Colorado Refines AI Decision and Chatbot Rules, EU Assesses Cloud and AI Infrastructure, China Clarifies Boundaries for Public Personal Information, NIST Seeks Input on NVD Modernization, Korea Updates CBPR Standards

On August 11, 2026, the Colorado Department of Law (DOL) submitted the proposed Automated Decision-Making Technology & Conversational Artificial Intelligence Service Rules to the Secretary of State, intended to clarify implementation requirements for automated decision-making technology under SB 26-189 and public-facing conversational AI services under HB 26-1263. The document remains in formal rulemaking and public-comment status and is not a final rule; the formal comment period runs from August 11 through October 26, 2026.

The proposed rules translate two enacted state laws, whose core obligations take effect on January 1, 2027, into more specific operating procedures. On automated decision-making technology, SB 26-189 reframed the regulated object as covered automated decision-making technology (covered ADMT) used to materially influence a consequential decision, covering areas including education, employment, housing, financial and lending services, insurance, healthcare, and essential government services. Building on that framework, the draft further specifies explanations for adverse decisions, including the respective roles of the system and human personnel, the principal reasons for the decision, and relevant inferences, scores, and data sources. It also operationalizes meaningful human review as an independent human process involving appropriate expertise and authority to change the outcome. The proposal would generally require acknowledgment of a review request within 10 days and completion within 45 days, while review personnel generally may not rely again on automated decision-making technology to perform the review. On conversational AI, the draft further specifies mechanisms including that age determination may not rely solely on user self-declaration, and establishes more concrete product and recordkeeping requirements around AI identity disclosure, privacy and interaction protections for minors, suicide or self-harm response, and annual reporting.

What enterprises need to check in advance is whether an automated decision can be traced backward from the outcome to the model, data, and human judgment involved. If recruitment screening, loan approval, insurance underwriting, or medical eligibility determinations rely on third-party models to generate rankings, scores, classifications, or inferences, retaining only the final “approve/deny” outcome will be increasingly insufficient to support the explanation and human-review process contemplated by the proposal. Enterprises need to be able to connect the relevant model or system version, the data entering the decision and its sources, key scores or inferences, points of human involvement, and the ultimate rationale for the decision. Where these capabilities come from an external vendor, procurement contracts should also confirm whether the vendor can provide information on training-data categories, system limitations, and the information needed for decision-level explanations. Operationally, human review should be designed as a genuinely independent process capable of changing the result, rather than requiring employees to accept the same model judgment again. For consumer chatbots, the change reaches directly into product design: age determination, AI identity notices, conversation memory, use of minors’ data, and safety-response mechanisms need to become configurable, testable, and auditable system controls, rather than merely statements in a privacy policy. Because the rules remain proposed, these points are best treated as enterprise gap-check items; final obligations will depend on the adopted text.

This rulemaking also needs to be understood against Colorado’s own policy changes. SB 24-205, enacted in 2024, originally centered on “high-risk artificial intelligence systems” and algorithmic discrimination, requiring developers and deployers to establish risk-management and impact-assessment mechanisms. SB 25B-004 in 2025 then delayed implementation of those obligations until June 30, 2026. SB 26-189 subsequently repealed and rewrote that framework in 2026, shifting the core regulatory object to covered automated decision-making technology and removing some of the prior regime’s duties relating to algorithmic-discrimination precautions, annual impact assessments, and risk-management programs, while focusing instead on notice, data correction, decision explanation, and human review. The August 11 development is therefore not simply the old “high-risk AI” rules entering implementation, but rather the rewritten ADMT framework beginning to take operational form through detailed rules. Chatbot governance offers another contrast with California: California SB 243 focuses primarily on “companion chatbots” designed to meet users’ social or emotional needs on an ongoing basis and similarly includes AI identity notices, self-harm response, and protections for minors. Colorado HB 26-1263, by contrast, defines covered conversational AI services more broadly as public-facing services that primarily simulate human communication through text, visual, or voice interfaces, making its scope more oriented toward general consumer conversational products. Under the announced procedure, the next identifiable milestone is publication of a revised proposed draft by September 23, 2026, followed by the formal hearing and the current comment deadline on October 26.

On August 11, 2026, the European Commission published the Study on Cloud and AI Development in the EU, systematically assessing the EU’s current capacity and future demand for general-purpose cloud and AI-optimized computing infrastructure, as well as issues including cross-border services, vendor lock-in, third-country laws, and resource constraints. The study’s findings had already contributed to the impact-assessment staff working documents accompanying the proposal for the Cloud and AI Development Act (CADA).

The study is not a new regulation or guidance document, but an empirical study commissioned by the European Commission in 2024. Beyond computing capacity and future demand, it focuses on barriers to cross-border cloud services, vendor lock-in across the AI compute stack, third-country laws with extraterritorial effects, data-center permitting, electricity-grid and water constraints, and open-source adoption. The report also identifies the EU’s limited and geographically concentrated computing capacity, together with dependence on non-European cloud and AI-compute providers, as major structural challenges, and compares a baseline scenario with different levels of EU intervention for the policy problems identified. The Commission has made clear that the study’s findings form part of the evidence base for the impact assessment accompanying the CADA proposal. The August 11 publication therefore does not create new mandatory obligations for enterprises.

For enterprise deployment, the more practical value lies in understanding which cloud-architecture attributes the EU is bringing into policy assessment. The first is portability. If an enterprise binds model fine-tuning, vector databases, model serving, monitoring tools, and identity and access controls to proprietary services from a single cloud provider, it may be unable to rebuild the full AI operating stack at low cost even if the underlying data can be exported. The study extends the lock-in question beyond traditional data portability to the AI compute stack, making model and service portability, open interfaces, exit costs, and multi-cloud operating conditions worth recording separately during vendor assessment. The existing Data Act already requires providers of data-processing services to remove technical, contractual, and organizational obstacles to effective switching and includes rules on open interfaces, data export, and interoperability, so this is not the emergence of an entirely new anti-lock-in obligation. The next layer is jurisdictional risk: “data located in the EU” and “a service fully insulated from third-country law” are two different questions. When selecting cloud services for sensitive or critical workloads, enterprises can therefore examine not only data-center location, but also supplier ownership and control relationships, applicable jurisdictions over infrastructure, procedures for responding to government-access requests, and who controls encryption keys. CADA remains a Commission legislative proposal, but its proposed sovereignty framework already establishes four assurance levels based on risk. Higher levels address factors such as supplier independence from third countries, ownership and control, and software-supply-chain transparency. If an enterprise provides AI services to European public-sector customers or other buyers with strong sovereignty requirements, these conditions may become particularly relevant to future cloud-provider and regional-architecture choices.

The study’s policy position is best understood by looking backward in time. The Commission launched the study in 2024. In April 2025, the AI Continent Action Plan had already proposed expanding European data-center and computing capacity through CADA. The Commission then formally proposed the CADA regulation on June 3, 2026, establishing measures around research and innovation, infrastructure capacity, and autonomy. The study published on August 11 is therefore not a new regulatory round following CADA, but the public release of empirical material that had already supported earlier legislative choices. Read together with the existing Data Act, the two instruments also operate at different levels. Article 23 of the Data Act already addresses switching between cloud services from the customer-rights perspective; Article 28 requires disclosure of the jurisdictions governing infrastructure and safeguards against unlawful international government access; Article 32 requires providers of data-processing services to take technical, organizational, and legal measures to prevent third-country government access to non-personal data where such access would conflict with EU law. The CADA proposal goes further into infrastructure supply and “cloud and AI sovereignty,” including a single EU-wide sovereignty assessment framework and a public-sector adoption mechanism. The study therefore does not add a new enterprise compliance checklist; rather, it provides evidence for the EU’s policy shift from “can data be moved, and how can improper access be prevented?” toward “who provides critical AI workloads, can the provider be replaced, and who ultimately controls it?”

On August 12, 2026, the Cyberspace Administration of China (CAC) published Questions and Answers on Policies and Regulations for Personal Information Protection (August 2026), explaining requirements for processing publicly available personal information as well as common causes of personal information leakage and corresponding security measures. The Q&A does not constitute a newly enacted law, administrative regulation, or departmental rule.

The Q&A does not reset the legal rules for “public information.” Instead, it brings together Article 27 of the Personal Information Protection Law of the People’s Republic of China and the audit criteria set out in the annex to the Measures for Personal Information Protection Compliance Audits. The Personal Information Protection Law permits personal information processors to process, within a reasonable scope, personal information voluntarily disclosed by individuals or otherwise lawfully made public, except where the individual expressly refuses such processing. If the processing has a significant impact on the individual’s rights and interests, consent must still be obtained. Audit guidance that entered into force in 2025 further identifies five types of non-compliant conduct, including commercial marketing unrelated to the original purpose of disclosure, use for cyberbullying or false information, disregard of an individual’s explicit refusal, processing with significant impact without consent, and collection, retention, or processing whose scale, duration, or purpose exceeds a reasonable scope. The August Q&A reiterates this analytical framework but does not provide a uniform quantitative definition of “significant impact” or “reasonable scope.”

For enterprises using public internet data to train models, build retrieval-augmented generation systems, or construct agent knowledge bases, the adjustment needs to occur in the decision process before data enters the system, rather than by simply adding the statement “the data came from the internet.” Enterprises first need to distinguish between “technically accessible” and “voluntarily disclosed by the individual or otherwise lawfully made public.” The fact that a webpage is accessible to a crawler does not by itself establish that all personal information on that page falls into the latter category. Enterprises should then record the collection purpose, data type, source page, scraping scale, retention period, and downstream use, so that different processing purposes such as training, fine-tuning, retrieval, and profiling can be reviewed separately. If an enterprise cannot explain why a batch of publicly available personal information was collected, why it needs to be retained over time, or why it can be repurposed from the original disclosure context for model training, it will be difficult to demonstrate that the processing remains within a “reasonable scope.” For data subject to an explicit refusal, the refusal status needs to propagate into the source corpus, vector database, indexes, and later training batches rather than being handled only by deleting a front-end record. As for how deletion or cessation of processing should be implemented once personal information has already entered model parameters, this Q&A does not provide AI-specific technical rules, and the issue should not be presented as if regulators have already supplied a definitive answer. These requirements connect directly with Article 7 of the Interim Measures for the Management of Generative Artificial Intelligence Services, which already requires generative AI service providers to use data from lawful sources and, where personal information is involved, obtain consent or rely on another lawful basis for processing.

The policy trajectory has in fact moved gradually from general principles toward auditable conditions. Articles 13 and 27 of the Personal Information Protection Law established the legal basis for processing publicly available personal information and the boundary of a “reasonable scope” in 2021. The Interim Measures for the Management of Generative Artificial Intelligence Services in 2023 brought personal-information lawfulness directly into generative-AI training-data processing. The Measures for Personal Information Protection Compliance Audits in 2025 then made scale, duration, purpose, refusal, and significant impact explicit audit items. The August 2026 Q&A again presents this framework directly to personal information processors. The same issue is approached through somewhat different analytical tools in Europe and the United Kingdom. The UK Information Commissioner’s Office (ICO), in its conclusions on generative AI, has said that under current practices the use of personal data scraped from the web to train generative AI may potentially rely on legitimate interests as the lawful basis, but developers need to apply the purpose, necessity, and balancing tests and explain why alternative means of obtaining the data are not feasible. The European Data Protection Board (EDPB) has likewise stated that whether personal data is publicly available is only one factor in assessing the reasonable expectations of data subjects; the source of the data, the context of collection, and subsequent model use also require case-by-case assessment. Compared with these approaches, China’s current framework is structured more directly around the chain of “lawfully public—reasonable scope—individual objection—significant impact.” For cross-regional training and data procurement, this difference goes directly to dataset-admission rules: the same public web data cannot be assumed to enter training or retrieval systems under identical conditions across jurisdictions merely because a usable legal basis exists in one region.

On August 12, 2026, the U.S. National Institute of Standards and Technology (NIST) published a Request for Information on Modernizing the National Vulnerability Database in the Age of Artificial Intelligence in the Federal Register, seeking input on how to modernize the processes, data standards, risk prioritization, and automated remediation functions of the National Vulnerability Database (NVD) for an environment shaped by AI and machine-consumable security data. Comments are due by October 13, 2026. The document is a request for information, not a rule, standard, or new mandatory requirement for enterprises.

NIST’s consultation covers the full vulnerability-management lifecycle rather than merely improvements to the NVD query interface. The current NVD automatically ingests Common Vulnerabilities and Exposures (CVE) records and enriches them with information such as severity and affected products. The RFI goes further by asking where AI can participate in vulnerability discovery, validation, disclosure, prioritization, and remediation, and which automated tasks should still retain human review. On prioritization, NIST specifically asks how AI-driven judgments can remain transparent and auditable and how asset and system context from production environments should inform prioritization. On remediation, it further asks what organizational processes and controls are needed before AI-generated fixes are introduced into systems. At the data layer, NIST also seeks feedback on whether existing vulnerability identifiers, product naming conventions, and severity-scoring standards are sufficient for AI-era vulnerability management, and how the quality and contextual richness of machine-readable vulnerability data can be improved.

For enterprises that have already introduced AI or agents into the security operations center, this RFI is more useful as a set of “automation-boundary questions” than as a new NIST compliance checklist. The first risk appears in vulnerability prioritization. If an agent simply reads CVSS scores and automatically generates a remediation queue, it can easily overlook whether the vulnerability actually exists in enterprise assets, whether it is already being exploited, whether the affected system is internet-facing, and how business-critical the system is. NVD data therefore needs to be combined with asset inventories, threat intelligence, and production-state context. Automated remediation raises an additional permission question: an agent that can recommend a patch should not automatically have the same permissions as an agent that can modify a production system. Enterprises can automate low-risk information collection and initial classification while applying approval thresholds, permission separation, operation logs, test-environment validation, and rollback paths to production changes. Model-generated prioritization or remediation recommendations should also be traceable to the data, rules, and system context on which they were based. The variability of upstream data cannot be ignored either. In April 2026, NIST confirmed that approximately 4,500 CVE records contained incorrect CVSS v4.0 numerical scores and subsequently corrected them through updated records and audit entries. Fully automated response systems driven by NVD data therefore also need synchronization mechanisms for upstream corrections and updates.

The consultation continues a broader transition in the NVD from labor-intensive vulnerability enrichment toward risk prioritization, structured data, and automated processing. Beginning in 2024, the NVD developed a substantial backlog as CVE volumes increased. By April 2026, NIST reported that CVE submissions had grown 263% between 2020 and 2025 and moved NVD enrichment toward a risk-prioritized model, focusing first on known exploited vulnerabilities, software used by the federal government, and CVEs affecting critical software while developing more automated systems. In June 2026, the NVD also added Stakeholder-Specific Vulnerability Categorization (SSVC) and affected-product data to its data feeds and APIs, further structuring vulnerability information. The August RFI pushes the next question into the design of data, auditability, and governance for AI-assisted vulnerability discovery, prioritization, and remediation. In contrast with the European Union, the U.S. action remains focused mainly on national vulnerability-information infrastructure and future standards design and does not itself impose new enterprise vulnerability-reporting duties. The EU Cyber Resilience Act (CRA), by contrast, already provides that from September 11, 2026, manufacturers of products with digital elements must begin complying with reporting obligations for actively exploited vulnerabilities and severe security incidents. Cross-regional enterprises therefore face two different governance questions: in the United States, how vulnerability data should support increasingly automated security operations; in the EU, how product vulnerabilities must also be identified, escalated, and externally reported through statutory procedures.

On August 13, 2026, Korea’s Personal Information Protection Commission (PIPC) issued an administrative notice on a partial amendment to the Guidelines on the Operation of the Cross-Border Privacy Rules Certification System, proposing updates to Korea’s domestic certification standards for the Global Cross-Border Privacy Rules (Global CBPR) System. Comments are open until September 2, 2026. The document remains a draft administrative notice and has not taken effect.

The amendment does not redesign Korea’s legal bases for cross-border transfers. Instead, it updates the certification criteria in Annex 1 of the current Guidelines to align with the Global CBPR Forum’s revised international requirements. The new standards add identification and additional protection of sensitive personal information and children’s personal information. For children’s data, they also require organizations to determine whether they process children’s information and to verify parental or legal-representative consent or another appropriate legal basis. The revisions additionally introduce withdrawal of consent, choice regarding direct marketing, identification and assessment of potential misuse risks arising from personal information processing, and proportionate mitigation measures based on the likelihood and severity of those risks. Where personal information is lost or subject to unauthorized access, use, modification, or disclosure and this may cause significant harm to affected individuals, organizations must also establish procedures for timely notification to those individuals. The draft includes a clear transition arrangement: the revised Guidelines are expected to take effect on April 1, 2027, but certification applications submitted on or after January 1, 2027 will already be assessed under the new Annex. Applications submitted on or before December 31, 2026 will continue to be reviewed under the existing standards, while certifications already granted under the old criteria will remain valid until their existing expiry dates.

For enterprises that use overseas cloud services, large-model APIs, or cross-regional group data platforms and are preparing to apply for or renew Global CBPR certification, the effects fall directly on data classification, model data flows, and operational controls. Demonstrating that the organization “has a privacy policy and security measures” will no longer be sufficient to cover the updated standards. Enterprises need to know which prompts, chat logs, training or fine-tuning corpora, user profiles, and model logs contain sensitive information or children’s information, and ensure that these classifications propagate into model calls, storage locations, and vendor permission configurations. Children’s data cannot rely only on a front-end age field; organizations also need a process for determining whether relevant information constitutes children’s personal data and for verifying an appropriate legal basis. When a user withdraws consent, the enterprise must also be able to stop the relevant use, disclosure, or publication. If personal information has already been synchronized into a data lake, retrieval-augmented generation (RAG) knowledge base, marketing system, or overseas processor, the consent status needs to continue propagating along the data chain rather than merely disabling a front-end marketing switch. Incident management similarly needs to include third-party model and cloud providers. The current amendment text already requires processors to be bound by obligations, restricts unauthorized onward subcontracting, and requires processors to report personal-information incidents to the applicant enterprise; the new standards further extend notification of incidents that may cause significant harm to affected individuals. These enterprise actions represent deployment mapping against the proposed certification standards and do not mean that every AI enterprise operating in Korea will automatically become subject to identical new statutory obligations from 2027 merely because of this draft.

The Korean revision is, in substance, the domestic synchronization of an international standards update. In March 2026, the Global CBPR Forum announced a new generation of certification requirements, expanding the Global CBPR System Program Requirements from 50 to 57. The additions cover accountability for sensitive and children’s data, risk assessment and mitigation, and breach notification, while strengthening requirements around direct-marketing choices, withdrawal of consent, records of processing activities, and qualifications for privacy-program accountability. The international system plans to apply the revised requirements to initial certifications and recertifications from April 1, 2027. Korea’s administrative notice explicitly states that its purpose is to align Annex 1 with these updated Global CBPR standards, so the changes are not a separate set of cross-border privacy risk requirements created independently by Korea. The institutional foundation has also been developing in stages: Korea established new domestic CBPR operating guidelines in February 2026, and the Korea Internet & Security Agency (KISA) formally designated a certification assessment body under those guidelines on July 1.

A more important distinction is between international privacy certification and a lawful basis for transferring personal information overseas. Article 28-8 of Korea’s Personal Information Protection Act separately recognizes mechanisms that may support overseas transfers, including explicit consent of the data subject, outsourcing or storage necessary for performance of a contract, certification designated by PIPC public notice, and recognition of an equivalent level of protection. Korean authorities, meanwhile, position CBPR as a certification mechanism for demonstrating an enterprise’s privacy-management level and supporting trusted cross-border data flows. Enterprises should therefore not see “CBPR” and skip the underlying transfer analysis. They should record two separate sets of questions: one asks why Korean personal information may be transferred overseas, to which country, and to which processor; the other asks whether the recipient and the enterprise itself meet the data-governance level required by Global CBPR. This distinction is particularly important for AI systems deployed across Korea, Japan, Singapore, and other markets: certification standards may converge, while the specific legal effect each jurisdiction assigns to certification for cross-border transfers may not be identical.