AI and trade rules demand proof, duty enforcement tightens, and stablecoins face supervisory alignment

Colorado and CMMC Turn AI and Security Rules into Workflow Proof

Colorado’s 2026 AI rewrite now turns governance into workflow design. The rules cover only automated decision-making technology that materially affects consequential decisions, but the remaining obligations are concrete: notice, disclosure of adverse decisions, correction rights, meaningful human review, three-year recordkeeping, and adverse-outcome information within 30 days. Enforcement sits with the Colorado Attorney General, with a conditional 60-day cure period. Separate chatbot rules for minors add age estimation, AI disclosure, privacy and account tools, and self-harm protocols. In parallel, the Department of War’s July 13, 2026 launch of a 60-day CMMC review paused Phase II and later rollout milestones while Phase I self-assessments remain in force, signaling recalibration of assessment mechanics rather than relaxation.

That fits the broader pattern already taking shape: Nigeria’s sovereign cloud framework, the EU’s provider oversight and cross-border rules, the White House’s voluntary AI evaluation guide, and the backlash to EU watermarking mandates all point to the same demand for proof that controls work. For Government & Regulatory Affairs teams, the work is now moving further upstream into product scoping, security review, procurement terms, and records design. The career edge now belongs to practitioners who can turn legal text into auditable workflows and coordinate evidence across technical, vendor, and consumer-rights processes.

Enforcement and Counter-Enforcement Tighten Around Trade Flows

CBP said this week that EAPA investigations uncovered more than $400 million in unpaid duties tied to illegal transshipment and other tariff-evasion schemes, with Southeast Asia flagged as a key routing channel for Chinese-origin goods. That pushes the story from broad compliance integration into transaction-level proof: origin, classification, and valuation now have to withstand enforcement scrutiny case by case. DOJ’s Trade Fraud Task Force is applying the same logic through duty-evasion cases built on country-of-origin misstatements, undervaluation, and false classification, including Ceratizit USA’s $54.4 million resolution involving tungsten carbide products from China.

The pressure is widening beyond customs. The EU added 51 entities tied to Russia’s military-industrial base, while China placed 14 EU entities on its export-control list and halted dual-use shipments to them without MOFCOM approval. China also broadened outbound investment review to indirect interests, financing, guarantees, and control rights. Even where flexibility remains, such as U.S. auto tariff talks, trade, sanctions, and investment decisions are becoming more conditional and evidence-driven.

For Government & Regulatory Affairs teams, the work now centers on continuous validation of origin, counterparties, and transaction structure with customs, legal, procurement, and finance. The career edge will go to people who can turn scattered enforcement signals into fast escalation decisions before they become duty, licensing, or market-access failures.

Preemption and Supervisory Alignment Become the Operating Constraint

Treasury this week proposed GENIUS Act stablecoin rules that would treat permitted payment stablecoin issuers as financial institutions for Bank Secrecy Act purposes, forcing AML and sanctions programs and limiting sales to U.S. persons unless the stablecoin comes from a permitted or qualifying foreign issuer. The proposal also keeps a state supervisory route for issuers with $10 billion or less in outstanding stablecoins, but only if the state regime is “substantially similar” to the federal framework.

That same jurisdictional pressure is showing up elsewhere. Crypto.com and Washington paused their event-contract dispute because the preemption issue is already before the Ninth Circuit, with an 18-month backstop and a 14-day notice-out. Separately, a federal court preempted New Jersey’s cannabis labor rule after finding its labor-peace agreement mandate conflicted with the NLRA under Machinists and Garmon. For compliance, policy, and legal teams, the practical task is no longer just meeting substantive rules; it is mapping which regulator’s framework controls, where state regimes can survive, and when preemption will decide the outcome before the merits do.