AI Transparency Disclosure

State of play.

• Colorado has executed a full policy reversal, repealing its landmark 2024 comprehensive AI Act and replacing it with a narrower disclosure-and-transparency regime focused on automated decision-making technology — effective January 1, 2027, enforced only by the AG, with no private right of action .
• The EU Digital Omnibus trilogue deal has been struck, provisionally amending the AI Act and postponing key high-risk AI compliance deadlines set to hit August 2, 2026 — and the European Commission's draft guidelines interpreting which AI systems qualify as high-risk under Article 6 remain open for stakeholder comment through July 23, 2026 .
• The Trump administration has demonstrated willingness to restrict AI model access on national security grounds without disclosed statutory authority, forcing Anthropic to disable foreign access to Fable 5 and Mythos 5 after Amazon raised concerns with U.S. officials — with Anthropic publicly criticizing the action as lacking transparency and due process .
• Anthropic has escalated from general transparency advocacy to proposing formal binding regulatory rules, with CEO Dario Amodei's "Policy on the AI Exponential" calling for government authority to block systems that fail safety assessments — a meaningful shift in how frontier labs engage with disclosure and governance policy .
• Google DeepMind has formalized AI readiness as a dedicated executive function, appointing Lila Ibrahim as its first chief AI readiness officer to lead government engagement, public communication, and responsible deployment — signaling that major labs now treat transparency and societal readiness as a structural compliance obligation rather than a communications function .
• For counsel advising employers, deployers, or developers operating across multiple jurisdictions, the operative picture is a diverging patchwork — Colorado retreating to disclosure-only, the EU's August 2026 deadline in flux, a new federal enforcement vector emerging through informal national security pressure, and frontier labs now actively shaping the binding-rules agenda — making jurisdiction-by-jurisdiction compliance mapping the immediate priority.

Where things stand.

• Colorado's new ADMT law displaces the 2024 Act entirely. SB 26-189, signed May 14, 2026, narrows the regulatory focus to automated decision-making technology used in consequential decisions — hiring, housing, lending, health care, insurance, education, government services. Developers must provide technical documentation; deployers must give pre-use and post-adverse-decision notice, retain records for three years, and allow data correction and human review. The 60-day cure window before AG enforcement begins is the key remediation lever .
• EU AI Act compliance timelines are in active flux. The provisional Digital Omnibus trilogue agreement adjusts transparency and documentation requirements and modifies sandbox and conformity procedures, but the specific deadline extensions remain undisclosed pending formal Parliament and Council adoption — leaving companies with EU-facing high-risk AI systems in compliance-planning limbo against the original August 2, 2026 deadline .
• The European Commission's draft high-risk AI classification guidelines are open for comment through July 23, 2026. Though non-binding, the Commission has stated they will reflect its enforcement interpretation of Article 6 of Regulation (EU) 2024/1689 — covering biometrics, critical infrastructure, education, employment, migration, law enforcement, and justice. The high-risk classification triggers conformity assessments, documentation, and human oversight requirements, with compliance deadlines beginning December 2, 2027 for most standalone systems .
• A new informal federal enforcement vector has emerged for AI model access. The Anthropic episode — where Amazon's concerns with U.S. officials triggered restrictions on Fable 5 and Mythos 5 without disclosed statutory authority — signals that national security grounds can be invoked to restrict model deployment, with private platform companies potentially serving as the catalyst .
• Frontier labs are now actively advocating for binding regulatory frameworks, not merely engaging with them. Anthropic's June 2026 policy framework proposes formal testing thresholds and government authority to block failing systems — a posture that, if adopted as a template, would reshape disclosure and pre-deployment assessment obligations industry-wide .
• Major AI developers are institutionalizing transparency and readiness functions at the executive level. Google DeepMind's creation of a chief AI readiness officer role — overseeing frontier AI affairs, public engagement, and responsibility — reflects intensifying pressure on labs to demonstrate structured governance to regulators and stakeholders .
• Workplace AI enforcement is multi-jurisdictional and employer-side liability is settled doctrine. Under existing anti-discrimination law, employers bear responsibility for AI-driven employment decisions regardless of whether a vendor built the tool or a human made the final call; the EEOC and state regulators in Illinois, New York City, Colorado, and California are all active .
• State disclosure laws remain the operative baseline across multiple vectors. California's transparency and training-data disclosure requirements took effect January 1, 2026; more than two dozen states are enacting or advancing AI regulation, with the FTC and state AGs positioned as primary enforcers .
• Federal preemption is the administration's stated goal, not yet law. The March 2026 National Policy Framework and the December 2025 EO directing agencies to identify conflicting state laws define the posture — but no legislation has passed, and states continue advancing their own regimes in the interim .
• AI governance is becoming operational infrastructure. Enterprise vendors and regulators are building runtime enforcement and continuous monitoring into AI systems; the 2026 compliance landscape is expected to include inventory requirements, risk assessment protocols, vendor review processes, and continuous monitoring for high-risk and agentic AI systems — though the binding legal framework has not yet solidified .
• AI-generated code quality is an emerging governance and liability gap. OpenClaw founders have warned that agentic AI tools are producing "vibe slop" — code that appears functional but contains bugs, security vulnerabilities, and maintainability problems — with governance and quality control underdeveloped as enterprises scale AI code generation into production .

Latest developments.

• Google DeepMind appointed Lila Ibrahim as its first chief AI readiness officer, formalizing AI preparedness, public engagement, and responsible deployment as a dedicated executive function — a structural signal that leading labs are treating regulatory transparency and societal readiness as a compliance obligation .
• Anthropic released a comprehensive policy framework anchored in CEO Dario Amodei's "Policy on the AI Exponential," proposing binding regulatory rules and formal testing thresholds for frontier AI models, including government authority to block systems that fail safety assessments — marking a shift from transparency advocacy to active rule-shaping .

Active questions and open splits.

• Colorado's disclosure-only model vs. more demanding state frameworks — which template prevails. Colorado's retreat from audit-heavy requirements signals that industry pressure can reshape comprehensive AI statutes; whether other states follow Colorado's lighter-touch model or advance more prescriptive approaches is the live question for multi-state compliance planning .
• Developer vs. deployer liability allocation under the new ADMT regimes. Colorado's SB 26-189 allocates liability based on relative fault between developers and deployers. How courts and the AG will apportion responsibility when a vendor's tool produces an adverse outcome — and what indemnification and audit-rights provisions in vendor contracts must now say — is unresolved .
• EU AI Act compliance planning against a moving deadline. The Digital Omnibus deal defers obligations but the final text is not yet adopted, and the Commission's draft high-risk classification guidelines remain open for comment — companies must decide whether to continue preparing for August 2, 2026 or pause investment pending formal adoption, while the July 23 consultation deadline offers a narrow window to influence enforcement interpretation .
• The statutory basis and due process limits of informal AI model access restrictions. The Anthropic episode raises unresolved questions about what authority the administration can invoke to restrict model deployment, whether affected companies have procedural recourse, and whether large platform investors can informally trigger government enforcement against competitors .
• Whether frontier-lab binding-rules proposals become the regulatory template. Anthropic's June 2026 framework proposes pre-deployment testing thresholds and government blocking authority — if other labs adopt similar frameworks or regulators treat them as a baseline, the disclosure and assessment obligations they embed could harden into de facto standards before any legislation passes .
• What qualifies as a covered "automated decision-making tool" under state regimes. Both Colorado and other state frameworks leave the boundary of covered systems to be defined through implementation and litigation — whether tools that assist rather than determine decisions are covered, and how human-in-the-loop configurations affect coverage, will drive the first wave of enforcement disputes .
• Workplace AI bias enforcement standard of care. The EEOC and state regulators are watching but the precise legal triggers for liability in individual cases have not yet crystallized — meaning the first enforcement actions will define what audit, validation, and explainability obligations actually require in practice .

What to watch.

• Formal Parliament and Council adoption of the EU Digital Omnibus — the adopted text will disclose which high-risk AI deadlines are deferred and by how long, resolving compliance-planning limbo for companies with EU-facing operations before the original August 2, 2026 deadline.
• The July 23, 2026 close of the European Commission's consultation on draft high-risk AI classification guidelines — the final guidelines will directly shape enforcement interpretation of Article 6 and are the last meaningful opportunity for companies to influence the classification framework before it hardens.
• Whether the administration discloses the statutory authority underlying the Anthropic model restrictions — and whether similar restrictions follow for other frontier models or foreign-accessible AI systems.
• Whether Anthropic's binding-rules framework draws responses from other frontier labs — if Google DeepMind, OpenAI, or Meta publish comparable proposals, the convergence could accelerate regulatory adoption of pre-deployment testing thresholds as a disclosure baseline.
• The first EEOC or state AG enforcement action against an employer for AI-driven employment decisions — the outcome will define the standard of care for audit, validation, and explainability obligations across all jurisdictions.
• Whether the White House's federal preemption push produces draft legislation — and whether the scope language reaches disclosure-only statutes or remains targeted at bias-mitigation mandates.