Is the original Colorado AI Act checklist still reliable?
It needs updating: SB26-189 replaced the earlier provisions and sets requirements from January 2027. Use current enacted text and final implementing rules, rather than relying on superseded dates.
Did all California ADMT obligations start in January 2026?
No: CPPA distinguishes the regulations’ effective date from later compliance dates, including January 2027 for the specified significant-decision ADMT requirements. Coverage must still be assessed against definitions and thresholds.
Does using an API transfer all legal responsibility to its provider?
No such blanket transfer is established by the sources. Colorado’s developer/deployer framework illustrates why the buyer must map its own role and obtain the documentation needed from suppliers.
Is an encrypted private cloud enough for HIPAA?
Not on its own where HIPAA applies. HHS guidance explains business-associate responsibilities even for some providers that cannot decrypt the ePHI they maintain.
Can we say our model is NIST certified?
These sources do not support that claim. NIST’s AI RMF is voluntary guidance; describe the actual controls and version used instead of implying product certification.