Fate of Colorado’s Artificial Intelligence Act & More Developments
Artificial Intelligence Briefing
This month’s briefing covers the uncertain fate of Colorado’s AI Act, while Illinois restricts AI chatbots in mental health clinical decision making. Meanwhile, a U.S. House subcommittee is investigating Hertz’s AI damage assessment system. And California’s Automated Decisions Safety Act will be considered by the full state senate, with a September 12 deadline for passage looming. Read on for a deeper dive into these and more key updates.
Regulatory, Legislative & Litigation Developments
Fate of Colorado’s Artificial Intelligence Act Remains Uncertain
After proposed amendments to Colorado’s landmark AI Act — previously discussed here and here — stalled during the 2025 legislative session, Governor Jared Polis called a special session to address, among other topics, concerns over the law’s implementation and fiscal impact. During the special session, lawmakers could not reach consensus on a compromise and instead passed an amendment delaying the effective date until June 30, 2026. The legislature will reconvene on January 14, 2026, but it remains to be seen whether it will revisit negotiation of a compromise amendment, allow the law to take effect in its current form on June 30, or continue to delay implementation. Federal action could also impact the law if Congress restricts state-level AI regulation.
Colorado Adopts Amended Governance Regulation
On August 20, 2025, the Colorado Division of Insurance adopted Amended Regulation 10-1-1, which previously imposed governance and risk management framework requirements only on life insurers that use external consumer data and information sources. The amended regulation extends those requirements to private passenger auto and health benefit plan insurers, who must submit preliminary progress reports by December 1, and full compliance reports by July 1, 2026. For more details, check out our client alert.
Congressional Investigation Into Hertz’s AI Damage Assessment System
House Oversight Subcommittee Chair Nancy Mace (R-S.C.) is investigating Hertz Global Holdings’ use of UVeye AI scanning technology for vehicle damage assessments, citing concerns about the company’s fully automated process that operates without human review. The technology, currently deployed at six U.S. airport locations with plans to expand to approximately 100 locations, scans vehicles before and after rental periods to identify damage and automatically generate billing assessments. Unlike other rental companies that use AI as a tool but require human review before billing customers, Hertz appears to be the only major U.S. car rental company issuing damage assessments through a completely automated process. The investigation raises questions about consumer protection, transparency in AI-driven financial assessments, and potential implications for federal agency procurement practices when renting vehicles for official business. Subcommittee Chair Mace has requested a staff briefing from Hertz CEO Gil West to better understand the company’s experience with this AI technology and its expected consumer benefits.
Illinois Restricts AI Chatbots in Mental Health Clinical Decision-Making, Emphasizing Human Oversight
Illinois recently enacted the “Artificial Intelligence Clinical Decision-Making Prohibition Act,” which specifically prohibits the use of AI-powered chatbots to make clinical decisions in mental health services. Under this law, only licensed mental health professionals can diagnose, treat or determine care plans, while chatbots may assist with administrative tasks but cannot replace human judgment in patient care. The act was driven by concerns about the accuracy, privacy and safety of AI systems in sensitive clinical settings and applies to all mental health providers and organizations in Illinois. The Illinois law marks a significant step in regulating the use of generative AI in mental health, highlighting the importance of human oversight and the growing scrutiny of AI’s role in clinical decision making.
AI Bill Advances in California Legislature
On September 5, 2025, the California Senate made changes to AB 1018, which would impose new requirements on developers and deployers of automated decision systems used to make certain consequential decisions. (“Consequential decision” is defined as a decision that materially impacts the cost, terms, quality or accessibility of employment, education, housing, utilities, family planning, health care, financial services, legal services, criminal justice, government benefits, public accommodations, insurance and telecommunications.) Developers would be required to conduct impact assessments that include an evaluation of whether disparate impact is reasonably likely to occur. Deployers would be required to provide disclosures relating to automated decisions and provide an opportunity to appeal. The bill will be considered by the full senate, with a September 12 deadline for passage looming.
NIST Concept Paper on AI Cybersecurity
On August 14, 2025, the U.S. National Institute of Standards and Technology (NIST) released a concept paper and proposed action plan for utilizing and expanding controls under NIST Special Publication (SP) 800-53 to account for AI-related cybersecurity risk. NIST’s goal is to create a series of control overlays that organizations can use to better manage cybersecurity risks in AI use and development, and proposes five initial use cases, including controls for adapting and using generative AI and for using AI agent systems. The purpose of the paper is to solicit feedback about the use cases, the prioritization of development of controls, and any other areas for potential future work. As an August 2025 article in CSO Online argues, NIST’s efforts are sensible but face several challenges, including organizational visibility into the scope of AI usage in a company and its risk, the success of existing cybersecurity tools in detecting AI-related threats, and even the risk that AI agents could “poison” feedback to NIST’s concept paper by flooding it with self-serving comments and suggestions.
In Case You Missed It
The material contained in this communication is informational, general in nature and does not constitute legal advice. The material contained in this communication should not be relied upon or used without consulting a lawyer to consider your specific circumstances. This communication was published on the date specified and may not include any changes in the topics, laws, rules or regulations covered. Receipt of this communication does not establish an attorney-client relationship. In some jurisdictions, this communication may be considered attorney advertising.
Meet the Authors
