State AI laws your organization needs to track in 2026

The United States still has no comprehensive federal AI law. What it has is a fast-growing set of state laws, most of them aimed at specific uses. The main targets are decisions about people in employment, lending, housing, insurance, health care and education, AI that talks to consumers, and the largest frontier models. In 2026 alone, state legislatures passed dozens of new AI laws, and many take effect in 2027.

This page lists the laws that matter for most organizations using AI, grouped by when they bite, and then sets out how to track them without running a separate project for every state.

In force now

Texas TRAIGA (since January 1, 2026). The Texas Responsible Artificial Intelligence Governance Act applies to anyone who develops or deploys AI in Texas or offers AI-enabled products to Texans. It prohibits a short list of uses defined by intent, such as AI intended to unlawfully discriminate against a protected class, and requires government agencies and health care providers to disclose AI interactions. The Attorney General enforces it after a 60-day cure period, and an organization that finds a violation through testing or an internal review that substantially complies with the NIST AI RMF Generative AI Profile, or another recognized framework, has a defense.

Illinois AI in employment (since January 1, 2026). Amendments to the Illinois Human Rights Act make it a civil rights violation to use AI in employment decisions in a way that has a discriminatory effect, to use zip codes as a proxy for a protected class, or to fail to tell employees and applicants that AI is being used.

California CCPA regulations (since January 1, 2026). Businesses subject to the CCPA must run and document a risk assessment before starting processing that presents significant risk to consumers’ privacy, which includes using automated decisionmaking technology for a significant decision. The ADMT notice and opt-out duties themselves start in 2027.

California employment ADS rules (since October 1, 2025). The Civil Rights Council’s regulations confirm that an automated-decision system that discriminates on a protected basis breaches the Fair Employment and Housing Act, treat vendors as the employer’s agents, and require four years of automated-decision data.

NYC Local Law 144 (enforced since July 5, 2023). Employers using an automated employment decision tool for New York City candidates need a bias audit within the past year, a published summary and 10 business days’ notice.

State privacy laws. Most states with a comprehensive privacy law give residents a right to opt out of profiling in furtherance of decisions with legal or similarly significant effects, and require a data protection assessment for risky profiling. Connecticut widened those rights from July 1, 2026.

Utah and California SB 53. Utah requires businesses to disclose generative AI to consumers who ask, and regulated professionals to disclose it up front in high-risk interactions. California SB 53 has applied to the largest frontier model developers since January 1, 2026.

Coming in 2027

January 1, 2027. Colorado SB 26-189. Colorado’s law on automated decision-making technology replaced the Colorado AI Act. It covers technology that materially influences consequential decisions in education, employment, housing, financial services, insurance, health care and government services. Developers hand documentation to deployers. Deployers give notice before the decision, explain an adverse outcome within 30 days, and offer data correction and human review.

January 1, 2027. California ADMT rules. Under the CCPA ADMT regulations, a business using technology that replaces or substantially replaces human decision-making in a significant decision must give a pre-use notice, offer an opt-out or a human appeal, and answer access requests about how the technology was used.

January 1, 2027. Frontier model laws in New York and Illinois. New York’s RAISE Act, as amended in March 2026, and the Illinois Artificial Intelligence Safety Measures Act, signed on July 6, 2026, join California SB 53 in requiring the largest frontier developers to publish safety frameworks and report critical safety incidents. Illinois adds independent third-party audits. These reach model developers, not organizations that only use AI.

January 1, 2027 onward. Companion chatbot laws. Several states passed laws in 2026 on AI companions and conversational AI, especially for minors, with start dates through 2027. They matter if you run a consumer-facing chatbot built for ongoing, personal conversation, and most exclude customer service bots.

October 1, 2027. Connecticut AI in employment. Connecticut Public Act 26-15 requires deployers of automated employment-related decision technology to disclose it to people who interact with it and to give written notice before an employment decision, for technology deployed from October 1, 2027. Developers owe deployers the information they need.

The federal picture

Executive Order 14365, signed on December 11, 2025, set up a Justice Department task force to challenge state AI laws, asked Commerce to identify onerous ones, and called for legislation to preempt them. The White House followed with legislative recommendations in March 2026. None of this preempts any state law today. Planning on the assumption that a particular state law will be struck down carries real risk, and child safety and state government use of AI are expressly carved out of the preemption push.

Federal law still applies to AI throughout. Anti-discrimination law covers AI-assisted hiring, the FTC Act covers unfair and deceptive AI practices, and federal agencies follow OMB M-25-21 for their own use.

How to track the laws without a project per state

The state laws differ in their triggers and remedies, but they ask for a surprisingly consistent set of things. An organization that builds these once can read each new law against them.

1. One inventory. List every AI system and agent, including AI inside vendor products, with the business owner, the vendor, and the decisions it touches. Most state laws attach to a use, so the register needs to say which uses each system has. Our guide to building an AI system register covers the fields.
2. Tag the consequential uses. Flag systems that make or materially influence decisions about people in employment, credit and lending, housing, insurance, health care, education and government services. Those are the systems Colorado, California, Connecticut and the state privacy laws reach.
3. Assess against one backbone. Run risk and impact assessments on a recognized framework such as the NIST AI RMF or ISO/IEC 42001, and keep them current as systems change. California’s risk assessments, the state privacy laws’ data protection assessments and Colorado’s developer documentation can all draw on the same work.
4. Get documentation from vendors. Colorado and Connecticut both put developers under a duty to give deployers what they need. Ask for it in contracts and track whether it arrives.
5. Prepare the notices. Pre-use notices, adverse decision explanations and AI disclosures share most of their content. Draft them from the inventory so they stay accurate when a system changes.

Aicura’s register, discovery, assessments, vendor records and policies are built for this kind of work. Pro adds assessments against the NIST AI RMF and ISO/IEC 42001. Aicura gives support and guidance for your own judgment and your advisers’, and it does not decide whether a state law applies to you.