The governance framing that no longer holds
When states began building AI governance programs in 2022 and 2023 — responsible use policies, procurement checklists, ethics review boards — the framing was largely consistent: government as the oversight body, evaluating and constraining risk from private technology suppliers. That framing matched the early deployment model, where a vendor sold an AI product and the state CIO or CISO determined whether to accept it.
That framing is now only partly accurate. Texas has enacted a law that explicitly names governmental agencies as parties subject to disclosure duties when their AI systems interact with residents. Colorado has enacted a law with covered domains that center on access to government services, even if its definition of regulated deployers is not government-specific. In both cases, the operational question for a state agency is no longer only "is this vendor's product acceptable?" but also "what do we owe the residents this system touches?"
The consequence is a compliance gap to audit for: AI systems deployed in production to assist with benefits intake, eligibility screening, or document classification may trigger resident rights that the agency has no current mechanism to satisfy.
What is actually in force
Texas TRAIGA (HB 149, signed by Governor Abbott on June 22, 2025, took effect January 1, 2026. The law explicitly addresses government agency AI tools: any state or local governmental agency (including political subdivisions, but excluding hospital districts and public universities) that makes available an AI system intended to interact with consumers must, before or at the time of interaction, provide a clear and conspicuous disclosure in plain language that the consumer is interacting with AI — without dark patterns, with a hyperlink permitted as one compliant format. The requirement applies to public-facing interactions regardless of whether the AI system is making a consequential decision — the intent to interact with consumers triggers the duty, not the severity of the outcome. A benefits portal chatbot, a virtual assistant on a state agency website, an AI-assisted call-routing system: all potentially require disclosure where they interact with residents and are in use on or after January 1, 2026 in Texas.
HB 149 establishes the Texas Artificial Intelligence Council, which is statutorily required to conduct training programs for state agencies and local governments. The Texas Department of Information Resources provides administrative support to the council, administers the AI regulatory sandbox, and collects agency AI inventory information as part of information resources reviews.
Colorado SB 26-189 (signed act, signed May 14, 2026 and effective January 1, 2027, goes further — but its application to state and local agencies is a live legal question. The law's definition of "deployer" is "a person doing business in Colorado that deploys a covered ADMT." The "person" definition in Colorado's Consumer Protection Act lists individuals, corporations, trusts, partnerships, associations and "any other legal or commercial entity" — it does not explicitly name governmental bodies. Coverage of state and local agencies as deployers is unsettled in the statute itself.
Two signals point toward practical state-agency exposure regardless of how that coverage question resolves. First, the official fiscal note anticipates that Governor's Office of Information Technology staff "may undertake additional work to ensure that covered domains across state agencies comply with the bill and rules adopted by the Department of Law" — official state analysis that treats agency-domain compliance as a plausible planning requirement. Second, contractors, platforms, and vendors that make AI-influenced eligibility determinations on behalf of a state are clearly "persons doing business in Colorado" and plainly in scope as deployers or developers. An agency that outsources benefits screening to an AI-enabled vendor cannot treat the vendor's obligations as irrelevant to its program delivery.
A state or local agency that wants to understand its direct exposure needs a coverage determination from counsel — the AG's rules, currently in a public comment process with a hearing on October 26, 2026, will provide official guidance, and the AG is required to finalize rules by January 1, 2027.
Enforcement status and timing. The AG's authority to enforce SB 26-189 is currently stayed by a federal court order (xAI v. Weiser, D. Colo., No. 1:26-cv-01515, April 27, 2026) that bars enforcement of SB 24-205 or any legislation amending it — which includes SB 26-189 — until the AG completes rulemaking and the court issues a ruling. The AG's office is conducting rulemaking; proposed rules were filed August 11, 2026, an interim draft was published October 6, 2026, and the comment period closes October 26, 2026. Final rules are due January 1, 2027. The stay does not eliminate the statute's obligations — they apply to decisions made on or after January 1, 2027 regardless of enforcement timing — but it affects when the AG can bring an enforcement action. The federal preemption question and the stay's duration remain unresolved. Prudent operators are preparing now.
The obligations that apply to in-scope deployers include three that require operational implementation:
- Pre-use notice. Before using a covered ADMT to materially influence a consequential decision, the deployer must provide clear and conspicuous notice and instructions for obtaining more information. A deployer may comply by maintaining a prominent public notice reasonably accessible at points of consumer interaction, including a nearby link or posting — not necessarily case-specific communication.
- Adverse-outcome explanation. When a covered ADMT materially influences an adverse consequential decision, the deployer must, within 30 days of making the decision, proactively send the consumer: a plain-language description of the decision and the role the covered ADMT played; a simple process to request additional information (including the ADMT name and version, developer identity, and types and sources of personal data used); and an explanation of the consumer's rights. This is a deployer-initiated obligation, not a right the consumer triggers by asking. The explanation must be case-specific; the AG's rules will specify the required content. Trade-secret and fraud-prevention confidentiality limitations apply.
- Meaningful human review. On request, the deployer must provide an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable. The reviewer must be designated by the deployer, have authority to approve, modify, or override a consequential decision, consider relevant available primary evidence, have access to sufficient information to understand the output's intended use, material limitations, and principal factors, be trained to conduct the review, and must not default to the system output. The consumer also has a companion right to request the personal data the ADMT used and to correct factually incorrect data (§6-1-1705(1)(a)(I)).
Where the operational gaps tend to appear
State agencies that deployed AI in the 2023–2025 period generally did so under internal governance policies focused on risk acceptance, vendor due diligence, and responsible use declarations. Those policies may not have specified the operational mechanisms Texas now requires or Colorado will require. Several categories of gap are worth auditing for explicitly.
Interaction disclosure is missing from resident-facing systems. In Texas, every AI system a governmental agency makes available to interact with residents must carry a clear and conspicuous disclosure. Agencies that deployed vendor-supplied chatbots, intake automation, or call-routing AI before January 2026 and did not specify disclosure requirements in the vendor contract may lack compliant notices. Auditing which resident-facing systems include an AI disclosure — and whether the disclosure is present at the start of the interaction, in plain language, without dark patterns — is the first compliance task in the Texas lane.
The platform cannot produce a case-specific explanation. Where an AI-assisted eligibility system produces a score or a flag that feeds into a case management tool without surfacing the contributing factors to a staff reviewer, the operational gap is clear. Colorado's adverse-outcome explanation must describe the role the ADMT played in the specific case — a boilerplate description of how the model works is not sufficient. Producing a case-specific, deployer-initiated explanation within 30 days of an adverse decision may require changes to the platform's output layer, updates to the vendor data contract, or a supplemental workflow connecting the model output to the explanation notice.
Human review is procedural rather than operational. State AI governance policies often declare that a human reviews AI recommendations. What that means in practice varies. In some deployments, a staff member approves an AI recommendation but has no structured access to the factors behind it, no authority pathway to override it through a documented process, and no record of the review outcome. Colorado's statute defines "meaningful human review" to require authority, evidence, training, and active engagement — not the formality of a logged approval. An agency with coverage exposure that cannot document what the reviewer saw, what factors they considered, and how the review was recorded will have difficulty demonstrating compliance on a challenged decision.
Four questions for a compliance audit
A state agency CIO, CISO, or program director reviewing deployed AI against these obligations should work through the following for each production system that touches residents.
1. Does this system trigger a Texas interaction disclosure requirement? If the agency operates in Texas, any AI system made available to interact with consumers requires a clear and conspicuous disclosure before or at the time of interaction, with no exception for non-consequential interactions. Identify every resident-facing AI system in use on or after January 1, 2026 — chatbots, virtual assistants, automated intake tools, call-routing AI — and confirm whether each carries a compliant notice. The disclosure can be delivered via hyperlink.
2. Does this system materially influence a consequential decision in Colorado? Colorado's covered consequential decisions include access to, eligibility for, or compensation related to essential government services and public benefits (including eligibility and renewal determinations), as well as employment, health care, residential real estate, financial and lending services, and insurance. Benefits eligibility screening and determinations affecting housing or employment assistance are likely within scope. Important exclusions: activities relating to fraud prevention (including identity verification, consumer identification, monitoring, and reporting controls required by law) are excluded — so AI fraud-scoring systems deserve a careful scope analysis, not a blanket assumption of coverage. Document routing, summarizing, organizing, and triage tools that do not materially influence the final decision are also likely excluded. Coverage of state agencies as direct deployers under the law is unsettled; agencies should obtain a coverage determination from counsel and document it.
3. Can this system produce a case-specific adverse-outcome explanation within 30 days of the decision? The obligation runs from the decision, not from a resident's request. The deployer must proactively send the explanation. If the current platform cannot surface the role the ADMT played in a specific case, close that gap before January 1, 2027 by modifying the platform, updating the vendor contract to require explanation-capable output, or replacing the system.
4. Is human review actually operational? A meaningful human reviewer, by statute, has authority to approve, modify, or override a consequential decision; considers relevant, available primary evidence; has access to the output's intended use, material limitations, and principal factors; is trained to conduct the review; and does not default to the system output. A review workflow that routes an AI recommendation to a staff member who lacks access to the contributing factors — or whose approval is the only recorded action — does not meet this standard. Documenting the review workflow, identifying where it falls short, and assigning ownership to specific staff roles is the productive use of the 70 days before January.
The vendor contract gap
An agency's potential compliance obligations under these laws do not transfer to its vendor by default. Colorado SB 26-189 imposes statutory obligations on developers regardless of contract: developers must provide deployers with technical documentation on intended uses, categories of training data, known limitations, and instructions for appropriate use and meaningful human review, and must notify deployers of any material update within a reasonable time (§6-1-1702). The duties are statutory, but contracts control delivery timelines, format and remedies — and a contract silent on these points leaves the agency without a reliable pathway to get what it needs.
Agencies renewing AI vendor contracts or soliciting new AI capabilities before January 2027 should add explicit provisions for:
- AI interaction disclosure language and the vendor's obligation to supply it
- Adverse-outcome factor documentation sufficient to support a case-specific, deployer-initiated 30-day explanation
- Human review evidence output: the factors, data sources, and role description that a reviewer and the explanation notice need
- Mandatory notification of any material update to the ADMT model
- Remedies for non-delivery
One additional statutory point: Colorado SB 26-189 §6-1-1707(7) voids contract provisions that indemnify a developer or deployer against liability for damages from their own acts or omissions in violation of the Colorado Anti-Discrimination Act or other Colorado anti-discrimination law. A developer whose ADMT was used in a manner it did not intend and who met the §6-1-1702 documentation requirements is exempt (§1707(7)(b)). Contracts entered before this provision was known to agencies may include indemnification language worth reviewing.
The conversion from governance to compliance
NASCIO's March 2026 Agentic AI report — drawing on the 2025 State CIO Survey — found that 88 percent of states have AI responsible use policies, guardrails, security policies and/or ethics requirements; 84 percent are inventorying and documenting AI uses in agencies or applications; and 82 percent have created advisory committees and/or task forces. That is a substantial governance infrastructure. The report also found, from the 2025 NASCIO–Accenture joint report on GenAI in citizen services, that 75 percent of state CIOs report serious concerns about using generative AI in direct citizen services, with AI accuracy, data security and privacy, and availability of adequate training and support cited most often.
Those concerns are reasonable, and they map directly onto the compliance gap described here. An AI system deployed in direct citizen services without a verified explanation capability, without a functional human review workflow, and without an interaction disclosure mechanism is not just a governance concern — it is a compliance deficit under laws that are in force or taking effect January 1, 2027 for in-scope deployers.
What would change the analysis: final AG rules, the outcome of the xAI v. Weiser proceeding, and any AG formal position on whether public entities are covered deployers under Colorado's CCPA-anchored framework. Agencies operating under genuine legal uncertainty about direct Colorado exposure can still take the prudent-operator path: audit which systems are in the covered domains, confirm whether vendors meet the developer documentation obligations, and close the explanation and review gaps that will matter regardless of how the coverage question resolves.
The state agencies that will be better positioned in January are not necessarily those with the most formal AI governance programs. They are the ones that converted their AI inventory from a documentation exercise into an operational compliance audit this fall — identifying which deployments are in scope or potentially in scope under applicable law, which meet the notice and review requirements, and which need remediation before the deadline.
Sources and further reading
- Colorado SB 26-189, Automated Decision-Making Technology, signed act (Session Law ch. 131): https://leg.colorado.gov/bill_files/116489/download
- Colorado SB 26-189, bill page: https://leg.colorado.gov/bills/sb26-189
- Colorado SB 26-189, Final Fiscal Note, Legislative Council Staff, September 8, 2026: https://leg.colorado.gov/bill_files/117715/download
- Texas Responsible AI Governance Act (TRAIGA), HB 149, signed June 22, 2025, effective January 1, 2026: https://capitol.texas.gov/tlodocs/89R/billtext/pdf/HB00149F.pdf
- NASCIO, "Beyond Generation: The Rise of Agentic AI in State Government," March 2026: https://www.nascio.org/wp-content/uploads/2026/03/NASCIO_Agentic-AI-Report_2026_.a11y.pdf
- Colorado AG AI rulemaking page: https://coag.gov/ai/
- Ropes & Gray, "Navigating TRAIGA: Texas's New AI Compliance Framework," June 2025: https://www.ropesgray.com/en/insights/alerts/2025/06/navigating-traiga-texas-new-ai-compliance-framework
- multistate.ai, State AI Legislation Tracker 2026 (further reading): https://www.multistate.ai/artificial-intelligence-ai-legislation
Spartan X has advised Colorado state technology leadership on AI strategy and governance. Arbiter, the company's AI verification platform, produces auditable, evidence-backed verification records — confidence-scored assessments with supporting evidence and audit trails — that can support a reviewer's workflow and the documentation requirements that these laws require deployers to maintain. Agencies working to close the explanation and human review gaps in existing deployments will find that adding an inspectable verification layer to current systems is a more tractable path than rebuilding a platform from scratch.
