Three legal shifts broke in the last week that collectively reshape the compliance roadmap for AI startups operating in the United States and Europe. Colorado Governor Jared Polis signed SB 189 on May 14, officially replacing the state's landmark 2024 AI Act with a narrower, disclosure-focused framework that takes effect January 1, 2027. On May 7, the EU reached a landmark deal to simplify the EU AI Act — extending deadlines for high-risk AI compliance and expanding startup protections to companies with up to 750 employees and €150 million in revenue. And in Washington, the INVEST Act — the most significant bipartisan capital formation reform in over a decade — passed the House 302-123 and is now awaiting Senate action. Each of these developments changes what AI founders owe, when they owe it, and how much runway they have to build compliance into their products.

The Big Picture

The AI regulatory landscape is shifting from construction to enforcement — but the construction phase is not over. This week's developments illustrate a critical tension: states and the EU are simultaneously simplifying older AI rules while moving toward harder enforcement on new, narrower obligations. Colorado replaced its sweeping risk-based framework with a targeted disclosure model — that is real relief for growth-stage AI companies. The EU extended its high-risk AI deadlines by 18 or more months — that is meaningful breathing room for AI startups with European exposure. But neither simplification means compliance-optional. Both frameworks still require affirmative action: disclosure obligations, recordkeeping requirements, and consumer rights that must be built into products before the effective dates. The founders who treat "simplified" as "eliminated" will be the ones facing enforcement in Q1 2027.

1. Colorado AI Law Signed — What SB 189 Actually Changes for AI Companies

Governor Polis signed SB 189 on May 14, 2026, officially replacing SB 24-205 — the first-in-the-nation AI consumer protection law that had been suspended under federal legal challenge. The new Colorado AI law is structurally different from the original in ways that matter for growth-stage AI companies. SB 189 repeals and reenacts SB 24-205 entirely, adopting a narrower framework that focuses on transparency, recordkeeping, and limited consumer rights rather than prescriptive risk governance.

What SB 189 eliminates:

1. The duty of care to protect consumers from algorithmic discrimination — scrapped entirely from the new framework
2. Mandatory impact assessments — no longer required under SB 189
3. Structured risk governance programs — eliminated as an affirmative obligation
4. The "high-risk artificial intelligence system" classification — replaced by the new defined term "automated decision-making technology" (ADMT)

What SB 189 keeps and adds:

1. Disclosure to consumers when ADMT is used in consequential decisions — employment, credit, housing, and healthcare decisions all trigger disclosure obligations
2. Consumer right to request human review — the right to have a human review AI-driven decisions in covered contexts is preserved
3. Recordkeeping requirements for ADMT deployments — companies must maintain documentation of how ADMT is used
4. Transparency obligations — consumers must be informed when ADMT materially influences decisions affecting them

The effective date is January 1, 2027 — giving companies roughly seven months to map their products against the new ADMT framework. The shift from "high-risk AI system" to "automated decision-making technology" is not just terminological. It resets which of your products are covered, what disclosures you owe, and what consumer rights you must support. Companies that built compliance programs around SB 24-205's impact assessment and algorithmic discrimination audit requirements can deprioritize those programs — but they need to replace them with a disclosure and recordkeeping architecture calibrated to SB 189's actual obligations before January 1, 2027.

Why the Colorado AI Law Signed in 2026 Sets the National Template

SB 189 is significant not just for Colorado-based AI companies but as a signal for how states will regulate AI going forward. The bill passed with strong bipartisan support following months of pressure from the federal government and industry — and its disclosure-first approach reflects what comprehensive AI regulation looks like when it must survive both political and legal scrutiny. As other states draft AI bills in 2026, Colorado's replacement framework is likely to serve as a model: narrower than the original, focused on transparency over prescriptive design, and calibrated to what enforcement agencies can actually verify. For AI founders thinking about multi-state compliance strategy, SB 189's ADMT framework is the direction of travel.

2. EU AI Act Digital Omnibus — What Changed for U.S. AI Startups with European Exposure

On May 7, 2026, the European Parliament and Council reached a provisional agreement under the Digital Omnibus on AI to significantly simplify the EU AI Act. This is not a proposal — it is a political agreement with formal adoption expected before August 2, 2026. The changes are meaningful for U.S. AI startups that have European customers, operations, or are considering EU market entry.

The key changes for AI startup compliance:

1. High-risk AI compliance deadlines extended — Annex III systems covering biometrics, employment, education, credit, and law enforcement have until December 2, 2027 to comply; Annex I systems embedded in regulated products such as medical devices or machinery have until August 2, 2028
2. SME threshold expanded significantly — startup and small-business protections now extend to companies with up to 750 employees and €150 million in annual revenue; benefits include reduced fines, simplified documentation templates, and regulatory sandbox priority access
3. AI-generated content watermarking deadline extended — the compliance deadline for watermarking AI-generated images, audio, and video is extended to December 2, 2026
4. Two new prohibited practices added — AI systems that generate or manipulate non-consensual intimate imagery, and AI systems that generate child sexual abuse material, are now expressly prohibited under the EU AI Act

The extended deadlines represent genuine relief for AI startups building toward EU compliance — but formal Omnibus adoption is required before August 2, 2026, after which the current high-risk AI deadlines would otherwise activate. Use the runway to build compliance infrastructure, not to defer the conversation.

3. The INVEST Act — What Capital Formation Reform Means for AI Startups and Their Investors

The INVEST Act (H.R. 3383) passed the House 302-123 on December 11, 2025 and is pending Senate action. The bill is the most significant bipartisan capital formation reform since the JOBS Act of 2012, and its provisions directly affect how AI startups access institutional capital.

Key INVEST Act provisions relevant to AI startups:

1. DEAL Act expansion — expands qualifying venture capital investments to include fund-of-fund and secondary investments, increasing the capital pool accessible to early-stage AI companies through a broader range of fund structures
2. ICAN Act reforms — increases investor count and fund size limits for qualifying venture capital funds, making it easier for growth-stage AI companies to access institutional capital
3. Critical tech sector access — expands capital formation tools for businesses operating in national security and critical technology sectors, a category that increasingly includes AI infrastructure and foundation model companies

The Senate timeline remains uncertain. But for founders currently in fundraising processes or structuring early fund relationships, understanding which INVEST Act provisions affect your securities exemptions and fund structures is worth getting ahead of before Senate action arrives.

What AI Founders Should Think About Now

• Colorado AI companies: SB 189's January 1, 2027 effective date gives you seven months. Map your products against the ADMT definition now — the question is not whether you use AI, but whether your AI makes or materially influences decisions in employment, credit, housing, or healthcare. That mapping determines your disclosure and recordkeeping obligations under the new Colorado AI law.

• AI companies with national deployment: SB 189's disclosure-first approach is where U.S. state AI regulation is heading. Building disclosure and human review mechanisms into your product architecture now positions you ahead of multi-state compliance obligations as other states follow Colorado's lead.

• AI startups with EU customers or operations: The extended EU AI Act deadlines are relief, not permission to delay — the December 2027 and August 2028 deadlines are specific. Post-deadline enforcement is where simplified rules become expensive. Start your compliance architecture in Q3 2026.

• Mid-stage AI companies with EU exposure: If your company is under 750 employees and €150 million in revenue, the expanded SME protections likely apply to you — verify eligibility and access the simplified documentation and sandbox resources before the Omnibus is formally adopted.

• AI founders in fundraising: Monitor the INVEST Act's Senate progress. Passage would expand qualifying venture fund structures and increase available institutional capital in ways that could directly affect your next round's structure and your investors' deployment capacity.

Strategic Takeaway

Opportunity → Colorado's SB 189 and the EU AI Act Digital Omnibus both represent genuine simplification of AI compliance obligations. The shift away from prescriptive risk governance toward targeted disclosure is a real win for growth-stage companies that cannot absorb the compliance cost of full impact assessment regimes. If your AI products touch consumers in Colorado or Europe, the path to compliance just got narrower and more achievable — and seven months is enough runway to build it right if you start now.

Risk → "Simplified" does not mean "eliminated." Both frameworks still require affirmative action before their effective dates. Colorado's January 1, 2027 deadline and the EU's December 2027 deadlines are specific — and post-deadline enforcement is where simplified rules become expensive. Build disclosure and recordkeeping architecture into your product roadmap in Q3 2026, not Q4.

What Comes Next

Colorado SB 189 takes effect January 1, 2027. Watch for the Colorado Attorney General to issue guidance on ADMT definitions and disclosure standards in the coming months — those definitions will determine the practical scope of compliance for AI companies operating in the state. The EU AI Act Digital Omnibus requires formal adoption before August 2, 2026; watch for the final text, which may modify specific provisions from the provisional agreement. On the INVEST Act, watch for Senate scheduling and whether the bill passes intact or is amended — the venture fund structure and qualifying investment provisions are the ones most likely to attract Senate attention.

Bottom Line

Colorado just replaced the most ambitious AI law in U.S. history with a leaner, disclosure-focused alternative that gives AI founders a clearer compliance target. The EU just extended its high-risk AI deadlines and expanded startup protections to cover more mid-stage companies. Both developments are genuine wins for AI founders — but both still require deliberate action before their effective dates. The compliance window is now clearer and the path more achievable. The founders who use this clarity well will be ahead of the regulatory curve when enforcement begins in 2027.

Learn More

At Launch Legal, we advise AI-native startups and technology companies on state AI compliance, EU AI Act obligations, and capital formation strategy — from Colorado's new ADMT framework to EU Omnibus readiness to INVEST Act positioning. If this week's developments raised questions about your AI product's legal exposure or fundraising strategy, reach out for a consultation.

Sources & Further Reading:

• Holland & Knight — Colorado Governor Signs SB 189, Significantly Amending the State's AI Law

• Morrison Foerster — Colorado Hits Reset on AI Regulation: What Developers and Deployers Need to Know

• Council of the EU — Artificial Intelligence: Council and Parliament Agree to Simplify and Streamline Rules

• Orrick — EU's Digital Omnibus on AI: 7 Key Changes You Need to Know

• Harvard Law — House Passes Bipartisan Capital Formation Package: The INVEST Act