What Changes for AI Products in 2027 and What It Means for Your Roadmap

Frequently Asked Questions

01.Does California's ADMT rule apply to my AI product?

It applies if you are a business covered by the CCPA and you use automated decisionmaking technology to make a significant decision about a consumer, such as hiring, lending, housing, education enrollment or healthcare services. Technology counts when it replaces or substantially replaces human decisionmaking. A business already doing this before 1 January 2027 must comply by that date.

02.What changes in the EU AI Act in 2027?

Two dates matter. Providers of general-purpose AI models placed on the market before 2 August 2025 must comply by 2 August 2027. From 2 December 2027, the high-risk requirements apply to Annex III systems, which cover many hiring, credit scoring and education uses unless an Article 6(3) exception applies, and that exception is never available where the system profiles people. Systems already on the market before that date are covered only if their design changes significantly afterwards. Article 50 transparency duties have applied since 2 August 2026, with machine-readable marking for older generative systems due by 2 December 2026, so they are a 2026 item, not a 2027 one.

03.How much notice do model vendors give before retiring a model?

It varies by vendor. Anthropic says it gives at least sixty days' notice before retiring a publicly released model. OpenAI says generally available models get at least six months, specialized variants and image models at least three months, and preview models much shorter notice, unless safety or compliance concerns require a faster timeline. Record each vendor's floor in your model dependency register.

04.Is Colorado's AI Act still taking effect?

Not in its 2024 form. SB 26-189, signed on 14 May 2026, repealed and re-enacted that part of Colorado law as a narrower act on automated decision-making technology. It takes effect on 1 January 2027 and applies to consequential decisions made on or after that date, with a notice duty, an explanation within thirty days of an adverse outcome, and, on request, a way to correct inaccurate personal data and human review where commercially reasonable.