Cybersecurity and Data Privacy

The Uncertain Future of State AI Regulation: Lessons from xAI v. Colorado

Author: Stefanie Brody
April 28, 2026

Artificial intelligence is increasingly embedded in decisions that affect people’s lives: hiring, lending, insurance, healthcare, and housing. That raises real questions about accountability, transparency, and discrimination. But AI as a commercial technology is still in its early stages, and legislators, regulators, and courts are still working to understand both its capabilities and its risks. X.AI LLC v. Weiser, an early major constitutional challenge to a comprehensive state AI law in which the United States has now intervened, illustrates just how unsettled the regulatory landscape remains.[1]

The Current Regulatory Landscape

Existing legal frameworks do apply to AI-driven decisions. Federal anti-discrimination statutes—Title VII, the Fair Housing Act, the Equal Credit Opportunity Act (“ECOA”)—do not contain an exception for algorithmic decision-making.[2] Regulators have affirmed as much. For example, the Consumer Financial Protection Bureau (“CFPB”) has addressed ECOA adverse-action obligations for credit decisions based on complex algorithms, including AI or machine learning; the Equal Employment Opportunity Commission (“EEOC”) has addressed automated employment selection tools under Title VII; and the Federal Trade Commission (“FTC”), Department of Justice (“DOJ”) DOJ, CFPB, and EEOC have jointly warned that automated systems remain subject to existing civil-rights, consumer-protection, and competition laws.[3]

But these general frameworks were not purpose-built for AI and some have argued that existing tools are insufficient.

Colorado Goes First

In the absence of an enacted comprehensive federal AI statute, states have moved to address perceived gaps. Colorado was the first state to enact a comprehensive AI law. Senate Bill 24-205, signed in May 2024, requires developers and deployers of “high-risk” AI systems to use reasonable care to prevent “algorithmic discrimination” in consequential decisions affecting employment, education, lending, healthcare, housing, insurance, legal services, and government services. The law imposes developer documentation and disclosure duties, deployer risk-management and impact-assessment obligations, consumer-facing disclosures, and Attorney General enforcement as an unfair-trade-practice regime with civil penalties of up to $20,000 per violation. Notably, the statute excludes from “algorithmic discrimination” certain offers, licenses, or uses of a high-risk AI system by a developer or deployer for the sole purpose of self-testing or expanding an applicant, customer, or participant pool to increase diversity or redress historical discrimination.[4]

The law has faced headwinds since enactment. Governor Polis signed it but expressed reservations, calling on the legislature to revise it before it took effect. SB25B-004 later delayed the effective date from February 1, 2026, to June 30, 2026. In March 2026, the Colorado AI Policy Work Group released a revised policy framework. As of April 27, 2026, no enacted replacement had displaced SB24-205 as delayed by SB25B-004. Attorney General Weiser had initially supported moving forward with rulemaking, but he later joined Governor Polis and Senate Majority Leader Robert Rodriguez in acknowledging that the law needed additional clarity and improvements before implementation.[5]

The Constitutional Challenge

On April 9, 2026, xAI filed suit seeking to enjoin SB 24-205. The complaint pleads six counts organized around four broad constitutional objections: (1) First Amendment challenges to the statute’s substantive and disclosure obligations; (2) Commerce Clause and extraterritoriality challenges; a (3) due-process vagueness challenge; and (4) an Equal Protection challenge to the diversity carve-out. xAI alleges, among other things, that the statute burdens protected expression by regulating model design, training, outputs, and disclosures. It also challenges the law for reaching development and deployment activity outside Colorado, using vague terms such as “algorithmic discrimination,” and exempting favored forms of differential treatment while imposing liability on others.[6]

On April 24, 2026, the United States intervened, with its complaint in intervention focused on Equal Protection. The government argues that the law compels demographic-conscious engineering to avoid disparate-impact liability, effectively requiring discrimination on the basis of race, sex, and religion. The government further argues that the diversity carve-out authorizes intentional differential treatment without the compelling interest or narrow tailoring required under Students for Fair Admissions v. Harvard (2023) and related precedent.[7]

What This Means Beyond Colorado

Several of the constitutional issues in this case arise from specific features of Colorado’s statute, including its broad definitions, the diversity carve-out, and the degree to which it regulates upstream development rather than discrete deployment decisions. AI regulation in other forms, including more targeted laws addressing AI in specific contexts like employment or lending, may not implicate the same questions. But other theories raised here could have far-reaching implications for any form of AI-specific regulation. The argument that AI model training constitutes protected expression under the First Amendment, if adopted, would be especially significant.

AI regulation is in its early stages, just as the technology itself is. Existing frameworks provide a foundation, but whether they are sufficient (and what purpose-built regulation should look like) are questions that legislatures, regulators, and courts are actively working through. We expect constitutional challenges to follow AI legislation wherever it emerges. Key developments to watch include any preliminary-injunction motion or stay-related order, whether Colorado acts before June 30, and how other states respond.[8]

We are monitoring developments in this case and in AI regulation more broadly, and will provide updates as the law develops.

[1] Complaint for Declaratory and Injunctive Relief, X.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo. filed Apr. 9, 2026), ECF No. 1, available at https://clearinghouse.net/doc/170419/; Order Granting United States of America’s Unopposed Motion to Intervene, X.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo. Apr. 24, 2026), ECF No. 16; United States of America’s Complaint in Intervention, X.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo. Apr. 24, 2026), ECF No. 17, available at https://www.justice.gov/crt/media/1437846/dl; docket available at https://www.courtlistener.com/docket/73171074/x-ai-llc-v-weiser/.

[2] Title VII of the Civil Rights Act of 1964, 42 U.S.C. §§ 2000e–2000e-17, available at https://uscode.house.gov/view.xhtml?path=/prelim@title42/chapter21/subchapter6&edition=prelim; Fair Housing Act, 42 U.S.C. §§ 3601–3619, available at https://uscode.house.gov/view.xhtml?path=/prelim@title42/chapter45/subchapter1&edition=prelim; Equal Credit Opportunity Act, 15 U.S.C. §§ 1691–1691f, available at https://uscode.house.gov/view.xhtml?path=/prelim@title15/chapter41/subchapter4&edition=prelim.

[3] See, e.g., Consumer Financial Protection Circular 2022-03, Adverse Action Notification Requirements in Connection with Credit Decisions Based on Complex Algorithms (May 26, 2022), available at https://www.consumerfinance.gov/compliance/circulars/circular-2022-03-adverse-action-notification-requirements-in-connection-with-credit-decisions-based-on-complex-algorithms/;; Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems (Apr. 25, 2023), available at https://www.ftc.gov/system/files/ftc_gov/pdf/EEOC-CRT-FTC-CFPB-AI-Joint-Statement%28final%29.pdf; see also 15 U.S.C. § 45(a)(1); EEOC, EEOC Launches Initiative on Artificial Intelligence and Algorithmic Fairness (Oct. 28, 2021), available at https://www.eeoc.gov/newsroom/eeoc-launches-initiative-artificial-intelligence-and-algorithmic-fairness.

[4] Colo. Rev. Stat. §§ 6-1-1701(1), (3), (9), 6-1-1702, 6-1-1703, 6-1-1704, 6-1-1706; id. § 6-1-112(1)(a); S.B. 24-205, 74th Gen. Assemb., Reg. Sess. (Colo. 2024), available at https://leg.colorado.gov/bills/sb24-205.

[5] Letter from Governor Jared Polis to the Members of the Seventy-Fourth General Assembly (May 17, 2024) (expressing reservations and requesting revisions to S.B. 24-205), available at https://governorsoffice.colorado.gov/governor/news/mayor-johnston-governor-polis-attorney-general-weiser-senator-bennet-congressman-neguse; Statement from J. Polis, Governor, State of Colo., P. Weiser, Att’y Gen., State of Colo., and R. Rodriguez, Senate Majority Leader, Colo. Gen. Assemb. (June 13, 2024), available at https://newspack-coloradosun.s3.amazonaws.com/wp-content/uploads/2024/06/FINAL-DRAFT-AI-Statement-6-12-24-JP-PW-and-RR-Sig.pdf; S.B. 25B-004, 75th Gen. Assemb., Extraordinary Sess. (Colo. 2025) (extending effective date to June 30, 2026), available at https://leg.colorado.gov/bills/sb25b-004; Colo. Governor’s Office, Colorado Artificial Intelligence Policy Workgroup Delivers Unanimous Support for Revised Policy Framework (Mar. 17, 2026), available at https://governorsoffice.colorado.gov/governor/news/colorado-artificial-intelligence-policy-workgroup-delivers-unanimous-support-revised-policy.

[6] Complaint for Declaratory and Injunctive Relief ¶¶ 1–11, 178–201, X.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo. Apr. 9, 2026), ECF No. 1, available at https://clearinghouse.net/doc/170419/.

[7] United States of America’s Complaint in Intervention ¶¶ 5–10, 53–72, X.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo. Apr. 24, 2026), ECF No. 17, available at https://www.justice.gov/crt/media/1437846/dl; Students for Fair Admissions, Inc. v. President & Fellows of Harvard College, 600 U.S. 181 (2023), available at https://www.supremecourt.gov/opinions/22pdf/20-1199_hgdj.pdf.

[8] See, e.g., Joint Motion to Vacate Scheduling Conference and Suspend Case Deadlines and Stipulation to Temporarily Stay Enforcement, X.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo. Apr. 24, 2026), ECF No. 18; Order Referring Motion, id., ECF No. 20; docket available at https://www.courtlistener.com/docket/73171074/x-ai-llc-v-weiser/.