’s preliminary-injunction motion. That order covers SB 26-189, so its January 1, 2027 start is subject to it. A December 2025 executive order (EO 14365) had criticized Colorado’s algorithmic-discrimination law.

SB 26-189 passed 34–1 in the Colorado Senate and 57–6 in the House. What survives: consumer notice at the point of AI interaction, post-adverse-outcome notice within 30 days, consumer rights to access data and request human review, and AG enforcement with a 60-day cure period. What was dropped: impact assessments, deployer risk-management programs, and the algorithmic discrimination duty of care. Seven sectors remain in scope — education, employment, housing, financial services, insurance, healthcare, and government services — but the compliance burden is much lighter than before.

Where Texas stands

TRAIGA has been in effect since January 1, 2026, and its logic differs from both Colorado and the EU: it targets intent, not risk tiers. The core prohibitions — behavioral manipulation designed to incite self-harm, constitutional-rights infringement, intentional unlawful discrimination (disparate impact alone is not enough), and child sexual content — apply to any entity. Government agencies must disclose AI interactions to consumers before or at the time of contact. Healthcare providers must disclose AI use in treatment on the date of service. Private non-healthcare businesses face no disclosure requirement at all.

Penalties run in tiers: $10,000–$12,000 for curable violations, $80,000–$200,000 for uncurable ones, and $2,000–$40,000 per day for continuing ones. A violation discovered through an internal review that substantially complies with NIST’s AI Risk Management Framework: Generative AI Profile or another nationally or internationally recognized AI risk framework (§ 552.105(e)) carries no liability. As of May 2026, no TRAIGA enforcement actions had been publicly reported.

The EU’s next deadline: December 2, 2027

When this article was published, most high-risk obligations under the EU AI Act were scheduled for August 2, 2026. That changed. The Digital Omnibus on AI — Regulation (EU) 2026/1744 — entered into force July 27, 2026 and deferred Annex III stand-alone high-risk obligations to December 2, 2027, and Annex I systems embedded in regulated products to August 2, 2028.

The Article 50 transparency obligations, including the duty to tell people they are interacting with an AI system, did begin applying on August 2, 2026. Prohibited AI practices have been enforceable since February 2025; GPAI model rules since August 2025.

For Texas-based companies with EU operations or EU customers, the distinction now matters more than the date: Article 50 is live, high-risk is not. See our full report.

Three regimes, three theories of harm

Strip away the detail and the divergence is clean. Texas prohibits bad intent. Colorado mandates disclosure and consumer rights in defined sectors. The EU imposes tiered conformity obligations by risk. None of the three creates a private right of action; all three rely on government enforcement with a cure window before penalties attach.

The practical problem is that a compliance posture built around any one of them leaves gaps in the other two. Which is why the starting point hasn’t changed since the day TRAIGA passed: know exactly which AI systems you run, and where they touch people.