| Regime | Verified status and relevant date | Who should screen for scope | Buyer action |
|---|---|---|---|
| Colorado SB26-189 | Signed 14 May 2026; relevant requirements begin 1 January 2027 | Developers/deployers of covered ADMT materially influencing consequential decisions | Replace an old SB24-205 checklist; map documentation and human-review responsibilities |
| Colorado implementing rules | Rulemaking still shown as proposed; hearing scheduled 26 October 2026 | Businesses potentially within the law | Check final rule text after the hearing; do not treat draft detail as settled |
| California CCPA regulations | Effective 1 January 2026, with staggered compliance dates | Covered businesses and relevant processing activities | Distinguish risk-assessment duties from ADMT and audit deadlines |
| California significant-decision ADMT | Compliance begins 1 January 2027 under CPPA’s final-rule announcement | Covered businesses using the defined ADMT for significant decisions | Prepare data/use inventory, notices and consumer-rights handling with counsel |
| EU AI Act | Updated Commission timeline includes 2026 transparency and later high-risk dates | US firms within the Act’s territorial/product scope | Reclassify role/use and refresh contract schedules |
| NIST AI RMF | Voluntary framework; NIST says version 1.0 is being revised | Organisations choosing or contractually required to use it | Record the version; do not claim NIST certification |
Sources: Colorado enacted-law summary, Colorado rulemaking page, CPPA announcement, Commission timeline and NIST status page. The table summarises these authorities; the actions are the desk’s proposed procurement response.