The Signal — March 21, 2026

Three stories today. Colorado reached consensus on rewriting its AI law, swapping compliance burdens for transparency requirements. BMG sued Anthropic for training Claude on copyrighted lyrics. And Cloudflare's CEO told SXSW that bot traffic will exceed human traffic by 2027.

Colorado Rewrites Its AI Law

Colorado's AI Policy Working Group released the KILO framework on Tuesday, a consensus proposal to replace SB 24-205, the state's 2024 AI Act that was already delayed from February 1 to June 30, 2026. The original law drew enough opposition that President Trump's executive order on AI specifically called it out.

The core shift: instead of a compliance-heavy system requiring risk assessments and impact statements before deployment, KILO takes a transparency-first approach. Companies using AI or automated decision-making tools in consequential decisions (employment, housing, insurance, finance, healthcare, education, public benefits, government services) must provide up-front notice to the people affected. If someone receives an adverse decision, the deployer has 30 calendar days to deliver a plain-language explanation and instructions for requesting human review.

The asterisk is in the details. Human review is required only "to the extent commercially reasonable," a phrase that gives deployers significant discretion over when they actually have to put a person in the loop. Enforcement sits exclusively with the Attorney General. There's no private right of action, meaning individuals can't sue on their own.

The political timeline adds pressure. AG Phil Weiser, who's running for governor in 2026, is termed out at the end of this year. Rulemaking has to finish before he leaves. Governor Polis endorsed the framework. More than 50 organizations, including CDT and the ACLU of Colorado, backed the earlier AI Sunshine Act that informed this effort.

The timing matters beyond Colorado's borders. The White House released a four-page AI framework on Thursday urging Congress to preempt state laws with a single national standard. Michael Kratsios called for "one national AI framework, not a 50-state patchwork." Colorado is now the first state to reach consensus on overhauling an existing AI law, which makes it either a model for that federal standard or a target for preemption, depending on who wins the argument.

Sources: GovTech · Colorado Springs Gazette · Governor's Office

BMG Sues Anthropic Over Copyrighted Lyrics

BMG Rights Management filed suit against Anthropic on Tuesday in California federal court, alleging the company used copyrighted song lyrics to train Claude. The complaint names works by Justin Bieber, Bruno Mars, Ariana Grande, and the Rolling Stones, among others. BMG is seeking up to $150,000 per song in damages.

The lawsuit follows a pattern that's now systematic. Universal Music Group and the RIAA have already filed against other AI companies. BMG, one of the world's three largest music publishers, is working through the major AI providers methodically. The per-song damages framing is significant because it could establish a pricing template for training data that the industry has been trying to set since these cases began.

The same week, GEMA (Germany's music rights organization) had a hearing against Suno in Munich, opening a European front in the same fight. The music industry isn't picking one jurisdiction or one defendant. It's testing the legal theory everywhere simultaneously.

For Anthropic specifically, this adds to existing copyright litigation. The company has argued that training on publicly available data constitutes fair use. Courts haven't resolved that question yet, and the BMG case will add another data point to what's becoming a multi-front legal war over whether AI training requires licenses.

Sources: Reuters · Rolling Stone · Billboard

Cloudflare's CEO: Bot Traffic Will Exceed Human Traffic by 2027

Matthew Prince, co-founder and CEO of Cloudflare, told a SXSW audience this week that AI-driven bot traffic will surpass human traffic on the internet by 2027. His example: an AI agent shopping for a camera visits roughly 1,000 times more websites than a human doing the same search, pulling specs, reviews, and pricing data across hundreds of sources before making a recommendation.

Cloudflare handles approximately 20% of global web traffic, so the company has real data behind this claim. Prince's prediction isn't abstract forecasting. It's an extrapolation from traffic patterns the company already sees.

Alongside the prediction, Cloudflare launched "AI Security for Apps" into general availability. The product gives website operators tools to manage AI agent traffic, including structured Markdown and JSON error payloads that tell agents why they were blocked and how to authenticate properly. It's infrastructure for a web where the majority of "visitors" are software.

The business incentive is obvious. Cloudflare sells security and performance services for web traffic. More traffic, especially traffic that needs new management tools, means more customers. But the underlying observation holds regardless of who profits from it: the ratio of machine-to-human requests is climbing fast, and most web infrastructure was built assuming the opposite.

Sources: TechCrunch · Search Engine Land · CyberNews

On the Editor's Desk

The White House released its AI policy framework on Thursday, a four-page document urging Congress to preempt state AI laws with a single national standard. Michael Kratsios called for "one national AI framework, not a 50-state patchwork." The document is deliberately vague on enforcement mechanisms. It pairs directly with the Colorado story above: the federal government wants to supersede exactly the kind of state-level innovation Colorado just produced. Whether Congress acts on it before Colorado's rulemaking deadline is the question.

Tesla's Terafab launch is happening today at Giga Texas, a planned $20-25 billion AI chip fabrication facility. No confirmed details beyond the pre-announcement. We'll cover it when substance arrives.

The Hegseth/Pentagon/Claude story continues developing, but we've covered it extensively since early March. Holding for genuinely new developments rather than repackaging the same information.

166 events came through the pipeline today. 116 were killed. 9% pass rate, typical for a Saturday cycle.