Global Tech Policy Tracker — 2026-05-18

Top Story

1 sources

coloradopolitics.com

coloradopolitics.com

U.S. House Talks Target State AI Preemption as White House Mulls Mandatory Frontier Model Vetting

The most consequential AI policy story of the week is playing out simultaneously at two levels of the U.S. government. According to POLITICO, House negotiators are actively discussing legislation that would block certain state AI laws — including high-profile measures in California and New York — from taking effect. The talks represent a significant shift in the federal-state balance of AI governance and signal that Congress may move toward a national preemption framework before states can build a durable patchwork.

In parallel, the White House is weighing what would be a landmark shift in its own posture. As reported by POLITICO, the administration is considering an executive action requiring federal government vetting of frontier AI models before their public release — a direct response to the emergence of Anthropic's Claude Mythos, which is described as having "unprecedented hacking capabilities." The deliberations represent a striking pivot for the Trump administration, which had previously embraced a hands-off approach championed by AI-friendly venture capitalists. Former Homeland Security Secretary Mayorkas, meanwhile, endorsed "voluntary" policies for frontier model security but referenced the Biden-era blueprint as a model. The White House has been meeting with tech companies for several weeks on the issue, and multiple people cautioned that the deliberations remain in flux.

The convergence of federal preemption talks and potential executive action on model vetting marks the most significant week for U.S. AI governance architecture since the Trump executive order on AI policy issued in December 2025. If either track advances, it would reshape the compliance landscape for every major AI lab operating in the United States.

2 sources

politico.com

politico.com

politico.com

politico.com

New Legislation & Regulatory Actions

United States: Colorado SB 26-189 — AI Law Rewrite Signed

• What happened: After a two-year legislative battle, Colorado's governor signed a dramatically scaled-back rewrite of the state's landmark 2024 AI law. The new law (SB 26-189) strips most of the original act's disclosure requirements — companies creating and deploying AI systems that influence "consequential" decisions on hiring, loans, and housing are no longer required to disclose how those systems work to affected individuals.
• Who it affects: Any business using AI systems in Colorado for employment, credit, or housing decisions, as well as AI developers targeting those markets.
• Status: Signed into law as of approximately May 12–13, 2026. The new law replaces the original statute ahead of its June 30, 2026 implementation deadline.
• Why it matters: Colorado was the first U.S. state to attempt broad AI regulation of consequential decision-making. The gutted rewrite signals how difficult it is to pass substantive AI regulation even in states that tried early — and reinforces the argument that only federal action can create uniform rules.

United States (Federal): House AI Talks — State Law Preemption

• What happened: House lawmakers are engaged in internal negotiations over provisions that would preempt certain state AI laws, specifically named California and New York. Details of the talks had not been previously reported, according to POLITICO.
• Who it affects: AI companies operating across multiple states; California and New York tech sectors; state legislatures that have invested in their own AI frameworks.
• Status: Active negotiations, no legislation introduced yet as of May 15, 2026.
• Why it matters: Federal preemption would override the growing patchwork of state AI laws but could also set a lower compliance floor than states like California were pursuing. The talks coincide with White House deliberations on frontier model vetting, suggesting a broader federal AI governance push may be imminent.

European Union: AI Act Omnibus Simplification — Deal Reached

• What happened: The EU Council and European Parliament reached a provisional agreement on the AI Act Omnibus simplification package. Key changes include: delaying high-risk AI system obligations from August 2026 to December 2027; simplifying compliance requirements for providers; clarifying overlaps with the Machinery Regulation; and notably banning "nudifier" apps outright.
• Who it affects: All AI providers, deployers, and importers operating in EU markets, particularly those in high-risk sectors (biometrics, utilities, health, creditworthiness, law enforcement).
• Status: Provisional deal reached May 7, 2026 after marathon negotiations. Still requires formal ratification by both institutions.
• Why it matters: Critics say the deal shows "Europe caving in to Big Tech" pressure. The delay gives companies more runway but also weakens near-term consumer protections. The nudifier ban is notable as a concrete new prohibition added through the simplification process.

United States (State): Missouri AI Regulation Bill Killed in Committee

• What happened: A Missouri state House committee killed an AI regulation bill that would have established several provisions governing AI use in the state.
• Who it affects: AI companies that were tracking Missouri's legislative process; advocates for state-level AI governance.
• Status: Dead in committee as of approximately May 13, 2026.
• Why it matters: Missouri joins a growing list of states where AI regulation efforts have failed at the committee stage, underscoring the difficulty of passing AI bills at the state level even as the technology advances.

Enforcement & Penalties

• EU AI Act Enforcement Mechanism → Market (No Fines Yet): As of mid-May 2026, no formal AI Act fines have been levied. The penalty framework — with fines up to €35 million or 7% of global turnover for prohibited AI practices, and up to €15 million or 3% for high-risk violations — technically became applicable for Article 5 (prohibitions) and GPAI obligations from August 2, 2025. However, enforcement deadlines for Annex III high-risk system obligations don't apply until August 2, 2026. The Omnibus deal's delay of high-risk rules to December 2027 further extends the effective enforcement timeline for most enterprise use cases.

• White House → Frontier AI Model Developers (Potential Executive Action): The Trump administration is actively considering requiring federal vetting of frontier AI models before public release, specifically in response to Anthropic's Claude Mythos and its described "unprecedented hacking capabilities." No formal enforcement action has been taken, but companies developing frontier models are on notice that pre-release government review could become mandatory. The White House has held multiple meetings with tech companies on this issue in recent weeks.

Industry Response

• Anthropic (Implicit): Anthropic's Claude Mythos model has become the proximate trigger for White House deliberations on mandatory frontier model pre-release vetting. The model's described "unprecedented hacking capabilities" have prompted the administration to shift from its previously laissez-faire stance. This represents a significant moment for the frontier AI lab — its technology may directly shape the federal regulatory framework it will have to comply with.

• Colorado AI Sector / Business Groups: Governor Polis signed the dramatically pared-down SB 26-189, which consumer advocates describe as stripping the original AI law of virtually all its substantive requirements. The rewrite removes disclosure requirements for AI systems used in consequential decisions. Business groups that had lobbied against the original law effectively achieved most of what they sought. Advocacy groups opposed the weakened bill but were unable to stop it.

• Big Tech (EU Context): Critics of the EU AI Act Omnibus deal, which passed May 7, specifically accuse "Big Tech" of lobbying European institutions into accepting delays and simplifications that weaken consumer protections. While no specific company was named in the Council's press release, Reuters and Slaughter and May's analysis both frame the deal as a response to tech industry pushback that started with the European Commission's November 2025 Digital Omnibus proposal.

• Yale/NYU Academics (U.S. Policy Framework): Jeffrey Sonnenfeld and Stephen Henriques (Yale) and Gary Marcus (NYU) published an op-ed in Fortune arguing that the U.S.'s 1,200+ active AI bills constitute "legislative noise" without a coherent evaluative framework, and proposing a methodology for separating necessary AI regulation from the noise. The piece signals growing academic frustration with the fragmented U.S. policy landscape.

Region Scorecard

Analysis: What This Means

• For frontier AI labs: The White House's consideration of mandatory pre-release federal vetting is the most immediate near-term risk. Labs developing large language models with dual-use capabilities (especially security/hacking applications) should engage proactively with the administration's ongoing consultations rather than wait for executive action to land. Companies like Anthropic, OpenAI, Google DeepMind, and Meta should model compliance scenarios assuming some form of pre-release review becomes mandatory within 6–12 months.

• For AI startups deploying in multiple U.S. states: The House preemption talks cut both ways. If federal preemption passes, companies currently tracking 1,200+ state AI bills could face a single, potentially lower federal floor instead — reducing compliance costs but also potentially limiting state-level innovation in consumer protection. Do not pause compliance planning for existing state laws (California, New York, etc.) while preemption is being debated; those laws remain in effect.

• For enterprises with EU exposure: The Omnibus deal's delay of high-risk AI obligations to December 2027 provides meaningful additional runway, but the penalty framework for prohibited AI practices (Article 5) and GPAI obligations is already in force from August 2025. Boards should not interpret "simplification" as regulatory relief — the fines (up to 7% of global turnover) remain unchanged and are already applicable for the most serious violations.

• For compliance teams tracking state laws: Colorado's SB 26-189 demonstrates that original AI regulations can be gutted in subsequent legislative sessions under industry pressure. Any compliance program built around state disclosure requirements should incorporate scenario planning for legislative rollback, not just regulatory enforcement.

What to Watch Next Week

1. White House executive action on frontier AI: The administration's deliberations on mandatory pre-release model vetting are described as "in flux" — watch for any executive order or agency guidance that formalizes requirements for companies like Anthropic. This could move quickly given the national security framing around Claude Mythos.

2. House AI preemption legislation: Whether formal legislative text emerges from the House negotiations on blocking state AI laws, and how California and New York respond. State attorneys general may signal legal challenges if preemption language appears.

3. EU AI Act Omnibus formal ratification: The May 7 provisional deal still needs formal ratification by both the European Parliament and Council. Watch for votes or committee sign-offs, as well as any last-minute pushback from civil society groups critical of the weakened provisions.