The US state AI laws tracker.

What changed in 2026

Every entry below is dated, and each links to the section of this tracker that carries the detail. The single most consequential change of the year is that the state everyone cited as the model for AI regulation repealed its own law before it took effect.

Two patterns are worth naming because they change how a multi-state program should be planned. First, the direction of travel is no longer one-way: Colorado demonstrated that a comprehensive state AI law can be repealed and narrowed before it binds anyone, so building a compliance program against a single state statute now carries repeal risk as well as deadline risk. Second, the center of gravity has moved from broad algorithmic-discrimination statutes toward two narrower shapes: transparency and disclosure duties for automated decisions, and frontier-model safety obligations aimed at a handful of large developers. An organization that is neither a frontier developer nor a user of ADMT in significant decisions is touched by far less of this than the headlines suggest.

Effective-date calendar

These are the dates that bind, in order. Anything already past is an obligation running now; anything ahead is the planning horizon. Each entry is covered in more detail in the state section it belongs to.

The US AI Regulatory Landscape

Unlike the European Union, which enacted a comprehensive AI Act covering all member states, the United States has taken a fragmented approach to AI regulation. In the absence of federal legislation, individual states have begun enacting their own AI laws, and organizations working across state lines now face a different set of obligations in each one.

Why States Are Acting

The pressure comes from four directions at once:

• Federal inaction: Despite multiple proposed bills, Congress has not passed comprehensive AI legislation, leaving a regulatory vacuum
• Consumer protection concerns: High-profile cases of algorithmic discrimination in hiring, lending, and insurance have prompted state responses
• Privacy law extension: States with existing privacy laws (California, Virginia, Connecticut, Colorado) are extending those frameworks to address AI
• Economic competition: States like California and Colorado are positioning themselves as leaders in responsible AI governance

Types of State AI Laws

Most of what has actually been enacted sorts into a few recognizable shapes. The table below groups them, with the states that have moved furthest in each:

Colorado: From the 2024 AI Act to the SB 26-189 ADMT Regime

Colorado was the first state to enact a comprehensive AI law, and the first to walk it back. The 2024 Colorado AI Act (SB 24-205) was repealed and replaced before it ever took effect by SB 26-189, titled “Automated Decision-Making Technology,” which Governor Polis signed on May 14, 2026. The new law trades the old reasonable-care-and-impact-assessment model for a narrower transparency and disclosure regime built around “covered automated decision-making technology (ADMT).” Substantive obligations commence January 1, 2027, by which date the Attorney General must also adopt clarifying rules.

Developer Requirements

Under SB 26-189, developers of covered ADMT must provide each deployer documentation that includes:

• Intended uses and known harmful or inappropriate uses
• The categories of training data, to the extent known
• Known limitations and risks, and circumstances where the ADMT should not be used
• Instructions for appropriate use, monitoring, and meaningful human review
• The information a deployer needs to meet its own obligations

Records are retained for at least three years. No disclosure of proprietary source code, model weights, or trade secrets is required.

Deployer Requirements

Deployers of covered ADMT owe four operational duties, with at least three-year recordkeeping:

• Pre-use notice: clear-and-conspicuous notice before covered ADMT is used to materially influence a consequential decision
• Post-adverse-outcome disclosure within 30 days: a plain-language description of the ADMT’s role plus the consumer’s rights and how to exercise them
• Data correction: on request, access to and correction of factually inaccurate personal data used by the ADMT
• Meaningful human review or reconsideration: on request, to the extent commercially reasonable

The earlier risk-management-program requirement, annual impact assessments, the 90-day Attorney General notification on discovering discrimination, and the standalone “you are interacting with an AI” chatbot disclosure did not survive the rewrite. Discrimination is now addressed under existing Colorado anti-discrimination law, and there is no longer a size-based small-business exemption.

For the full treatment, including the developer and deployer duties in detail, see our Colorado AI Act Complete Compliance Guide.

California: The Privacy Leader Expands to AI

California has no comprehensive AI law equivalent to Colorado’s. What it has instead is a deep stack of privacy rules that keep reaching further into AI, built up over the decade in which the state led the country on data regulation. Several of those rules now land on the same deployment at once:

California Consumer Privacy Act (CCPA/CPRA)

California Automated Decision-Making Technology (ADMT) Regulations

The California Privacy Protection Agency (CPPA) finalized its ADMT, risk-assessment, and cybersecurity-audit regulations, which took effect January 1, 2026. Businesses using ADMT for significant decisions must comply with the applicable ADMT requirements beginning January 1, 2027; later April deadlines apply to specified risk-assessment submissions and cybersecurity-audit certifications. Key provisions:

• Pre-use notice: Detailed disclosure before ADMT is used in significant decisions
• Opt-out rights: Consumers may request human review or alternative processes
• Access to logic: Businesses must explain how automated decisions are made
• Risk assessments: Required for ADMT used in significant decisions and other high-risk processing
• Cybersecurity audits: Annual independent audits for businesses whose processing presents significant risk

The regulations are in force, but their compliance dates differ. Significant-decision ADMT obligations begin January 1, 2027; specified risk-assessment submissions and cybersecurity-audit certifications follow the regulation’s separate phase-in dates. Confirm the schedule and whether the business and processing are in scope.

California enacted and historical AI bills

Status matters: a bill that passed the legislature is not necessarily law. These 2024 examples should not be grouped together as pending proposals:

• SB 1047 (2024): vetoed. The governor returned the frontier-model bill without a signature on September 29, 2024; it is not operative law. Official veto message.
• AB 2013 (2024): chaptered. The generative-AI training-data transparency bill was approved September 28, 2024 as Chapter 817. Official bill status.
• Other California measures: assess each enacted code section, effective date, amendment, and scope individually; do not infer obligations from a bill number or press summary.

Illinois: Biometrics and Employment AI Pioneer

Illinois never set out to regulate AI as such. It regulated biometric data in 2008 and AI-analyzed video interviews from 2020, well before the current wave of bills, and both statutes now sit squarely in the path of ordinary AI deployments:

Illinois Biometric Information Privacy Act (BIPA)

BIPA has generated significant litigation involving facial-recognition and other biometric technologies. It imposes notice, written-release, retention and destruction, disclosure, and security duties on covered biometric identifiers and information; whether a use is lawful depends on the facts and statutory exceptions.

Illinois Artificial Intelligence Video Interview Act (AIVIA)

Illinois Employment AI Legislation

Three further measures build on that base, and each of them widens the disclosure the employer owes:

• HB 3773 (2024): Broader employment AI transparency and discrimination prevention requirements
• Amendments to AIVIA: Expanded disclosure and consent requirements
• Human Rights Act integration: AI discrimination treated as civil rights violation

Texas: TRAIGA Now in Force

Texas, with its large technology sector and business-friendly reputation, has moved from a measured stance to enacting one of the most consequential state AI laws. Texas HB 149, the Texas Responsible Artificial Intelligence Governance Act (TRAIGA), took effect January 1, 2026 and is now live. It prohibits certain AI uses (including intentional discrimination and unlawful manipulation), establishes disclosure obligations for consumer-facing AI, and creates Attorney General enforcement with civil penalties up to $200,000 per violation.

Texas HB 149 (TRAIGA)

Texas Capture or Use of Biometric Identifier Act (CUBI)

Texas Data Privacy and Security Act (TDPSA)

Effective July 1, 2024, the TDPSA includes provisions affecting AI:

• Profiling opt-out: Consumers can opt out of profiling for decisions with legal or significant effects
• Data protection assessments: Required for processing that presents heightened risk, including profiling
• No private right of action: Attorney General enforcement only

Texas AI Advisory Council

Texas established an AI Advisory Council to study AI issues and recommend legislation. Areas under consideration include:

• AI in government decision-making
• AI in healthcare and insurance
• AI workforce implications
• AI safety and security standards

New York: Local and State AI Regulation

New York regulates AI at two levels that do not line up. The city set rules for hiring tools that have been live since 2023. The state set rules for frontier model developers that begin in 2027. The two reach very different populations, and a company can easily be caught by one and untouched by the other:

New York City Local Law 144 (Automated Employment Decision Tools)

Enforcement review. The New York State Comptroller’s December 2, 2025 audit criticized NYC DCWP’s implementation of Local Law 144 and reported problems with complaint routing. The audit and agency response do not, by themselves, establish the volume or likelihood of future investigations; check current DCWP materials for enforcement practice.

New York RAISE Act (frontier AI)

The Responsible AI Safety and Education Act (S6953B / A6453B) was originally signed by Governor Hochul on December 19, 2025; the final chapter amendment was signed on March 27, 2026. It is the second US state frontier-model law (after California SB 53) and takes effect January 1, 2027.

• Scope: Large frontier developers (training-compute and revenue thresholds aligned to SB 53).
• Obligations: Publish safety protocols; report critical incidents to the Department of Financial Services within 72 hours.
• Oversight: A new oversight office within DFS will assess large frontier developers.
• Enforcement: Attorney General may bring civil actions; penalties up to $1 million for first violation, $3 million for subsequent.

Other New York AI legislation

• NY SHIELD Act: data security requirements applicable to AI systems processing personal information.
• NYDFS Insurance Circular Letter No. 7 (2024): AI underwriting and pricing guidance for licensed insurers.
• Healthcare AI bills: requirements for AI in clinical decision-making (pending).

Other State AI Laws and Pending Legislation

The five states above take most of the coverage. The rest of the country has not been idle. Profiling opt-outs sit inside general privacy statutes, several states run separate biometric rules, and a growing number limit what government agencies may deploy on their own account.

States with Privacy Laws Including AI Provisions

States with Biometric/Facial Recognition Laws

States with Government AI Restrictions

The list here is short, and most of it is about facial recognition rather than AI in general:

• California: Restrictions on law enforcement facial recognition
• Massachusetts: Proposed moratorium on government facial recognition
• Maine: Limits on law enforcement use of facial recognition
• Vermont: Restrictions on government AI without human oversight
• Washington: State agency AI accountability requirements

State AI Law Comparison Matrix

Read across the rows rather than down the columns. The same requirement carries different weight in each state, and “None” means the state has no law on that specific point, not that the activity is unregulated by anything else.

Federal context and the preemption push

Congress still has not passed a general AI law. The executive branch moved anyway in late 2025, and that move now shapes how much of the state patchwork survives and how a national program should be planned.

The December 2025 executive order

On December 11, 2025, President Trump signed “Eliminating State Law Obstruction of National Artificial Intelligence Policy.” The order:

• Establishes an AI Litigation Task Force within the Department of Justice to challenge state AI laws on commerce-clause and preemption grounds. (Colorado’s 2024 SB 24-205 had drawn early scrutiny, but the state has since repealed and replaced it with SB 26-189, a state legislative change rather than a federal preemption.)
• Directs the FTC to articulate when state laws “requiring alterations to truthful AI outputs” are preempted by Section 5 of the FTC Act.
• Directs Commerce, to the maximum extent allowed by law, to withhold remaining non-deployment BEAD funds from states identified under the order. It does not condition the entire BEAD program or a fixed $42 billion amount.
• Carves out child-safety, AI-compute and data-center infrastructure, and state procurement from preemption.

A bipartisan coalition of 36 state attorneys general publicly opposed broad federal preemption on 25 November 2025; the Senate previously voted 99 to 1 to strip a similar preemption provision from the budget reconciliation bill, and a rumored FY2026 NDAA moratorium was omitted from the final bill text. No federal statute or court has categorically preempted or paused state AI law; claim-by-claim conflicts and the political contest remain unresolved as of August 26, 2026.

Senate AI Working Group and proposed federal bills

Senator Marsha Blackburn’s TRUMP AMERICA AI Act would codify the executive order into statute and create comprehensive federal AI governance, but remains in committee. The Bipartisan Senate AI Working Group reports continue to be a roadmap document rather than enacted law.

Attorney General Alliance bipartisan AI Task Force

On November 13, 2025, Utah Attorney General Derek Brown and North Carolina Attorney General Jeff Jackson announced a bipartisan AI Task Force through the Attorney General Alliance. The public announcement describes a standing forum to identify issues, share expertise, and develop safeguards; it should not be described as a NAAG body or as coordinating investigations unless a current primary source says so. North Carolina DOJ announcement.

Why no comprehensive federal AI law yet

Bills exist, and some of them have bipartisan sponsors. They stall on four things:

• Partisan disagreement on the regulation-versus-innovation balance.
• Preemption disagreement among governors of both parties (CA, FL, CO) who oppose stripping state authority.
• Definitional challenges in scoping “AI” and “high-risk” applications.
• Jurisdictional complexity across Senate and House committees.

Existing Federal AI-Related Laws

While no comprehensive AI law exists, several federal laws affect AI deployment:

• Civil Rights Act (Title VII): Prohibits employment discrimination, including via AI
• Fair Credit Reporting Act (FCRA): Governs AI used in credit and background checks
• Equal Credit Opportunity Act (ECOA): Prohibits lending discrimination
• Fair Housing Act: Applies to AI in housing decisions
• Americans with Disabilities Act: AI accessibility requirements
• HIPAA: Governs AI processing protected health information

Federal Agency Guidance

Several agencies have set out how they read AI within the rules they already enforce:

• EEOC: Guidance on AI in employment decisions (May 2023)
• FTC: Enforcement actions against deceptive AI practices
• CFPB: Statements on AI in consumer financial services
• FDA: Guidance on AI/ML medical devices
• HHS OCR: AI guidance for HIPAA covered entities

NIST AI Risk Management Framework

The NIST AI RMF, released January 2023, provides a voluntary framework that multiple state laws reference. Colorado’s 2024 AI Act once offered a rebuttable-presumption safe harbor for following NIST AI RMF or ISO/IEC 42001, but SB 26-189 removed it and provided no replacement; the frameworks remain sound governance practice rather than a codified legal defense in Colorado. NIST 1.1 has not yet been released; through 2026 NIST is publishing addenda and profiles, including the Generative AI Profile (NIST AI 600-1, July 2024) and an AI RMF Profile on Trustworthy AI in Critical Infrastructure (concept note released April 7, 2026).

Multi-State Compliance Strategy

The failure mode here is familiar. A control built for one state gets reused in another, and only later does someone notice that the second state asked for something different. The rest of this section is about avoiding that.

Requirement-by-requirement approach

Shared controls can reduce duplicate work, but the “strictest” rule in one state does not automatically satisfy a differently framed duty elsewhere. Build a matrix by system, role, jurisdiction, decision type, effective date, and obligation, then reuse controls only where the legal and operational requirements actually overlap.

Planning pattern

Multi-state AI requirement matrix

1

Organize voluntary risk work

Use NIST AI RMF or another suitable voluntary framework to organize risk work where useful. A framework mapping is not a finding that a state-law duty is satisfied, and SB 26-189 does not retain the former Colorado NIST/ISO safe harbor.

2

Separate assessment and audit duties

California privacy risk assessments, New York City Local Law 144 bias audits, and other assessment duties have different triggers, content, actors, timing, and publication rules. Reuse validated inputs where appropriate, but do not treat one template as satisfying all of them. SB 26-189 no longer mandates the prior Colorado impact assessment.

3

Build rights workflows with jurisdiction flags

Where applicable, support notice, opt-out, correction, explanation or disclosure, appeal, and human-review workflows. Route each request by the actual law, role, decision, consumer, deadline, and exception instead of assuming one national workflow fits every state.

4

Document for Multiple Regulators

Maintain reusable policies, testing results, training records, incident procedures, model or dataset documentation, and a jurisdiction-specific delta log. Adapt the package to the regulator and matter rather than presenting a generic bundle as universally sufficient.

5

Monitor Regulatory Evolution

Establish processes to track new state legislation, regulatory guidance, and enforcement actions. Update compliance programs proactively rather than reactively. Subscribe to AG office updates and industry associations.

Sector-Specific Considerations

Three sectors carry a second layer on top of everything above, and in each case the federal baseline arrived first:

Healthcare AI

• HIPAA compliance remains primary federal requirement
• State health privacy laws may impose additional AI restrictions
• Insurance AI regulations vary significantly by state
• Telehealth AI may trigger multiple state licensing requirements

Employment AI

• NYC LL144 sets high bar for bias auditing
• Illinois AIVIA requires video interview AI disclosure
• Colorado SB 26-189 treats employment as a consequential-decision domain for covered ADMT
• EEOC guidance applies nationally to Title VII compliance

Financial Services AI

• FCRA and ECOA provide federal baseline
• State fair lending laws may be more restrictive
• Insurance AI regulations are state-by-state
• Model risk management (SR 11-7) applies to banks

Frequently asked questions

Key takeaways