Nobody Is Driving the Agent Economy

On May 14, Colorado Governor Jared Polis signed SB 189 and quietly dismantled the most ambitious AI law in the country. The original Colorado AI Act — the 2024 statute that was supposed to take effect June 30 and impose a duty of care, impact assessments, and algorithmic-discrimination protections on high-risk systems — was repealed before it ever drew breath. In its place is a thinner thing called CADMA, the Colorado Automated Decision-Making Technology Act, which doesn't even arrive until January 2027 and asks mostly for disclosures. The duty of care is gone. The risk-management mandate is gone. The reporting obligations to the attorney general are gone.

This was supposed to be the law everyone else copied. Instead it became the law everyone watched collapse.

Colorado didn't fold in a vacuum. On June 2, President Trump signed an executive order, "Promoting Advanced Artificial Intelligence Innovation and Security," whose entire premise is that America leads in AI precisely because it refuses to "stifle" the industry with rules. The order builds on a January 2026 DOJ litigation task force explicitly chartered to identify and challenge state AI laws that conflict with national policy. The message to Denver, Sacramento, and Austin is not subtle: harmonize down, or get sued. The states that spent two years writing guardrails are now the defendants.

The vacuum has a timeline

Here is the part that should unsettle you. The retreat from regulation is happening at the exact moment the thing being regulated stops being a chatbot and becomes an actor. 2026 is the year AI agents went from drafting emails to executing transactions. MoonPay launched agentic payment infrastructure in February. Competing machine-to-machine payment protocols — x402, AP2, MPP — are now fighting to become the rails on which software agents pay each other in stablecoins, no human in the loop. Analysts are throwing around a $1.5 trillion agentic-commerce figure by 2030. An autonomous agent can now hold a wallet, read a price, and settle on-chain faster than any compliance officer can notice it happened.

So who is liable when it goes wrong? The honest answer is that nobody has decided. The doctrines we're reaching for are antiques. UETA Section 9 attributes an electronic agent's conduct to whoever deployed it. The Restatement of Agency treats anything acting on your behalf under your control as your agent, binding you to its acts. Courts will likely stretch vicarious liability — the employer-employee logic — over autonomous software and call it a day. Crucially, no jurisdiction grants an AI agent legal personhood, which means a human or a company must always be on the hook. California, to its credit, passed a law effective January 1 that bars firms from using an agent's "autonomous operation" as a liability shield. Even Trump's own order conceded the point in passing, directing the attorney general to prosecute anyone who weaponizes AI agents to illegally access or damage computers — an acknowledgment, buried in a deregulatory document, that an agent can do real harm and someone must answer for it.

But control is exactly the fiction that breaks. The whole pitch of an agent is that you don't supervise it. When a procurement bot overpays a counterparty it negotiated with itself, or an on-chain agent drains a treasury chasing a hallucinated arbitrage, "subject to your control" describes a relationship that no longer exists. We are about to litigate twenty-first-century autonomy with eighteenth-century agency law, in a country actively suing the few states that tried to write something newer.

Deregulation is a bet, not a default

None of this is an argument that Colorado's original act was good policy — plenty of compliance lawyers thought it was unworkable, and "pumping the brakes" was a defensible call. The problem isn't that one law died. The problem is the asymmetry. Capability is compounding monthly; legal clarity is being actively dismantled. The federal stance treats deregulation as the safe default and rules as the risky deviation. With agents now moving money, that has it backwards. The risky bet is the one where a trillion-dollar machine-to-machine economy runs on payment rails nobody chartered, settled in stablecoins nobody fully regulated, executed by agents nobody can quite say they controlled.

The companies building this know it. That's why MoonPay's agentic stack ships with transaction limits, identity verification, and a verified human tethered to every agent — not because Washington requires it, but because their lawyers can read the gap as well as anyone. Industry is privately building the guardrails that policy is publicly tearing down. When the first nine-figure agent failure lands in court — and it will, probably before CADMA even takes effect — the precedent won't be set by a legislature that thought it through. It'll be set by whichever plaintiff's firm gets there first, against whichever company left the seat empty.

That is the actual state of tech policy in June 2026: the agents learned to drive, the regulators got out of the car, and everyone is pretending the road is straight.