Unapproved AI tools and regulatory exposure

Your organization operates in Colorado, which places you within the jurisdiction of the Colorado AI Act, effective January 1, 2027. The statute regulates "covered ADMT" — automated decision-making technology that materially influences a consequential decision in employment, education, lease or purchase of Colorado residential real estate, financial or lending services, insurance, healthcare services, or essential government services and public benefits. Deployer obligations include pre-use consumer notice, post-adverse-outcome disclosure, consumer right to correction of inaccurate data, and meaningful human review to the extent commercially reasonable. Enforcement is exclusively by the Colorado Attorney General under the Colorado Consumer Protection Act; a 60-day cure period applies (waivable for knowing or repeated violations) and there is no private right of action. The Colorado AG is conducting rulemaking on multiple required topics through 2026, which will further specify implementation.

Because your most active departments are Legal, Finance, and HR, the Colorado AI Act's consequential-decisions framing applies directly to several tools in your inventory. Tools that ingest, transcribe, or process personal information about identifiable individuals — Fireflies.ai, Otter.ai, Glean, and the Microsoft 365 Copilot deployment — carry the most direct obligations. Note that general-purpose AI chatbots are conditionally excluded from ADMT scope only when both (a) not configured or marketed for consequential decisions and (b) subject to an acceptable use policy prohibiting such use. Your AI policy status of "Not sure" means the second condition is presumptively unmet, putting general-purpose AI tools in scope. See the tool-by-tool assessment below for specific recommendations.

The California Privacy Protection Agency's ADMT regulations apply to businesses meeting the CCPA business threshold: $25M+ annual revenue, or processing personal information of 100,000+ consumers or households, or deriving 50%+ of revenue from selling or sharing personal information. For an organization of your headcount band with EU exposure indicated, California consumers, employees, or applicants are typical and the CCPA threshold is presumptively met. The regulations themselves took effect January 1, 2026, with ADMT-specific obligations (pre-use notice, opt-out rights, access rights) effective January 1, 2027. Risk-assessment obligations for "significant risk" processing — including using or training ADMT for significant decisions — are running now, with assessments for ongoing 2026-2027 processing due to be completed by December 31, 2027 and a summary attestation to CPPA due April 1, 2028. CCPA penalties are up to $2,500 per violation, up to $7,500 per intentional violation or per violation involving a minor.

ADMT under California's regulations is defined more narrowly than Colorado's — California's trigger requires the technology to replace or substantially replace human decision-making, which fails if a human reviewer (a) knows how to interpret the output, (b) reviews the output and other relevant information, and (c) has authority to make or change the decision. Tools where human review is present but cursory still trigger ADMT obligations. Significant-decision domains under California's regulations include financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, and healthcare services; advertising is explicitly excluded. Tools in your inventory most likely to trigger California ADMT obligations are those used in HR and employment workflows where human review is undocumented — Glean, Microsoft 365 Copilot in HR-facing use, and meeting intelligence platforms used in recruiting or performance review. Tools used to train ADMT on personal information also fall under risk-assessment obligations even if not directly used in significant decisions.

Your stated profile indicates EU exposure — customers, employees, or operations within the EU. The EU AI Act applies to any provider or deployer of AI systems whose output is used within the EU, regardless of where the organization is based. Phased obligations are in effect: prohibited-practice provisions have applied since February 2, 2025; general-purpose AI governance obligations took effect August 2, 2025; high-risk obligations under Annex III apply from August 2, 2026. Penalties for high-risk violations reach €15M or 3% of global annual turnover, whichever is higher.

Several tools in your inventory fall within EU AI Act scope. Tools used in employment-related decisions sit squarely within Annex III high-risk categories — including Glean (when used for HR knowledge retrieval) and meeting intelligence platforms used for performance or recruiting reviews. Tools generating public-facing content (Jasper AI, Adobe Firefly) trigger Article 50 transparency-labeling obligations. Tools embedded in employee workflows (Cursor.sh, Microsoft 365 Copilot, GitHub Copilot, OpenAI) require documented risk management under Article 13. Documentation gaps are the most immediate exposure.