The AI Rule You Built For Just Got Repealed

In May, Colorado repealed an AI law before it ever took effect.

The state's 2024 AI Act was scheduled to come into force on June 30, 2026. Instead, it was repealed and replaced by Senate Bill 26-189, signed into law on May 14, 2026 – weeks before the original would have bound anyone. If your firm spent the last year building toward that deadline, the deadline is gone – and not because you finished the work; the work simply stopped being required.

That's a strange new failure mode, and it's worth naming clearly. (None of what follows is legal advice – it's a read on ground that's shifting faster than the advice can keep up.) For two years the compliance task was "keep up with the new AI rules." The task now includes something harder: keep up with the AI rules that are being unwound.

The target is moving in both directions at once

Colorado isn't an isolated reversal – the whole regulatory map is pulling apart at the seams.

At the federal level, a December 2025 executive order directs the Justice Department to move to pre-empt certain state AI laws – an attempt to override the state-by-state patchwork from the top. Whether that pre-emption ultimately holds is contested and will be litigated; the point for planning is that the question is now open. Meanwhile other regimes kept tightening: California's CCPA rules on automated decision-making technology took effect January 1, 2026, and the EU AI Act's high-risk obligations are still widely reported to land in August 2026. So a firm operating across jurisdictions is simultaneously preparing for new obligations, watching others get repealed, and waiting to learn whether a federal action erases a category of state law entirely.

You can see the same whiplash outside AI specifically. The Corporate Transparency Act's beneficial-ownership reporting requirement collapsed from an estimated 32.6 million reporting entities to roughly 20,000 after it was narrowed to foreign companies – a near-total reversal of who the rule even applies to. Firms that built onboarding workflows for the original scope built for a world that no longer exists.

Why "track the new rules" is no longer enough

The old compliance posture assumed regulation accreted. Rules got added; you tracked the additions and adjusted. The instability changes the shape of the work, because now a rule you've already operationalized can vanish, narrow, or get pre-empted – and that costs real money too. Capability stood up for a requirement that evaporates is sunk cost. A control loosened on the assumption a rule was coming, when it then doesn't, is exposure. Both the addition and the subtraction now carry risk.

For boutique advisory firms whose clients lean on them to make sense of this, that's actually an opening. When regulation only accreted, regulatory intelligence was a tracking service – useful, commoditized. When the rules reverse unpredictably, the value moves to judgment: not just "here's the new rule," but "here's a rule that's likely to be repealed, so don't over-invest yet," and "here's one being pre-empted, so the state version may not matter," and "here's one that's stable enough to build on." That read – stability, direction, and likely reversal, not just existence – is the thing a tracker can't sell and a thinking advisor can.

Building for instability

The practical shift is to treat the regulatory map as a live, directional thing rather than a checklist.

Track trajectory, not just status. For each rule that matters, the useful question isn't only "is this in effect" but "which way is this moving – tightening, loosening, likely to be pre-empted, likely to be repealed?" That's what tells a client whether to build now or wait.

Stage your compliance investment to the uncertainty. Where a rule is stable, operationalize it. Where it's contested or likely to reverse, prefer reversible, low-sunk-cost measures until the picture clears. Building heavy infrastructure for a rule that gets repealed before its effective date is the new way to waste a budget.

Separate the durable from the volatile. Some obligations – core privacy, data protection, honest disclosure – are stable across the churn. Others are political and fast-moving. Knowing which is which is most of the work, and it's exactly the judgment clients can't get from a regulatory newsletter.

The old skill was keeping up with what's required. The new one is reading a map that's being redrawn while you stand on it. The firms that can tell their clients which lines are drying and which are about to be erased will be worth far more than the ones still just reporting what the lines say today.