Vantage Briefing for Ashlar Health, Inc. No. 1 · 17 May 2026

Colorado SB 26-189, signed May 14, 2026 (2026 Colorado Session Laws, chapter 131), repeals and reenacts with amendments part 17 of article 1 of title 6 of the Colorado Revised Statutes — the framework SB 24-205 created — and in doing so restates the duties attaching to "covered ADMT" under Colorado SB 26-189, automated decision-making technology used to materially influence a consequential decision. A "developer" is a person doing business in Colorado that makes a covered ADMT commercially available or intentionally modifies one to become covered; a "deployer" is a person doing business in Colorado that deploys one. Covered domains include education, employment, financial services, housing, insurance, health care, and essential government services. Under Colorado SB 26-189, a developer must document known limitations and harmful uses for deployers; a deployer must give point-of-interaction notice before using a covered ADMT to materially influence a consequential decision. Where a covered ADMT under Colorado SB 26-189 materially influences a consequential decision under that act resulting in an adverse outcome for a consumer, the deployer must provide, within 30 days after making the decision and without the consumer asking, a plain-language description of the decision and the covered ADMT's role in it, instructions for requesting further information, and an explanation of the consumer's rights. Separately, a consumer who experiences such an adverse outcome may request, and the deployer must then provide in response to that request, instructions for correcting inaccurate personal data used in the decision and an opportunity for meaningful human review and reconsideration of it, the latter to the extent commercially reasonable under Colorado SB 26-189. The Colorado Attorney General enforces exclusively under the Colorado Consumer Protection Act. Before an enforcement action, the Attorney General issues a notice of violation only where a cure is deemed possible by the Attorney General, opening a 60-day period to cure; where the Attorney General finds and can demonstrate a knowing or repeated violation, no cure period is required before penalties or other relief are sought. These cure provisions sunset January 1, 2030. Most duties apply to decisions made on or after January 1, 2027.

Iowa House File 2635, signed May 13, 2026, is a broader health-carrier and utilization-review act whose Section 2 substantively amends existing Iowa Code § 514F.8, a sectoral AI-in-healthcare provision. Under the amendment, a utilization review organization may use an artificial-intelligence-based algorithm or system to conduct an initial review of a prior-authorization request, but that AI-based algorithm or system may not be the sole basis to deny, delay, or downgrade a request for a health-care service based on medical necessity — a use-restriction model under Iowa Code § 514F.8, distinct from the disclosure-oriented sectoral AI statutes in Texas and Illinois. Neither "artificial intelligence-based algorithm or system" nor "utilization review organization" is newly defined in the amendment; the latter carries its existing statutory meaning. The Iowa Insurance Commissioner retains rulemaking and enforcement authority for the amended chapter; the amendment imposes no AI-specific penalty and creates no private right of action. The act takes effect July 1, 2026, while separate audit-timing provisions in the same act apply to audits initiated on or after January 1, 2027.

Colorado SB 26-189, signed May 14, 2026, repeals and reenacts, with amendments, Part 17 of Article 1 of Title 6 — the developer-and-deployer framework for consequential decisions originally created by SB 24-205. SB 24-205's own duties, including reasonable care against algorithmic discrimination, a deployer risk-management program, and annual impact assessments, had already been deferred by SB 25B-004 to a June 30, 2026 operative date and never took effect before the repeal and reenactment superseded them. SB 26-189 replaces those duties with the covered-ADMT documentation, notice, and meaningful-human-review framework described in the accompanying new-enactment record, effective for consequential decisions on or after January 1, 2027. The former SB 24-205 term "high-risk artificial intelligence system" is replaced by "covered ADMT" under Colorado SB 26-189. Enforcement remains exclusive to the Colorado Attorney General under the Colorado Consumer Protection Act.

The Texas Attorney General announced, on May 11, 2026, a proposed Agreed Final Judgment and Permanent Injunction resolving an investigation into LG Electronics U.S.A., Inc.'s collection of "Viewing Data" — household-level viewing behavior gathered through automatic content recognition on LG Smart TVs — with claims referencing the Texas Data Privacy and Security Act. As proposed, LG would be required to obtain affirmative express consent, defined as a freely given, specific, and informed indication following clear disclosure, before collecting or processing viewing data or offering services that use it; to update onboarding and disclosure materials for model-year 2025 televisions within 30 days after the judgment's Effective Date, which the judgment defines as the date it is signed and entered by the court; and, for model-year 2027 and subsequent models, to provide notice of the Viewing Information Agreement in a pop-up screen that automatically appears when a consumer enters the "User Agreements" screen during onboarding, within 180 days after what that paragraph calls the judgment's "issuance date." The judgment defines "Effective Date" and uses it for its other deadlines, including a separate 180-day consent restriction; "issuance date" appears once, in the pop-up paragraph alone, and is not defined, so whether the two paragraphs run from the same date is not resolved by the judgment's own text. The supplied judgment copy carried a blank judicial signature and date block, so court entry and the resulting effective date were not independently confirmed as of May 11, 2026.

The Texas Attorney General filed an Original Petition against Netflix, Inc. on May 11, 2026, in a Collin County district court, invoking the Texas Deceptive Trade Practices–Consumer Protection Act, Tex. Bus. & Com. Code §§ 17.46 and 17.47. The petition alleges false, misleading, or deceptive collection, use, sharing, sale, and disclosure of subscriber viewing and behavioral data, including conduct involving children's profiles, targeted advertising, autoplay defaults, and data-sharing arrangements with other companies. Relief sought includes a data purge, express informed consent before targeted-advertising-related data collection or disclosure, parental consent for children's behavioral data, disabling autoplay by default on kids' profiles, and civil penalties of up to $10,000 per violation, with an additional penalty of up to $250,000 for conduct affecting a consumer aged 65 or older. As of May 11, 2026, the matter remained pending, with no merits ruling or settlement in the retrieved court record; the petition's assigned cause number and judicial district were left blank on the filed copy.

The April 27, 2026 minute order in X.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo.) (ECF 24), restrains the Colorado Attorney General from initiating enforcement or an investigation for alleged violations of SB 24-205, "or any legislation replacing or amending SB24-205 enacted during this legislative session," for conduct occurring through 14 days after the court rules on a forthcoming preliminary-injunction motion. Colorado SB 26-189, signed May 14, 2026, repeals and reenacts the same Part 17 framework SB 24-205 created, replacing it with the covered-ADMT documentation, notice, and human-review duties described under Colorado SB 26-189, and was enacted within the same legislative session the order's restraint clause addresses. On the terms of the order, the restraint on Attorney General enforcement reaches SB 26-189's covered-ADMT framework on the same basis as SB 24-205's, notwithstanding SB 26-189's own January 1, 2027 date for those duties to begin applying. The restraint continues through 14 days after a ruling on xAI's preliminary-injunction motion; as of the evidence cutoff of May 17, 2026, that motion had not yet been filed, and no ruling had issued.