AI Governance

About This Law Official Name: Colorado Artificial Intelligence Act (CAIA) – Colorado SB 24-205 Originally Signed: May 17, 2024 by Governor Jared Polis Effective Date: June 30, 2026 (delayed from February 1, 2026 following a special legislative session) Jurisdiction: State of Colorado, USA. Applies extraterritorially to any company making consequential decisions affecting Colorado residents, regardless of where the company is based. Type: First comprehensive state-level AI law in the United States Applies To: Developers and deployers of high-risk AI systems used for consequential decisions affecting Colorado residents Maximum Penalties: Up to USD 20,000 per violation per affected consumer. Violations constitute unfair trade practices under Colorado Consumer Protection Act. Enforcement: Colorado Attorney General (exclusive enforcement, no private right of action). 60-day cure period after notice. Safe Harbor: Documented alignment with NIST AI RMF or ISO/IEC 42001 and cure within 90 days of discovering violation. Introduction Your AI hiring tool just screened 500 applications. Your AI credit model just declined 200 loan requests. If any of those decisions affected Colorado residents, your company has new legal obligations starting June 30, 2026. Colorado SB 24-205 is the United States’ first comprehensive state AI law. Despite multiple attempts to scale it back, the core requirements remain unchanged. The Colorado Attorney General has exclusive enforcement authority, with penalties reaching USD 20,000 per violation per affected consumer. For an AI system touching hundreds of applicants, that exposure compounds fast. Read on for the complete breakdown of who this law covers, what it requires, and the practical compliance steps you need to take before June 30. What Is the Colorado AI Act Targeting? Algorithmic discrimination is the legal target. The CAIA defines it as unlawful differential treatment based on protected characteristics (race, age, sex, disability, religion, and others) caused by an AI system. The law exists because AI systems can produce discriminatory outcomes even when developers and deployers never intended discrimination. The CAIA places responsibility on both the companies that build AI systems (developers) and the companies that use them to make decisions (deployers). If you buy a third-party AI tool and use it to screen job candidates, you are a deployer under Colorado law. You cannot outsource your compliance obligation to your vendor. What Counts as High-Risk AI Under the CAIA? An AI system is high-risk if it makes or substantially influences a consequential decision. A consequential decision is one that has a significant effect on a consumer’s access to or the cost of education, employment, financial services, essential government services, healthcare, housing, or insurance. Examples include: resume screening and candidate ranking tools, credit scoring and loan decision systems, insurance underwriting and pricing algorithms, medical risk stratification tools, tenant screening software, and educational assessment systems. If your AI system plays a meaningful role in any of these decisions for Colorado residents, you are almost certainly in scope. Deployers with fewer than 50 employees are exempt from the annual impact assessment requirement, unless they use their own data to train or customize the high-risk AI system. That exemption disappears the moment you do custom training work. What the CAIA Requires of Developers and Deployers Developers must: use reasonable care to protect consumers from algorithmic discrimination, document known foreseeable risks and intended uses, provide deployers with a statement describing those risks, conduct regular impact assessments, and disclose discovered discrimination to the Colorado Attorney General within 90 days. Deployers must: implement a documented risk management policy and program, complete an annual impact assessment of each high-risk AI system, notify consumers before deploying a high-risk AI system to make a consequential decision about them, provide a plain-language explanation of how the system works, give consumers the right to appeal automated decisions and request human review, and report discovered discrimination to the Attorney General. The Affirmative Defense: How to Protect Your Business The CAIA provides a meaningful safe harbor. A developer or deployer is not liable for a violation if they have complied with a nationally or internationally recognised AI risk management framework (such as the NIST AI RMF or ISO/IEC 42001) and they discover and cure the violation within 90 days of discovery. Aligning with the NIST AI RMF is not just good governance practice. It is a legal shield under Colorado law. Document your alignment, maintain records of your risk assessments, and implement the cure procedures before June 30. Your 5-Step CAIA Compliance Plan Frequently Asked Questions Does the Colorado AI Act apply to companies based outside Colorado? Yes. The CAIA applies to any company that deploys a high-risk AI system to make consequential decisions affecting Colorado residents. A New York company using AI to screen applicants from Denver must comply, as must a San Francisco fintech approving loans for Colorado borrowers. What are the penalties for violating the Colorado AI Act? Violations constitute unfair trade practices under the Colorado Consumer Protection Act. The maximum penalty is USD 20,000 per violation, counted separately for each affected consumer or transaction. An AI system that discriminates against 100 consumers could generate up to USD 2 million in penalties. Is the Colorado AI Act still subject to change? Colorado lawmakers can make amendments during the 2026 legislative session before the June 30 effective date. However, the core framework including developer and deployer obligations and the consequential decision trigger has remained stable. Build compliance around the current text. How does the Colorado AI Act interact with the EU AI Act? The laws share a risk-based philosophy and overlapping concepts, but Colorado focuses specifically on algorithmic discrimination protection for Colorado residents while the EU AI Act covers a broader range of AI risks. Build a unified compliance programme that addresses the specific requirements of each. Conclusion The Colorado AI Act is the United States’ most demanding state-level AI law, and it takes effect on June 30, 2026. The operational requirements, including annual impact assessments, consumer notifications, appeal workflows, and 90-day disclosure obligations, all take time to implement properly. Businesses that align with a recognised AI risk management framework now build both legal protection

About This Law Official Name: Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Trust (AI Basic Act / AI Framework Act), Act No. 20676 Passed by National Assembly: December 26, 2024 Promulgated: January 21, 2025 Enforcement Decree Effective: January 22, 2026 (Presidential Decree No. 36053) Jurisdiction: Republic of Korea. Extraterritorial: applies to any foreign business whose AI activities affect Korean market users. Grace Period: At least one year from January 22, 2026. Fines deferred except for exceptional cases involving serious social harm (loss of life or human rights violations). High-Performance AI Threshold: AI systems trained with cumulative compute of at least 10^26 FLOPs. Roughly 10 times EU AI Act GPAI threshold. Primarily targets global big-tech GPAI operators. High-Impact AI Categories: Employment, healthcare, financial services, public safety, education. Mandatory lifecycle risk management, impact assessments, and compliance reporting. Generative AI Obligation: Any business producing AI-generated content visible to Korean users must notify users in advance and label outputs that may be difficult to distinguish from non-AI content. Governing Ministry: Ministry of Science and ICT (MSIT). National AI Committee (under President). AI Safety Research Institute. Implementation Task Force: AI Basic Act Institutional Improvement Task Force launched March 2026. 40+ experts across industry, academia, civil society. Refining implementation during grace period. Introduction On January 21, 2025, South Korea became the second jurisdiction in the world, after the European Union, to enact comprehensive AI legislation. The Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Trust (Act No. 20676), known as the AI Basic Act or AI Framework Act, was passed by the National Assembly on December 26, 2024, promulgated on January 21, 2025, and took full legal effect on January 22, 2026. Since the Act took effect, MSIT has clarified several key compliance details. The high-performance AI threshold has been confirmed at systems trained with a cumulative compute of at least 10 to the power of 26 floating-point operations (FLOPs), roughly ten times the EU AI Act’s general-purpose AI model threshold. A multi-stakeholder AI Basic Act Institutional Improvement Task Force of more than 40 experts launched in March 2026 to refine implementation during the one-year grace period. This guide breaks down who the Act applies to, the clarified compliance details, and the practical steps foreign SMEs must take before the grace period ends and enforcement fines begin. Why South Korea’s AI Law Is a Landmark Moment for Asia-Pacific Before the AI Basic Act, South Korea had more than 20 separate AI governance bills circulating through the National Assembly. The Act consolidated them into a single unified framework, balancing industrial promotion with safety, transparency, and human rights protection. It is the world’s first comprehensive AI law in the Asia-Pacific region and only the second globally after the EU AI Act. New President Lee Jae-myung has publicly defined AI as a game-changer that will shift the global economic paradigm, presenting it as a core engine for South Korea’s technology-led growth. The government is pairing regulation with significant AI investment: startup support programmes, government-funded training data access, and AI Growth Zones with reduced regulatory requirements. Does the South Korea AI Basic Act Apply to Your Company? The Act applies to both domestic and foreign AI business operators. The foreign company domestic representative requirement is triggered when a company meets any one of three thresholds. For most SMEs, these thresholds mean the domestic representative requirement does not immediately apply. However, High-Impact AI requirements and the generative AI user notification obligation apply to any business operating in Korea regardless of size. High-Impact AI: The Core Compliance Category High-Impact AI is the Act’s central compliance concept: AI systems that may significantly affect human life, safety, or fundamental rights. For High-Impact AI, operators must implement lifecycle risk identification and mitigation, maintain incident monitoring systems, conduct fundamental rights impact assessments before deployment, and report compliance information to MSIT. Operating an AI system in South Korea that may qualify as High-Impact AI, or using generative AI that produces content for Korean users? Book a free compliance assessment. Our team reviews your AI use cases against the Act’s definitions and tells you exactly what obligations apply. The High-Performance AI Threshold: 10 to the Power of 26 FLOPs MSIT confirmed in the Enforcement Decree that AI systems trained with a cumulative compute of at least 10 to the power of 26 floating-point operations (FLOPs) are designated as high-performance AI and subject to additional safety obligations. This threshold is roughly ten times higher than the EU AI Act’s GPAI model computation threshold. This was a deliberate policy choice targeting only the most powerful global AI systems, primarily from US and Chinese big tech companies, while exempting the vast majority of commercially deployed AI. Most SMEs are well below this threshold. The Domestic Representative Requirement Explained Foreign AI business operators that meet the revenue or user thresholds must designate a domestic representative in South Korea and report that designation to MSIT. The representative bears legal accountability for the company’s compliance and must have a domestic Korean address or place of business. The April 2025 amendment to Korea’s PIPA tightened these rules, requiring companies with established Korean business units to designate those units rather than unrelated third-party nominees. Frequently Asked Questions When did the South Korea AI Basic Act take effect? The Act and its Enforcement Decree both took effect on January 22, 2026. A one-year grace period applies to administrative fines, with exceptions for exceptional cases involving serious social harm. Substantive compliance obligations apply from January 22, 2026. What is the high-performance AI FLOPs threshold and does it affect my business? MSIT confirmed the threshold at 10^26 FLOPs of cumulative compute. This primarily affects global frontier AI model developers such as OpenAI, Google, and Anthropic. Most SMEs and mid-size AI companies are well below this threshold. Does the AI Basic Act apply to internal AI tools used by a Korean subsidiary? Yes, if those tools make decisions affecting Korean employees. HR AI systems, performance evaluation

About This Framework Primary Framework: UK AI White Paper: A Pro-Innovation Approach to AI Regulation (DSIT, March 2023). Five cross-sector principles: Safety/security/robustness, Transparency/explainability, Fairness, Accountability/governance, Contestability/redress. DSIT Blueprint (October 2025): Replaces AI Bill as immediate legislative vehicle. Introduces AI Growth Lab: sectoral sandboxes where regulations can be relaxed under licence for approved AI innovators. Data Use and Access Act 2025: Royal Assent June 19, 2025. Bulk of provisions commenced February 5, 2026. New recognised legitimate interests basis for automated decision-making now in force. Section 103 complaints procedure commences June 19, 2026. Deepfake Criminal Law: Crime and Policing Act amendment in force from February 6, 2026. Criminalises creation of sexually explicit deepfake images of adults without consent. Copyright and AI Report: Published March 18, 2026 (required by DUAA 2025). Government maintains status quo on AI/copyright for now. AI Bill Status: As of June 2026, still expected but not introduced. Government deliberately delayed to resolve AI/copyright interaction. Penalties Under Existing Law: UK GDPR: GBP 17.5M or 4% global turnover. FCA, Ofcom, CMA retain separate enforcement powers. Deepfake criminal law: criminal prosecution. Key Regulators: ICO, FCA, Ofcom, CMA, MHRA, AI Security Institute/DSIT. Introduction No single AI law. No risk tiers. No mandatory impact assessments. The UK has deliberately chosen a principles-based, sector-led model rather than following the EU’s comprehensive AI Act approach. As of June 2026, there is still no UK AI Act. But that absolutely does not mean no rules apply to your AI systems. In 2026, UK AI regulation is moving on multiple tracks simultaneously. The Data (Use and Access) Act 2025 commenced in February 2026. A deepfake criminal law took effect on February 6, 2026. The government published the Copyright and AI Report on March 18, 2026. The DSIT Blueprint for AI Regulation, published in October 2025, introduces the AI Growth Lab concept. And a government-backed AI Bill remains expected but has not yet been introduced. This guide explains every active UK AI rule as of June 2026, which sector regulators apply them, and the practical compliance steps your business must take right now. The Current UK AI Framework: What Is Actually In Force The UK’s AI governance landscape as of June 2026 is built on layers rather than a single law. The foundational layer is the five White Paper principles from March 2023: safety/security/robustness, transparency/explainability, fairness, accountability/governance, and contestability/redress. These are not statutory. They are guidance that each sector regulator applies within its own binding framework. The second layer is the Data (Use and Access) Act 2025, in force from February 5, 2026. The most important change for AI businesses: the new recognised legitimate interests lawful basis for automated decision-making means UK GDPR’s ADM rules are now more accessible. The near-blanket prohibition that previously made solely automated decisions difficult to lawfully deploy has been replaced by a legitimate interests framework with genuine human oversight and transparency safeguards. New Laws Already In Force: What Changed in 2026 Three significant developments have changed the UK AI compliance landscape since January 2026. The deepfake criminal law is the most immediate. From February 6, 2026, the Crime and Policing Act amendment makes it a criminal offence to create sexually explicit deepfake images of adults without their consent. Businesses deploying any AI capable of generating such content face direct criminal liability without adequate consent and safety controls. The DUAA automated decision-making framework creates new operational requirements. The new recognised legitimate interests basis for ADM removes the previous consent barrier, but requires genuine human oversight, transparent contestation mechanisms, and a documented balancing test. The Copyright and AI Report (March 18, 2026) confirmed the government’s status quo on AI training data: no text-and-data mining exception was introduced. AI systems trained on copyrighted UK content without licences remain legally exposed. Which Regulator Oversees Your AI? The Sector Guide Unsure which UK regulators apply to your specific AI systems, or whether the new DUAA ADM framework changes your current legal basis for automated decisions? Download our free UK AI compliance readiness guide, updated for June 2026. The DSIT Blueprint and the AI Growth Lab Published October 21, 2025, the DSIT Blueprint for AI Regulation replaced the long-awaited AI Bill as the government’s immediate legislative vehicle. The centrepiece is the AI Growth Lab: a set of sectoral sandboxes where specific regulations can be relaxed under licence for approved AI innovators. For SMEs, the AI Growth Lab represents a genuine opportunity. Approved participants can test AI systems in regulated environments (healthcare, financial services, energy) with temporary relief from specific sector regulations. The DSIT One Year On progress report (January 29, 2026) confirmed 38 of the 50 AI Opportunities Action Plan commitments are met. Your UK AI Compliance Action Plan for 2026 Frequently Asked Questions Does the UK have an AI Act? No. As of June 2026, no comprehensive UK AI Act has been passed. The government’s approach is the DSIT Blueprint and sector-led enforcement of existing law. A government-backed AI Bill is expected to be introduced in 2026, but no timeline has been confirmed. What does the DUAA 2025 change for businesses using automated decision-making? The Data (Use and Access) Act 2025, in force from February 2026, replaced the near-blanket prohibition on solely automated decisions with a recognised legitimate interests framework. Businesses can now more readily use automated decision-making under UK GDPR, but must implement genuine human oversight and transparent contestation mechanisms. Is creating deepfake images now a criminal offence in the UK? Yes, for sexually explicit images of adults. From February 6, 2026, the Crime and Policing Act amendment makes it a criminal offence to create sexually explicit deepfake images without the subject’s consent. Businesses deploying AI image or video generation tools face criminal liability without adequate safeguards. How does UK AI regulation compare to the EU AI Act? The EU AI Act is binding law with fines of up to 7% of global turnover (with high-risk deadlines extended to December 2027 via the Omnibus). UK regulation is principles-based and sector-led with no mandatory AI-specific impact assessment requirement.

About This Framework Official Name: NIST AI Risk Management Framework (AI RMF 1.0), NIST AI 100-1 Published By: National Institute of Standards and Technology (NIST), US Department of Commerce Published: January 26, 2023 Authorising Law: National Artificial Intelligence Initiative Act of 2020 (P.L. 116-283) Binding?: Voluntary. Not law. However, provides affirmative legal defense in Colorado AI Act (June 30, 2026) and Texas TRAIGA (January 1, 2026). Required in US federal government AI procurement. Global Adoption: Referenced in EU AI Act compliance, ISO/IEC 42001, Singapore AI Verify, Australia AI6 framework, UK DSIT guidance, and enterprise vendor questionnaires worldwide. Core Structure: Four functions: GOVERN, MAP, MEASURE, MANAGE. Nine trustworthy AI characteristics. Cost: Free. Full framework, Playbook, and Generative AI Profile available at airc.nist.gov. Latest Version: AI RMF 1.0 (Jan 2023). Generative AI Profile (NIST AI 600-1) published July 2024. Introduction The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary AI governance framework published by the US National Institute of Standards and Technology on January 26, 2023. It was built under the National Artificial Intelligence Initiative Act of 2020, developed over 18 months through a consensus process involving more than 240 organisations from industry, academia, civil society, and government. It is free, flexible, and designed for organisations of any size and sector. In 2026, the NIST AI RMF is referenced as an affirmative legal defence in Colorado’s AI Act and Texas TRAIGA, incorporated into ISO/IEC 42001, and used as the evaluation framework in Singapore’s AI Verify toolkit. Enterprise procurement teams across financial services, healthcare, and government are adding NIST AI RMF alignment to vendor questionnaires. Most SMEs adopt AI tools faster than they build governance around them. If something goes wrong and you cannot show a documented, defensible process for identifying, measuring, and managing AI risk, you are exposed both legally and commercially. The NIST AI RMF fixes that gap with minimal overhead. This guide walks you through the four core functions in plain language, with practical steps you can implement this week, no dedicated compliance team required. Why SMEs Cannot Afford to Ignore AI Governance in 2026 AI systems fail in ways that traditional software does not. A biased training dataset can produce discriminatory hiring outcomes at scale. A hallucinating AI assistant can give customers inaccurate information that creates legal liability. A poorly monitored model can drift over time, quietly degrading decisions in ways no human reviewer notices. For SMEs, the consequences of these failures are disproportionately severe. A single AI-related discrimination claim, a regulatory investigation, or a high-profile customer harm can consume operational resources that a large enterprise would absorb as a rounding error. Critically, 2026 is the year US state AI laws start imposing real compliance burdens. Colorado’s AI Act (effective June 30, 2026) and Texas TRAIGA (effective January 1, 2026) both reference NIST AI RMF alignment as an affirmative defence or safe harbor. Implementing the framework is now both good governance and a legal shield. The 4 Core Functions: Govern, Map, Measure, Manage The NIST AI RMF organises AI risk management into four interconnected functions that work across the AI lifecycle. GOVERN applies continuously across all stages. MAP, MEASURE, and MANAGE apply sequentially as each AI system moves through its lifecycle. The Generative AI Profile (NIST AI 600-1, July 2024) extends the framework to LLMs and foundation model deployments. Trustworthy AI: The 9 Characteristics the Framework Targets The NIST AI RMF defines trustworthy AI through nine characteristics. These are measurable properties, not aspirational values. For an SME starting from scratch, focus first on Valid and Reliable and Accountable and Transparent. These form the foundation for everything else and are the characteristics regulators, clients, and courts are most likely to ask about first. Want a free assessment of where your AI systems stand against the NIST AI RMF criteria, and whether your documentation would satisfy Colorado’s AI Act or Texas TRAIGA affirmative defence requirements? Book a 30-minute consultation and we will walk you through the gaps. Implementing the NIST AI RMF Without a Dedicated Team Why the AI RMF Is Now a Commercial Requirement Colorado’s AI Act (effective June 30, 2026) provides an affirmative defence to organisations complying with a nationally or internationally recognised AI risk management framework. The NIST AI RMF is the primary framework cited. Texas TRAIGA similarly recognises substantial compliance with the NIST AI RMF as a liability shield. ISO/IEC 42001, the international AI management system standard that is rapidly becoming the ISO 9001 of AI, builds on NIST AI RMF principles. Companies that implement the AI RMF now are typically ISO 42001 certification-ready with minimal incremental work. Frequently Asked Questions Is the NIST AI RMF mandatory in the United States? No. The NIST AI RMF is voluntary. However, it is referenced as an affirmative defence in Colorado’s AI Act and Texas TRAIGA, required in US federal government AI procurement, and increasingly demanded by enterprise clients as a condition of vendor approval. How does the Generative AI Profile (NIST AI 600-1) differ from the AI RMF 1.0? The AI RMF 1.0 is the foundational framework for all AI systems. NIST AI 600-1, published July 2024, extends the framework specifically to generative AI and large language models, addressing hallucination, data provenance, and intellectual property risks. How long does it take an SME to implement the NIST AI RMF? A basic implementation covering all four core functions can be completed in 4 to 8 weeks for a small organisation with a handful of AI systems. Ongoing maintenance requires roughly 2 to 4 hours per month. Where can I download the NIST AI RMF? The full AI RMF 1.0, the Playbook, NIST AI 600-1, and all supporting resources are available free at airc.nist.gov. Conclusion The NIST AI Risk Management Framework is the most practical AI governance tool available to SMEs today. In 2026, it is also a legal shield under US state AI laws and a commercial requirement for enterprise vendor relationships. The combination of free availability, legal benefit, and commercial necessity makes implementation an easy