Colorado Guts AI Act: Only 2.4% of Companies Past Pilot Stage

So, What Actually Happened?

So, Tuesday morning, and the whole conversation this week was about who gets to write the rules, and who's quietly walking them back. We scanned 190,000 articles this week so you don't have to. Colorado gutted its own AI Act two months before it was meant to bite, Pope Leo aimed an encyclical straight at big tech, and Europe's investors stopped funding apps and started funding science. Meanwhile the boring number underneath it all: only 2.4% of companies have actually gotten AI past the pilot stage.

The Bottom Line: Three different authorities moved the AI rulebook this week, one loosening it, one tightening it, one moralizing about it, while the companies underneath are still stuck on a problem no regulator can fix for them: their data is a mess. The rule fight is loud. The foundation is wet concrete.

The Tracks That Matter

1. Colorado Just Gutted Its Own AI Act Before Enforcement

Here's the regulatory whiplash of the week. Colorado Governor Jared Polis signed SB 26-189, repealing and replacing big chunks of the first comprehensive state AI law in the US, just months before it was due to take effect. The original act was the one every other statehouse was watching as a template. They blinked first.

What got cut is the interesting part. Gone is the general duty of care, the formal risk management programs, and the mandatory algorithmic impact assessments, the exact obligations that made the original law a model. What survives is narrower: rules for ”covered automated decision-making technology” that processes personal data and materially affects consequential decisions about people, plus consumer rights to notice, correction, and human review of an adverse outcome. The Attorney General enforces it through existing consumer-protection law, not a new AI regime.

The strategic read is that the compliance burden moved from ”build a governance program” to ”manage liability between developer and deployer.” The amended act leans hard on contractual allocation of responsibility, which means the fight over who's accountable when an AI system discriminates is now happening in vendor contracts, not in a state-mandated framework. If you're deploying someone else's model, that clause is your exposure.

Here's what works: Don't read Colorado's rollback as ”regulation is off the table.” Read it as the obligation shifting into your contracts. Before your next AI vendor renewal, get your legal team to spell out, in writing, who owns the liability when the system makes a consequential decision that goes wrong. The statute got lighter; your contract just got load-bearing.

2. Only 2.4% Of Companies Got AI Past The Pilot

While everyone argued about rules, a quieter report named the thing nobody wants to say out loud. In industry and logistics, 81% of companies sit at an immature or basic AI level, and only 2.4% have reached what the study calls transformative maturity. AI and machine learning is the single highest IT investment priority in the sector. The gap between the spend and the result is the whole story.

And the reason is the least glamorous one possible. The report names data quality as the biggest perceived obstacle to AI, full stop. Not model choice, not GPU access, not talent. The boring stuff: clean, reliable, well-structured data. This is the same wall I've watched companies hit for fifteen years, dressed in a new outfit. They slap an LLM on messy data, call it ”AI-driven,” and wonder why the pilot never graduates.

There's a second failure mode buried in the findings: resistance to change and lack of anchoring in the business. The report is blunt that AI which delivers real value has to live beyond the IT department, that a pilot owned by IT alone stays a pilot. You can feel the truth of it. The proof-of-concept that impresses the engineers and never reaches a P&L is the most expensive kind of success.

Here's what works: Before you approve another AI pilot, run two checks. First, score the data the pilot will run on, if it's dirty, fix that before you buy anything, because no model rescues bad inputs. Second, name a business owner outside IT who has to show the value in their own numbers. A pilot with a clean data source and a business owner has a path to the 2.4%. One without either is a demo with a budget.

Try It Yourself

3. Pope Leo Aims His First Big Encyclical Squarely At AI

Of all the voices weighing in on AI this week, the one that traveled furthest wasn't from a lab or a regulator. Pope Leo XIV used a sweeping encyclical to take aim at big tech, framing artificial intelligence as both promise and peril, and putting the moral weight of the Vatican behind a warning about where it's heading.

It's easy to file this under ”soft news” and scroll past. That would be a mistake. When a figure with that reach issues a direct warning about AI, it changes the room temperature for hundreds of millions of people, including a lot of employees, customers, and board members who don't read TechCrunch. Moral framing precedes regulatory framing more often than technologists like to admit. The printing press didn't get rules until the culture decided it needed them.

The operating consequence is subtle but real. The public conversation about AI is shifting from ”what can it do” to ”what should it do,” and that second question lands in boardrooms eventually, usually as a reputational risk nobody priced. The companies treating AI ethics as a press-release afterthought are the ones who'll be answering harder questions when the cultural mood, now with the Pope's voice in it, reaches their customers.

Here's what works: Add one line to your AI project reviews: ”How does this look if it ends up on the front page?” Not as censorship, as foresight. The teams that can answer the should-we question, not just the can-we question, are the ones who won't get caught flat-footed when moral scrutiny becomes customer scrutiny.

4. Your AI Incident Report Just Leaked Another Client's Breach

Here's the security story the agentic-AI crowd needs to read twice. Researchers warned this week that using AI tools to draft breach response reports risks cross-contamination, where details from one client's incident bleed into another's documentation. The tool that was supposed to speed up your worst day quietly creates a new exposure on it.

The mechanism is the uncomfortable part. Feed a model context from multiple incidents and it doesn't keep neat walls between them, so a sensitive detail from Client A can surface in the report you hand to Client B. In incident response, where confidentiality and chain-of-custody are the entire point, that's not a typo, it's a second breach caused by the cleanup. The cure became part of the disease.

This generalizes well past security teams. Any shared AI workflow where the same model touches multiple customers' sensitive data has the same shape of risk: the convenience of one assistant across many accounts is also a leak path across those accounts. The faster you've rolled AI into client-facing work, the more of these quiet bridges you've built without mapping them.

Here's what works: Audit every AI workflow that touches more than one client's confidential data and ask one question: can context from one account reach another? If you can't prove isolation, you don't have a productivity tool, you have an undisclosed data-sharing arrangement. Wall off per-client context before the next incident, not after.

5. Europe's AI Money Stopped Chasing Apps, Started Buying Science

The funding flows this week told a story the headlines missed. Europe's dealflow was led not by another chatbot wrapper but by Isomorphic Labs raising $2.1 billion in a Series B for AI-driven drug discovery, the kind of hard-science bet that takes years to pay off. The smart money is moving down the stack, away from the easy apps and toward the foundations.

Look at who else drew checks and the pattern sharpens. Recursive Superintelligence pulled in $650 million at early stage, Fractile secured $220 million for AI compute hardware, and the rest of the board skewed toward infrastructure, science, and deep tooling rather than thin consumer plays. Read alongside last week's shift from ”models to moats,” this is the same instinct expressed in euros: investors are done paying for features anyone can clone and are buying things that are genuinely hard to build.

For anyone planning their own AI roadmap, the signal is about defensibility. The capital is voting that the durable value sits in the layers that take real science, real hardware, real data to assemble, not in the wrapper that a competitor rebuilds in a weekend. If your AI strategy is a thin layer on someone else's model, the people with the most information just bet against you.

Here's what works: When you assess an AI investment, your own build or a vendor's, ask what about it would survive a smart competitor with a budget and six months. If the answer is ”the science” or ”the proprietary data,” you're on the side the European money just backed. If it's ”the UI,” you're on the side they're walking away from.

6. The Real Cost Of AI Coding Just Made Microsoft Blink

Here's the contrarian thread tying the week together. Reports surfaced that Microsoft has quietly walked back its use of Claude Code, with the apparent driver being the real, recurring cost of running frontier AI for coding at scale. When the company with the deepest pockets in software starts watching the meter, the ”AI makes coding free” story needs an asterisk.

The framing in the coverage is pointed. A separate writeup asked directly whether the retreat was down to high cost, and that's the question everyone running AI dev tools should be asking before the invoice does it for them. The trials are cheap and the demos are magic. The bill at production scale, across thousands of engineers running agents all day, is a different animal entirely.

This connects straight to the maturity gap and the funding shift. The market is collectively waking up to AI economics: the per-token cost that's invisible in a pilot becomes a line item that needs defending in production. The companies that scaled AI tooling without modeling the run-rate are about to have the same uncomfortable budget conversation Microsoft apparently just had, only with less room to absorb it.

Here's what works: Before you roll an AI coding assistant out org-wide, build the unit-cost model first, cost per engineer, per day, at full adoption, not the trial price. Then pressure-test it against the productivity gain in hours actually saved. If the math only works at demo scale, you're buying a pilot that gets more expensive the more it succeeds.

7. Compliance Just Got Its Own AI Board Member

The governance vendors aren't waiting for the rulebook to settle. At its Elevate 2026 conference, Diligent rolled out a slate of GRC-focused AI tools, including an ”AI Board Member” pitched at directors drowning in complex board materials, and a ”Connected Compliance” layer meant to catch governance failures before they happen. The audit-and-oversight function, long the last to get new tooling, is now a product category.

CEO Brian Stafford was direct about the bet. ”Agentic AI isn't a future state for governance, risk, and compliance professionals,” he said. ”It's here, it's built for your world, and it's ready to work.” The pitch is that GRC professionals should spend their expertise on ”judgment, strategy, and governance,” not on ”assembly, coordination, and chasing”, automating the grunt work so humans do the part that needs a human.

That's the optimistic read, and it's a real one. The skeptical read is the one this whole issue keeps circling: the moment you put AI inside the oversight function itself, you've created a layer that watches the watchers, and somebody has to make sure that layer is right. An AI board member that confidently summarizes the wrong risk is a more dangerous failure than a human who simply ran out of time to read the packet.

Here's what works: If you're evaluating AI for governance or compliance, treat it like you'd treat any new auditor: useful, but verified. Pilot it on judgment you can independently check, keep a named human accountable for the output, and never let ”the AI flagged it” become the end of a sentence. The tool should sharpen oversight, not become the thing that needs oversight.

Signal vs. Noise

🟢 Signal: Governance and compliance ownership. The audit-and-governance layer kept gaining real influence this week while the marquee model names slipped, the clearest sign yet that the people who sign off on AI risk are now setting the agenda. Colorado rewriting liability into contracts and Diligent shipping AI into the boardroom are where the authority actually moved. Most coverage is still keyword-screening for model launches and missing it.

🔴 Noise: The ”Generative AI” label. Generic ”generative AI” pulled heavy mentions again but lost ground in real influence, lots of volume, less substance underneath. Anyone tracking the story by the buzzword is missing the actual movement, which is in the unglamorous governance, cost, and data-quality plumbing that decides whether any of it reaches production.

From the 190K

We scanned 190,000 articles this week. Here's what no one's talking about:

Colorado loosened its AI law, the EU's privacy board moved to tighten what counts as research data, and Pope Leo aimed an encyclical at big tech, three authorities reshaping the AI rulebook in three different directions, all in the same week that a report found only 2.4% of companies have gotten AI past the pilot stage.

Each desk reads these alone. The legal press covers Colorado. The privacy bar covers the EDPB. The culture desk covers the Pope. The trade press buries the maturity stat. Read them on the same morning and the real picture appears: an enormous, noisy fight over how to govern AI is happening directly above an industry where 97.6% of companies still can't make it work, because their data isn't clean and nobody outside IT owns the result. The strategic move on Monday is to stop watching the rule fight as if it's your bottleneck, it isn't, and put the effort into the foundation no regulator can fix for you: the quality of your data and the business owner accountable for the outcome.

By The Numbers

• Isomorphic Labs raised $2.1 billion in a Series B — Europe's biggest AI round of the week went to drug discovery, not another chatbot. When the largest check buys hard science, the smart money is telling you where the durable value sits.

• Only 2.4% of companies have reached transformative AI maturity — With 81% still at an immature or basic level despite AI being their top IT priority, this is the gap between AI spend and AI results, named in one number.

• Viktor hit a $15 million revenue run rate in three months — Across more than 2,000 organizations since a February launch. Proof that when AI tooling actually fits a workflow, adoption moves at a speed traditional software never matched.

• Overwatch AI saves airlines up to $4 million a year — And 150 hours per team member annually, by pinpointing answers instantly. A clean example of AI value measured in money and time saved, not features shipped.

• Recursive Superintelligence pulled $650 million at early stage — A nine-figure bet before product maturity, a reminder that frontier-AI capital is still flowing to the foundations even as it gets pickier about apps.

• See what's rising in our 190K-article corpus this week →

Deep Dive: Everyone's Fighting Over The Noise Ordinance While The PA Isn't Wired

Picture the festival the night before doors open. Out front, the city council is arguing about the noise ordinance, how loud, how late, who gets fined. Important arguments. Real consequences. But backstage, the PA is half-wired, the monitors hum, and nobody's checked whether the main speakers actually carry sound to the back field. That's the AI industry this week. The rule fight is the noise ordinance. The data foundation is the wiring. And the crowd shows up either way.

The Rules Moved Three Directions At Once

In a single week, Colorado repealed the teeth of its own AI Act before it could bite, Europe's privacy board moved to narrow what counts as scientific research under the GDPR, and the Pope put moral weight behind a warning about AI's direction. Loosening, tightening, moralizing, all at once. If you tried to plan your AI strategy around ”what will the rules be,” this week told you the honest answer: nobody agrees, and the direction reverses by jurisdiction.

But The Floor Is Still Wet

Underneath the rule fight, the operating reality barely moved. Only 2.4% of companies have reached transformative AI maturity, 81% are stuck at basic, and the named culprit is the least exciting thing in technology: data quality. This is the wall, the same one, wearing a 2026 outfit. The regulation you're watching so closely doesn't touch it. You can comply perfectly with every AI law on the books and still have a pilot that never reaches a P&L because the inputs are garbage.

The Gap Nobody's Regulating

Here's the synthesis the separate desks miss. The rulebook fight and the maturity gap are not the same problem, and confusing them is how companies waste a year. Regulation decides what you're allowed to do. Data quality decides whether you can do anything at all. The European investors betting on hard science over apps understand this, they're funding the layers that are hard to build, not the ones a regulation might bless. The foundation is the moat. No statehouse votes on it.

What Actually Works

1. Fix the wiring before the ordinance. Score your data quality before your next AI pilot. A clean source beats a compliant strategy with dirty inputs every time.

2. Give every pilot a business owner outside IT. A proof-of-concept that only IT owns stays a proof-of-concept. Value lives in someone else's P&L or it doesn't live.

3. Move liability into your contracts. With statutes like Colorado's shifting the burden to contractual allocation, the clause that names who's accountable is now your real governance layer.

4. Model the run-rate, not the trial price. AI economics that work at demo scale can break at production scale. Cost the thing at full adoption before you commit.

The festival's happening whether the council settles the ordinance or not. The crowd doesn't care who won the rule fight, they care whether the sound carries to the back field. The operator obsessing over the noise debate while the PA stays half-wired is going to play to silence. Wire the system first. Then you can argue about how loud.

What's Coming

Colorado Won't Be The Last To Walk It Back

Colorado's rollback of its own AI Act is a template other states were watching. Expect a wave of statehouses quietly softening their comprehensive AI bills as enforcement deadlines approach and the implementation cost lands. The headline regime is bending toward narrower, liability-and-disclosure rules. Watch where the obligation goes, not whether the law survives.

The Maturity Gap Becomes A Board Metric

With only 2.4% of companies reaching transformative AI maturity, expect ”what's our AI maturity, really” to become a board-level question over the next two quarters, framed less as enthusiasm and more as accountability for the spend. The companies that can show a pilot reaching a P&L will separate hard from the ones still demoing.

Moral Scrutiny Reaches The Boardroom

The Pope's encyclical is the leading edge of AI's should-we question going mainstream. As cultural and moral framing builds, expect customer and employee scrutiny of AI decisions to follow, and boards to start treating AI ethics as reputational risk rather than a press-release line. Get ahead of the question before a customer asks it for you.

For Your Team

Strategic purpose: Wednesday is the day this week's noise turns into one decision before the next operating review. The week told you plainly: the AI rule fight is loud and contradictory, but it isn't your bottleneck. Your bottleneck is the foundation, and naming who owns it is the work most companies keep skipping.

Wednesday's meeting prompt: ”We keep tracking the AI regulation headlines, but if only 2.4% of companies have made AI actually work, are we in that 2.4% or just busy? And if we're not, is it because of a rule, or because our data is a mess and no one outside IT owns the outcome?”

The Foundation-First Framework:

1. Score the data before the pilot — No AI project gets approved without a data-quality check on the source it'll run on. Dirty inputs sink clean models.

2. Name the business owner — Every AI initiative gets an accountable owner outside IT who has to show value in their own numbers. No owner, no pilot.

3. Move liability into the contract — With regulation shifting to contractual allocation, make every AI vendor agreement spell out who owns the consequence when a decision goes wrong.

4. Cost it at full scale — Model the production run-rate, not the trial price, before any org-wide AI rollout. Successful pilots get more expensive, not less.

Share-worthy stat: This week three authorities, a US state, the EU's privacy board, and the Pope, all moved the AI rulebook in different directions, while a report found only 2.4% of companies have gotten AI past the pilot stage. Drop that on the next strategy call and the ”are we actually doing this or just talking about it” conversation writes itself.

Go deeper: Track where AI value is actually landing in real time →

The Track of the Day

”Everyone loves to talk about technical debt, but they conveniently ignore or avoid the emotional damage that comes with it.”
— John Boesen, on the hidden cost of legacy technology

Today's set closes on the record nobody requests but everybody needs: the maintenance track. The whole week was a fight over the rules, who loosens them, who tightens them, who warns about them, while the actual work sat untouched in the back room: dirty data, orphaned pilots, run-rates nobody modeled. The operator reading only the regulation headlines is arguing about the noise ordinance while the PA hums unwired. The one who walks into Wednesday with a data-quality score and a named owner for every AI project is the one whose set actually lands.

Yves Mulkers, your data DJ, mixing 190,000 articles into the tracks that actually matter.

We scanned 190,000 articles this week so you don't have to. Data Pains → Business Gains.

Published: May 26, 2026 | Curated by Yves Mulkers @ Ins7ghts