Deadlines shift, data obligations don't

Deadlines shift, data obligations don't

Year-end planning for 2027 AI compliance meets a picture in which the timing moves but the substance of the obligations holds: the EU has, according to an IAPP listing, pushed high-risk AI obligations to December 2027, while Colorado's narrower replacement law and California's automated decisionmaking technology rules both take effect on 1 January 2027. Whichever date applies, all the regimes point to the same underlying demand — that organizations be able to document the data and systems their AI use rests on.

The deadline picture right now

According to IAPP's listing for the web conference "AI governance starts with your data" (IAPP), the EU has delayed high-risk AI obligations to December 2027. The same source states that Colorado repealed its AI Act and replaced it with a narrower law taking effect on 1 January 2027 — the same day California's automated decisionmaking technology (ADMT) rules begin to apply.

The sourcing deserves a clear flag: the IAPP listing is sponsored by the company Exterro, which sells data governance tools, and the EU delay and Colorado repeal are not corroborated by independent sources here. Coblentz Patch Duffy & Bass, however, does confirm the California date: their attorney alert (JDSupra) states that the CPPA's ADMT rules take effect on 1 January 2027, consistent with the IAPP listing.

The consequence for planning is the same regardless of where you place the probability: organizations that built their plans on the EU's original timeline or Colorado's original AI Act must recalibrate — but the new dates still sit within a horizon where preparation has to start now.

The US baseline: the states carry the weight

The Coblentz alert sketches the basic picture for US compliance: there is still no federal AI statute, but more than 60 state laws now regulate various aspects of commercial AI, and there is already substantial litigation over business use of AI tools.

The sitting administration is challenging state laws and pressing Congress to preempt them. According to Coblentz, that effort has so far displaced no state laws. For practical planning, that means the state level remains the operative compliance baseline. A federal solution could change this in the future, but today no organization doing business in the United States can ignore the state rules.

The mechanics of California's ADMT rules

The Coblentz alert describes the concrete requirements of California's CCPA rules for automated decisionmaking technology, effective 1 January 2027. According to the alert, they apply to businesses using automated technology to make — or substantially replace human judgment in — significant decisions about California residents, in the sectors of employment, lending, housing, education, healthcare and essential services. Coblentz sets this standard in contrast to Colorado's broader trigger, discussed below.

According to the alert, the requirements include:

• Published pre-use notices before the technology is deployed.
• Functional opt-out and access workflows — that is, not just a policy, but real mechanisms residents can actually use.

In addition, the IAPP listing states that California now requires risk assessments before a business processes sensitive personal information or uses ADMT for significant decisions. That is an upfront obligation: the assessment must be complete before the use happens, not afterward.

Notice what these requirements presuppose. Pre-use notices require knowing exactly where ADMT is used and for what. Opt-out workflows require mapping what data the system works with and how it flows. Pre-use risk assessments require a clear picture of the data foundation. None of these deliverables can be produced without a current, classified inventory of data and systems.

Colorado: an undefined key term

Here lies one of the most legally significant open questions in the material. According to Coblentz, "materially influences" is a key term in Colorado's proposed SB 26-189, but the bill does not define it. The scope of the term is therefore unsettled: how much influence over a decision is needed before a system falls under the rule is not fixed in the statutory text.

This distinguishes Colorado from California. While California's ADMT rules, per the Coblentz alert, attach to systems that make or substantially replace human decisions, Colorado's "materially influences" could in principle also capture systems that merely influence a decision. Coblentz notes that the state's attorney general has asked for comments on precisely these competing standards — meaning the choice between a broad and a narrow trigger is an open question in the rulemaking process.

The outcome matters directly for scope: a standard that captures systems influencing decisions hits substantially more use cases than one that only captures systems with a more delimited role.

One point deserves emphasis: the relationship between the enacted narrower replacement law described in the IAPP listing and the proposed SB 26-189 that Coblentz discusses cannot be determined from the available sources. They may refer to different stages or different instruments. Readers should therefore treat Colorado's final regime as not yet settled — and follow the comment process at the attorney general's office, where the outcome of the "materially influences" question will likely be decided.

The data layer: what the EU AI Act actually requires

This is where the two sides of the Atlantic meet. The IAPP listing summarizes the EU AI Act's data governance requirements: providers of high-risk systems must govern training, validation and testing data, including where the data comes from, and whether it is relevant, representative and as error-free as possible.

The formulation is worth unpacking. There are four distinct documentation requirements:

1. Provenance — where each data record originates.
2. Relevance — that the data actually belongs to the task the system is meant to solve.
3. Representativeness — that it covers the population or scenarios the system encounters.
4. Error levels — documentation of how error-free the data is, and how errors have been handled.

These are not requirements met with a policy document. They require traceable data flows, classification of datasets by purpose and sensitivity, and a mechanism for updating the inventory when data or systems change. And while they formally target providers of high-risk systems in the EU regime, any organization documenting compliance — its own or a vendor's — will quickly find it needs the same underlying data.

The IAPP session is organized around a simple thesis: AI governance programs stall without a current, classified data inventory. Whatever the sponsorship arrangement, the thesis is consistent with what both the EU regime and the US state rules actually presuppose.

Why inventory is the deadline-proof work

Put the three regimes side by side:

The dates can change again — the EU delay shows that they do. But the data obligations move in the opposite direction: every single rule variant, from the EU's data governance duties to California's risk assessments, depends on the organization being able to point to which data lies behind which systems, what it is used for, and how sensitive it is.

That is why a current, classified data inventory is the work that survives every deadline change. It is needed equally whether Colorado's standard turns out broad or narrow, whether the EU's December 2027 date holds, and whether the federal preemption effort stays fruitless or not. If preemption ever does invalidate state laws, the inventory work reduces the cost of that too — the documentation is not regime-specific.

What can be done now

For compliance teams in year-end planning, the evidence points to some concrete priorities:

• Build or update the data and systems inventory for AI use, classified by purpose, sensitivity and decision significance. This is the one deliverable all the regimes share.
• Map exposure to the California sectors (employment, lending, housing, education, healthcare, essential services) — where the ADMT rules become concrete on 1 January 2027, and pre-use notices and opt-out workflows must be in place before that date.
• Follow Colorado's rulemaking process. The outcome of the attorney general's comment solicitation on "materially influences" will determine whether the state's regime captures systems that influence decisions or only those with a more delimited role — a difference that can mean an order of magnitude in scope.
• Treat the EU's December 2027 date as indicative, not guaranteed. The source is a sponsored webinar promotion, and no confirmation from primary sources exists. Check against the EU's own legal acts as they become available.
• Don't plan around preemption. According to Coblentz, it has displaced no state laws, and state legislation remains the operative baseline.

A general caveat applies to the entire picture: the primary regulatory documents — the EU's amendments, Colorado's legislation, the CPPA's rules — are not part of this source material. All legal status claims come from a sponsored conference listing and an attorney alert. They are consistent where they overlap, but verification against primary sources is a necessary step before binding decisions are made.

That may be the most useful conclusion for 2027 planning: the deadlines are the uncertain variables, the data documentation is the certain one. Organizations that spend the time on the inventory will be prepared whichever dates ultimately apply.