Marvel Advisors
Contact us
AI Governance

AI Governance and Compliance in 2026: NIST AI RMF, ISO/IEC 42001, the EU AI Act, and Colorado

Oct 29, 2026 ยท By Marvel Advisors

This article is general information, not legal advice.

Several AI deadlines shifted in the last year. Here is where the main frameworks and laws stand as of late October 2026, and what a mid-size business can do now.

Voluntary frameworks: NIST AI RMF and the Generative AI Profile

The NIST AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1) was released on January 26, 2023. It is voluntary and organized around four functions: Govern, Map, Measure, and Manage.

On July 26, 2024, NIST released the Generative AI Profile (NIST AI 600-1), a companion that describes 12 risks new to or made worse by generative AI, such as data privacy, information security, and confabulation (confidently wrong output), with suggested actions for each.

NIST's AI RMF page states the framework is being revised as part of the White House AI Action Plan; no revised version has been published as of this writing. For most mid-size businesses, the AI RMF is the most practical starting point: it is free and flexible.

Certifiable standard: ISO/IEC 42001

ISO/IEC 42001:2023, published December 18, 2023, specifies requirements for an AI management system for organizations of any size that develop, provide, or use AI, and can be certified by a third party.

It follows the same management-system structure as ISO/IEC 27001, so existing governance can be extended.

EU AI Act: what applies when

The EU AI Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024, with obligations phased in. It can reach companies outside the EU that place AI systems on the EU market or whose AI output is used in the EU. In July 2026 the EU adopted the Digital Omnibus on AI (Regulation (EU) 2026/1744), which entered into force on July 27, 2026 and pushed back the high-risk deadlines. The current timeline:

  • February 2, 2025: Prohibited AI practices and AI literacy obligations apply. (The omnibus reframed the literacy duty as taking measures to support staff AI literacy.)
  • August 2, 2025: Obligations for general-purpose AI model providers, governance, and penalties apply.
  • August 2, 2026: General application date, including the Article 50 transparency obligations (for example, telling people they are interacting with an AI system and marking AI-generated content).
  • December 2, 2026: New prohibitions on AI-generated non-consensual intimate imagery and child sexual abuse material apply. Providers of generative AI systems placed on the market before August 2, 2026 have until this date to meet the Article 50(2) content-marking requirement.
  • December 2, 2027: High-risk obligations for stand-alone (Annex III) systems, such as AI used in employment, credit, and education decisions. This was originally August 2, 2026.
  • August 2, 2028: High-risk obligations for AI embedded in regulated products (Annex I). This was originally August 2, 2027.

Colorado: SB 24-205 was repealed and replaced

Colorado's original AI Act, SB 24-205, never took effect. Its February 1, 2026 start date was first moved to June 30, 2026 by SB 25B-004, signed August 28, 2025. Then in the 2026 session the legislature passed SB 26-189, "Automated Decision-Making Technology", signed May 14, 2026, which repeals and reenacts the law in a narrower form.

Per the bill summary and the Legislative Council fiscal note, the main obligations begin January 1, 2027 and apply to automated decision-making technology (ADMT) used to materially influence consequential decisions about education, employment, housing, financial or lending services, insurance, health care, and essential government services. Key points:

  • Developers must give deployers technical documentation (intended uses, training data categories, known limitations, human-review guidance) and notify them of material changes.
  • Deployers must notify consumers when ADMT is used in a consequential decision. After an adverse decision, they must explain the role ADMT played within 30 days and describe the consumer's rights to access and correct personal data and to request meaningful human review.
  • Both must keep compliance records for at least three years.
  • The Attorney General enforces the law under the Colorado Consumer Protection Act. Until January 1, 2030, the AG must generally give 60 days' notice and a chance to cure before acting. The AG must also adopt implementing rules by January 1, 2027.
  • According to legal analysis of the final bill, the earlier requirements for a risk management program, impact assessments, and a duty of reasonable care against algorithmic discrimination were dropped.

Certain cybersecurity tools, spreadsheets, and tools that only summarize information for human review are excluded from the ADMT definition. Check the final text and the AG's rules before deciding whether your use is covered.

What a mid-size business should do now

  1. Inventory your AI use, including AI features in existing software, and note which uses touch people's employment, credit, housing, insurance, health care, or education.
  2. Map your exposure. Do you sell into the EU, or use AI to make decisions about Colorado consumers or employees? That determines which dates matter to you.
  3. Adopt a framework. Use the NIST AI RMF to structure roles, risk review, and monitoring. Consider ISO/IEC 42001 if customers want certification.
  4. Close the documentation gap. Get vendor documentation you would need to explain a decision, and build notice and human-review steps.
  5. Assign an owner for the inventory, vendor review, and regulatory watch.

Quick checklist

  • AI inventory completed, with high-impact uses flagged
  • EU and Colorado applicability determined
  • Governance framework chosen (NIST AI RMF and/or ISO/IEC 42001)
  • Vendor documentation requested for AI used in consequential decisions
  • Consumer notice, adverse-decision explanation, and human-review process designed
  • Records retention set for at least three years where Colorado law applies
  • Owner named; counsel consulted on scope

Getting a clear picture

The rules are still settling, but the groundwork is the same under every framework. A compliance assessment can measure your current practices against the NIST AI RMF, ISO/IEC 42001, and the obligations that apply to you, and give you a prioritized list of gaps to close.

Sources