Regulation

Colorado repealed its landmark AI Act before it ever took effect and replaced it with something narrower: SB 26-189, built around automated decision-making technology, disclosure, and a consumer right to meaningful human review, effective January 1, 2027. The mandate list shrank. The question that survives — review of what, exactly? — is the one worth preparing for.

On April 17, 2026, the banking agencies superseded SR 11-7 with SR 26-2, moving model risk management from a prescriptive checklist to a risk-based posture. We absorbed the change by re-pointing a citation pack, not rebuilding an engine — and the SR 26-2 Model Risk Management Graph Suite is now available as an enterprise offering.

Corrected and updated: Colorado repealed SB 24-205 before it ever took effect and replaced it with the narrower SB 26-189, effective January 1, 2027. We keep the original analysis on the record, mark what the replacement dropped, and note what survives — including the question that outlives both statutes: can you document how the system reasoned?

Traditional validation assumes you can read a model’s mechanics, test it on holdout data, and stress-test it against known scenarios. LLMs break all three assumptions. What validation teams actually need isn’t holdout accuracy—it’s reasoning traces.

Most EU AI Act coverage is written by lawyers for lawyers. But the Act’s requirements for high-risk AI systems aren’t just policy obligations—they’re architectural ones. Engineering teams need a different reading of Articles 9 through 15.

SR 11-7, the Federal Reserve's model risk management guidance, was written for statistical models with inspectable coefficients. LLMs break every assumption the framework rests on. When an examiner asks how the model arrived at a specific decision, the answer "we trust the output" is not an answer.

There is a difference between knowing what your AI did and knowing how it got there. Most governance platforms answer the first question. They log the model, the timestamp, the guardrail result. The second question requires a reasoning trace.