The US state AI laws tracker.

What changed in 2026

Every entry below is dated, and each links to the section of this tracker that carries the detail. The single most consequential change of the year is that the state everyone cited as the model for AI regulation repealed its own law before it took effect.

Two patterns are worth naming because they change how a multi-state program should be planned. First, the direction of travel is no longer one-way: Colorado demonstrated that a comprehensive state AI law can be repealed and narrowed before it binds anyone, so building a compliance program against a single state statute now carries repeal risk as well as deadline risk. Second, the center of gravity has moved from broad algorithmic-discrimination statutes toward two narrower shapes — transparency and disclosure duties for automated decisions, and frontier-model safety obligations aimed at a handful of large developers. An organization that is neither a frontier developer nor a user of ADMT in significant decisions is touched by far less of this than the headlines suggest.

Effective-date calendar

The dates that bind, in order. Dates in the past are obligations already live; dates in the future are the planning horizon. Each entry is covered in more detail in the state section it belongs to.

The US AI Regulatory Landscape

Unlike the European Union, which enacted a comprehensive AI Act covering all member states, the United States has taken a fragmented approach to AI regulation. In the absence of federal legislation, individual states have begun enacting their own AI laws—creating a complex compliance landscape for organizations operating across state lines.

Why States Are Acting

Several factors are driving state-level AI regulation:

• Federal inaction: Despite multiple proposed bills, Congress has not passed comprehensive AI legislation, leaving a regulatory vacuum
• Consumer protection concerns: High-profile cases of algorithmic discrimination in hiring, lending, and insurance have prompted state responses
• Privacy law extension: States with existing privacy laws (California, Virginia, Connecticut, Colorado) are extending those frameworks to address AI
• Economic competition: States like California and Colorado are positioning themselves as leaders in responsible AI governance

Types of State AI Laws

State AI legislation generally falls into several categories:

Colorado: From the 2024 AI Act to the SB 26-189 ADMT Regime

Colorado was the first state to enact a comprehensive AI law — and the first to walk it back. The 2024 Colorado AI Act (SB 24-205) was repealed and replaced before it ever took effect by SB 26-189, titled “Automated Decision-Making Technology,” which Governor Polis signed on May 14, 2026. The new law trades the old reasonable-care-and-impact-assessment model for a narrower transparency and disclosure regime built around “covered automated decision-making technology (ADMT).” Substantive obligations commence January 1, 2027, by which date the Attorney General must also adopt clarifying rules.

Developer Requirements

Under SB 26-189, developers of covered ADMT must provide each deployer documentation that includes:

• Intended uses and known harmful or inappropriate uses
• The categories of training data, to the extent known
• Known limitations and risks, and circumstances where the ADMT should not be used
• Instructions for appropriate use, monitoring, and meaningful human review
• The information a deployer needs to meet its own obligations

Records are retained for at least three years. No disclosure of proprietary source code, model weights, or trade secrets is required.

Deployer Requirements

Deployers of covered ADMT owe four operational duties, with at least three-year recordkeeping:

• Pre-use notice — clear-and-conspicuous notice before covered ADMT is used to materially influence a consequential decision
• Post-adverse-outcome disclosure within 30 days — a plain-language description of the ADMT’s role plus the consumer’s rights and how to exercise them
• Data correction — on request, access to and correction of factually inaccurate personal data used by the ADMT
• Meaningful human review or reconsideration — on request, to the extent commercially reasonable

The earlier risk-management-program requirement, annual impact assessments, the 90-day Attorney General notification on discovering discrimination, and the standalone “you are interacting with an AI” chatbot disclosure did not survive the rewrite. Discrimination is now addressed under existing Colorado anti-discrimination law, and there is no longer a size-based small-business exemption.

For comprehensive coverage, see our Colorado AI Act Complete Compliance Guide.

California: The Privacy Leader Expands to AI

California leads US states in data privacy regulation, and its frameworks increasingly address AI. While California hasn’t enacted a comprehensive AI law equivalent to Colorado’s, multiple overlapping regulations affect AI deployment:

California Consumer Privacy Act (CCPA/CPRA)

California Automated Decision-Making Technology (ADMT) Regulations

The California Privacy Protection Agency (CPPA) finalized its ADMT, risk assessment, and cybersecurity audit regulations, which took effect January 1, 2026. The rules phase in over the following 24 months, with the most consequential obligations for AI systems used in "significant decisions" beginning January 1, 2027. Key provisions:

• Pre-use notice: Detailed disclosure before ADMT is used in significant decisions
• Opt-out rights: Consumers may request human review or alternative processes
• Access to logic: Businesses must explain how automated decisions are made
• Risk assessments: Required for ADMT used in significant decisions and other high-risk processing
• Cybersecurity audits: Annual independent audits for businesses whose processing presents significant risk

The regulations are now in force. Businesses already had to begin complying on January 1, 2026 for baseline obligations; significant-decision ADMT requirements, risk assessments, and the first cybersecurity audit cycle phase in through 2027 and 2028 depending on business size.

California Pending AI Legislation

California’s legislature has considered multiple AI bills, including proposals modeled on the EU AI Act:

• SB 1047 (2024): "Safe and Secure Innovation for Frontier Artificial Intelligence Models Act" - Originally imposed significant requirements on large AI models; later amended significantly before passing
• AB 2013 (2024): AI training data transparency for generative AI
• AB 2885 (2024): AI watermarking for synthetic content
• Healthcare AI bills: Multiple proposals addressing AI in clinical settings

Illinois: Biometrics and Employment AI Pioneer

Illinois has been at the forefront of regulating specific AI applications, particularly biometric data and employment decisions:

Illinois Biometric Information Privacy Act (BIPA)

BIPA has generated significant litigation against AI companies using facial recognition technology, with settlements reaching hundreds of millions of dollars. The law effectively prohibits most commercial facial recognition uses without explicit consent.

Illinois Artificial Intelligence Video Interview Act (AIVIA)

Illinois Employment AI Legislation

Illinois continues to expand employment AI regulation:

• HB 3773 (2024): Broader employment AI transparency and discrimination prevention requirements
• Amendments to AIVIA: Expanded disclosure and consent requirements
• Human Rights Act integration: AI discrimination treated as civil rights violation

Texas: TRAIGA Now in Force

Texas, with its large technology sector and business-friendly reputation, has moved from a measured stance to enacting one of the most consequential state AI laws. Texas HB 149, the Texas Responsible Artificial Intelligence Governance Act (TRAIGA), took effect January 1, 2026 and is now live. It prohibits certain AI uses (including intentional discrimination and unlawful manipulation), establishes disclosure obligations for consumer-facing AI, and creates Attorney General enforcement with civil penalties up to $200,000 per violation.

Texas HB 149 (TRAIGA)

Texas Capture or Use of Biometric Identifier Act (CUBI)

Texas Data Privacy and Security Act (TDPSA)

Effective July 1, 2024, the TDPSA includes provisions affecting AI:

• Profiling opt-out: Consumers can opt out of profiling for decisions with legal or significant effects
• Data protection assessments: Required for processing that presents heightened risk, including profiling
• No private right of action: Attorney General enforcement only

Texas AI Advisory Council

Texas established an AI Advisory Council to study AI issues and recommend legislation. Areas under consideration include:

• AI in government decision-making
• AI in healthcare and insurance
• AI workforce implications
• AI safety and security standards

New York: Local and State AI Regulation

New York presents a complex regulatory landscape with both city-level and state-level AI requirements:

New York City Local Law 144 (Automated Employment Decision Tools)

April 2026 enforcement update. The New York State Comptroller’s December 2, 2025 audit found NYC DCWP enforcement of Local Law 144 “ineffective” — 75% of 311 calls about AEDTs were misrouted. DCWP committed to proactive investigations starting in 2026, increasing the likelihood of enforcement actions for employers and AEDT vendors operating in NYC.

New York RAISE Act (frontier AI)

The Responsible AI Safety and Education Act (S6953B / A6453B) was originally signed by Governor Hochul on December 19, 2025; the final chapter amendment was signed on March 27, 2026. It is the second US state frontier-model law (after California SB 53) and takes effect January 1, 2027.

• Scope: Large frontier developers (training-compute and revenue thresholds aligned to SB 53).
• Obligations: Publish safety protocols; report critical incidents to the Department of Financial Services within 72 hours.
• Oversight: A new oversight office within DFS will assess large frontier developers.
• Enforcement: Attorney General may bring civil actions; penalties up to $1 million for first violation, $3 million for subsequent.

Other New York AI legislation

• NY SHIELD Act: data security requirements applicable to AI systems processing personal information.
• NYDFS Insurance Circular Letter No. 7 (2024): AI underwriting and pricing guidance for licensed insurers.
• Healthcare AI bills: requirements for AI in clinical decision-making (pending).

Other State AI Laws and Pending Legislation

Beyond the major states covered above, AI regulation is advancing across the country:

States with Privacy Laws Including AI Provisions

States with Biometric/Facial Recognition Laws

States with Government AI Restrictions

Several states have enacted or proposed restrictions on government use of AI:

• California: Restrictions on law enforcement facial recognition
• Massachusetts: Proposed moratorium on government facial recognition
• Maine: Limits on law enforcement use of facial recognition
• Vermont: Restrictions on government AI without human oversight
• Washington: State agency AI accountability requirements

State AI Law Comparison Matrix

This matrix provides a high-level comparison of key AI regulatory requirements across major states:

Federal context and the preemption push

The federal landscape changed materially in late 2025 and now actively shapes how state AI law plays out.

The December 2025 executive order

On December 11, 2025, President Trump signed “Eliminating State Law Obstruction of National Artificial Intelligence Policy.” The order:

• Establishes an AI Litigation Task Force within the Department of Justice to challenge state AI laws on commerce-clause and preemption grounds. (Colorado’s 2024 SB 24-205 had drawn early scrutiny, but the state has since repealed and replaced it with SB 26-189 — a state legislative change, not a federal preemption.)
• Directs the FTC to articulate when state laws “requiring alterations to truthful AI outputs” are preempted by Section 5 of the FTC Act.
• Conditions roughly $42 billion of BEAD broadband funding on state repeal of “burdensome” AI regulation.
• Carves out child-safety, AI-compute and data-centre infrastructure, and state procurement from preemption.

A bipartisan coalition of 36 state attorneys general publicly opposed broad federal preemption in March 2026; the Senate previously voted 99–1 to strip a similar preemption provision from the budget reconciliation bill, and a rumored FY2026 NDAA moratorium was omitted from the final bill text. No federal statute or court has preempted or paused state AI law; the political contest remains unresolved as of June 2026.

Senate AI Working Group and proposed federal bills

Senator Marsha Blackburn’s TRUMP AMERICA AI Act would codify the executive order into statute and create comprehensive federal AI governance, but remains in committee. The Bipartisan Senate AI Working Group reports continue to be a roadmap document rather than enacted law.

NAAG state AG AI Task Force

In early 2026 Utah Attorney General Derek Brown (R) and North Carolina Attorney General Jeff Jackson (D) launched a bipartisan AI Task Force in partnership with OpenAI, Microsoft, and the Attorneys General Alliance. The task force coordinates state AG investigations and monitors emerging AI risks — especially child-safety and chatbot harms.

Why no comprehensive federal AI law yet

Despite bipartisan interest, federal AI legislation has stalled due to:

• Partisan disagreement on the regulation-versus-innovation balance.
• Preemption disagreement — many governors of both parties (CA, FL, CO) oppose stripping state authority.
• Definitional challenges in scoping “AI” and “high-risk” applications.
• Jurisdictional complexity across Senate and House committees.

Existing Federal AI-Related Laws

While no comprehensive AI law exists, several federal laws affect AI deployment:

• Civil Rights Act (Title VII): Prohibits employment discrimination, including via AI
• Fair Credit Reporting Act (FCRA): Governs AI used in credit and background checks
• Equal Credit Opportunity Act (ECOA): Prohibits lending discrimination
• Fair Housing Act: Applies to AI in housing decisions
• Americans with Disabilities Act: AI accessibility requirements
• HIPAA: Governs AI processing protected health information

Federal Agency Guidance

Federal agencies have issued AI guidance within their regulatory domains:

• EEOC: Guidance on AI in employment decisions (May 2023)
• FTC: Enforcement actions against deceptive AI practices
• CFPB: Statements on AI in consumer financial services
• FDA: Guidance on AI/ML medical devices
• HHS OCR: AI guidance for HIPAA covered entities

NIST AI Risk Management Framework

The NIST AI RMF, released January 2023, provides a voluntary framework that multiple state laws reference. Colorado’s 2024 AI Act once offered a rebuttable-presumption safe harbor for following NIST AI RMF or ISO/IEC 42001, but SB 26-189 removed it and provided no replacement; the frameworks remain sound governance practice rather than a codified legal defense in Colorado. NIST 1.1 has not yet been released; through 2026 NIST is publishing addenda and profiles, including the Generative AI Profile (NIST AI 600-1, July 2024) and an AI RMF Profile on Trustworthy AI in Critical Infrastructure (concept note released April 7, 2026).

Multi-State Compliance Strategy

Organizations operating across multiple states need a strategic approach to managing divergent requirements:

Highest Common Denominator Approach

Rather than maintaining separate compliance programs for each state, implement controls satisfying the strictest applicable requirements:

GLACIS Framework

Multi-State AI Compliance

1

Adopt NIST AI RMF

Implement NIST AI Risk Management Framework as baseline. It maps to most state requirements and remains sound governance practice — though, following SB 26-189, it is no longer a codified safe harbor in Colorado. Document implementation across all four functions: Govern, Map, Measure, Manage.

2

Implement Comprehensive Impact Assessments

Create impact assessment templates that satisfy California CPRA, NYC LL144, and pending state requirements. (Colorado’s SB 26-189 no longer mandates impact assessments, but the same artifacts still support its disclosure duties.) Include bias testing, discrimination risk analysis, and consumer rights documentation.

3

Build Unified Consumer Rights Infrastructure

Implement consumer-facing capabilities: opt-out mechanisms, explanation rights, data correction, appeal processes with human review. Design once, deploy across all states.

4

Document for Multiple Regulators

Maintain documentation that can be adapted for any state regulator: risk management policies, bias testing results, training records, incident response procedures. Use standardized formats (model cards, dataset cards).

5

Monitor Regulatory Evolution

Establish processes to track new state legislation, regulatory guidance, and enforcement actions. Update compliance programs proactively rather than reactively. Subscribe to AG office updates and industry associations.

Sector-Specific Considerations

Certain industries face additional state-specific requirements:

Healthcare AI

• HIPAA compliance remains primary federal requirement
• State health privacy laws may impose additional AI restrictions
• Insurance AI regulations vary significantly by state
• Telehealth AI may trigger multiple state licensing requirements

Employment AI

• NYC LL144 sets high bar for bias auditing
• Illinois AIVIA requires video interview AI disclosure
• Colorado SB 26-189 treats employment as a consequential-decision domain for covered ADMT
• EEOC guidance applies nationally to Title VII compliance

Financial Services AI

• FCRA and ECOA provide federal baseline
• State fair lending laws may be more restrictive
• Insurance AI regulations are state-by-state
• Model risk management (SR 11-7) applies to banks

Frequently asked questions

Key takeaways