With no comprehensive federal AI statute, US organisations face a growing patchwork of state AI laws whose scope, dates and even existence keep changing: Colorado's 2024 AI Act was repealed and replaced before it ever took effect. This tracker lists the main state and city AI laws that matter to organisations building or deploying AI, with their status as shown on official legislative, governor and attorney general pages on 27 October 2026. It covers comprehensive automated decision laws (Colorado), frontier model safety laws (California, New York), governance and prohibited-use laws (Texas), disclosure laws (Utah), privacy regulator rules on automated decisions (California) and employment tools (New York City), plus the December 2025 federal executive order aimed at state AI laws. It is written for compliance, legal operations, security and AI platform teams that need one view of what applies and when. Deep dives on individual states are linked rather than repeated. Last reviewed: October 2026.
Key takeaways
- Colorado's law changed shape. SB 26-189 repealed and reenacted the 2024 Colorado AI Act as a narrower automated decision-making technology (ADMT) law that takes effect on 1 January 2027, with Attorney General rules still being finalised.
- Frontier model laws are in place in two states. California's SB 53 was signed on 29 September 2025 and New York's RAISE Act on 19 December 2025, both aimed at large frontier developers rather than ordinary deployers.
- Texas is in force. TRAIGA (HB 149) took effect on 1 January 2026, enforced by the Attorney General with a 60-day cure period and penalties up to US$200,000 per uncurable violation.
- Federal action targets state laws but does not itself preempt them. The 11 December 2025 executive order set up an AI Litigation Task Force and funding levers; the White House fact sheet does not say the order displaces state law.
- Most obligations land on identity and records. Notices, explanations, human review, incident reports and audits all need a reliable record of which system, acting under which identity, made or assisted a decision.
Status key
| Status | Meaning in this tracker |
|---|---|
| In force | Obligations apply now |
| Enacted, not yet in force | Signed into law; obligations start on a stated future date |
| Rulemaking | Law in place; implementing rules proposed or in progress |
| Sunset scheduled | Law in force with a stated repeal date unless extended |
| Federal action | Executive or agency measure that affects state laws without being one |
What it is and who it applies to
State AI laws fall into five families. Who is covered depends on the family, not on whether you call yourself an AI company.
- Automated decision laws: developers and deployers of systems used in consequential decisions about people (employment, lending, housing, insurance, education, health care, government services). Colorado is the main example.
- Frontier model safety laws: developers of very large models above compute and revenue or spend thresholds. California SB 53 and New York's RAISE Act.
- Governance and prohibited-use laws: anyone developing or deploying AI in the state, with specific bans and duties for government entities and some sectors. Texas TRAIGA.
- Disclosure laws: businesses that use generative AI to interact with consumers. Utah.
- Privacy regulator and local rules: businesses subject to state privacy law using ADMT (California CPPA regulations), and employers using automated employment decision tools in New York City.
For how these sit alongside the EU AI Act and other national regimes, see the Global AI Regulation Map.
Structure and key requirements
Comprehensive and automated decision laws
| Jurisdiction and law | Status | Key dates | Core obligations | Enforcement |
|---|---|---|---|---|
| Colorado SB 26-189, Automated Decision-Making Technology (repeals and reenacts SB 24-205) | Enacted, not yet in force; Rulemaking | Signed May 2026; takes effect 1 January 2027; Attorney General rule hearing 26 October 2026 | Developers give deployers technical documentation; deployers notify consumers, give a plain-language explanation after an adverse outcome, allow access to and correction of personal data, and offer human review | Attorney General; confirm enforcement route and any private right of action in the enacted text |
| California CCPA regulations on ADMT, risk assessments and cybersecurity audits | In force (phased) | Adopted by the CPPA Board 24 July 2025; approved by OAL 22 September 2025; effective 1 January 2026 | Duties for businesses using ADMT for significant decisions, risk assessments and cybersecurity audits, with later compliance dates for some duties (see the California guide) | California Privacy Protection Agency and Attorney General |
See the Colorado AI Act Guide and the California AI Laws Guide.
Frontier model safety laws
| Jurisdiction and law | Status | Key dates | Core obligations | Enforcement |
|---|---|---|---|---|
| California SB 53, Transparency in Frontier Artificial Intelligence Act | Enacted | Signed 29 September 2025 | Large frontier developers publish a framework describing how they apply national and international standards; critical safety incidents reportable to the Office of Emergency Services; whistleblower protections; CalCompute consortium | Civil penalty enforced by the Attorney General |
| New York RAISE Act (S6953B), Chapter 699 of 2025 | Enacted | Signed 19 December 2025; takes effect on the ninetieth day after becoming law, subject to any later amendment | Large developers (frontier models trained with more than 10^26 operations and over US$100 million compute cost) implement and publish a redacted written safety and security protocol and disclose safety incidents | Attorney General; confirm penalty amounts in the enacted text |
See the Frontier AI Model Risk Frameworks Guide.
Governance, prohibited-use and disclosure laws
| Jurisdiction and law | Status | Key dates | Core obligations | Enforcement |
|---|---|---|---|---|
| Texas HB 149, Texas Responsible Artificial Intelligence Governance Act (TRAIGA) | In force | Effective 1 January 2026 | Prohibited intent-based uses (for example AI intended to incite self-harm or to unlawfully discriminate); disclosure duties for government agencies and health care providers; regulatory sandbox of up to 36 months | Attorney General; 60-day cure; US$10,000 to US$12,000 per curable violation, US$80,000 to US$200,000 per uncurable violation, US$2,000 to US$40,000 per day for continuing violations |
| Utah Artificial Intelligence Policy Act (SB 149 of 2024, amended by SB 226 and SB 332 of 2025) | In force; Sunset scheduled | SB 332 effective 7 May 2025 moved the repeal of Title 13, Chapter 72 to 1 July 2027 | Disclosure of generative AI use when a consumer asks, and up-front disclosure in high-risk interactions by regulated occupations | Division of Consumer Protection |
| New York City Local Law 144 of 2021, automated employment decision tools | In force | Enforced from 5 July 2023 | Bias audit within one year before use, public audit information, notice to candidates and employees | Department of Consumer and Worker Protection |
See the Texas Responsible AI Governance Act (TRAIGA) Guide and the Utah AI Policy Act Guide.
Federal action affecting state laws
| Measure | Status | Date | What it does |
|---|---|---|---|
| Executive order "Ensuring a National Policy Framework for Artificial Intelligence" | Federal action | 11 December 2025 | AI Litigation Task Force to challenge state AI laws; Commerce evaluation of conflicting state laws; conditions on non-deployment BEAD funds; FTC and FCC actions; call for federal legislation that would preempt state AI laws. The White House fact sheet does not state that the order itself preempts state law. |
Identity and NHI requirements
None of these laws names non-human identities, but several obligations cannot be met without controlled machine identities and attributable logs.
- Explanations and human review (Colorado): to explain an adverse outcome and offer human review, a deployer must reconstruct which system, model version and data produced the decision. That needs a distinct identity for each decisioning service and logs that tie decisions to it. See the AI Agent Audit Trails for Regulators Guide.
- Safety and security protocols (California, New York): frontier developers must publish a framework (California) or a safety and security protocol (New York); the security half of either is only credible if access to model weights, training pipelines and the keys that reach them is controlled and logged. See the AI Model Risk Management Guide.
- Incident reporting (California, New York): a credential compromise that exposes model weights or lets someone misuse a model is the kind of event incident reporting is built for. Detection depends on monitoring machine credentials.
- Cybersecurity audits (California CPPA): audits cover access controls, which include service accounts and API keys.
- AI agents acting for consumers: where an agent interacts with consumers (Utah disclosure, Texas health care disclosure), the agent must be identifiable as AI and its actions traceable. See the Agent Identity and Access Guide.
Implementation steps
- Inventory AI uses by state. For each system, record where users, consumers or candidates are located, because most of these laws follow the affected person.
- Classify by law family. Mark consequential decision systems (Colorado, CPPA ADMT), consumer-facing generative AI (Utah, Texas), employment tools (NYC) and any frontier model development (California, New York).
- Pick a common baseline. Build to the strictest overlapping duty: notice, explanation, human review, documentation and logging, then add state-specific items.
- Fix identity and logging first. Unique identities for every decisioning service and agent, owned and least privilege, with decision logs retained for the longest applicable period.
- Write the notices and explanations. Test them with real adverse-outcome cases before the effective date.
- Prepare incident processes. Frontier developers: map California and New York reporting into the security incident process. Others: make sure AI incidents feed existing breach and consumer protection processes.
- Track rulemaking. Colorado Attorney General rules must be adopted before 1 January 2027; adjust once final.
Decision guidance
- National deployers: one baseline across all states is cheaper than per-state variants and survives new laws better.
- Small businesses using vendor AI: focus on contracts: require developer documentation (Colorado), bias audit support (NYC) and logs from the vendor.
- Frontier developers: align the California framework and the New York protocol into one document set, published once and redacted once.
Evidence and assessment
| Evidence | Laws it supports |
|---|---|
| AI system inventory with state exposure and owner | All |
| Developer technical documentation received from vendors | Colorado SB 26-189 |
| Consumer notices, adverse outcome explanations, human review records | Colorado SB 26-189, CPPA ADMT |
| Bias audit report and public summary | NYC Local Law 144 |
| Published frontier framework or safety and security protocol | California SB 53, New York RAISE Act |
| Incident reports and timelines | California SB 53, New York RAISE Act |
| Disclosure screenshots and scripts for AI interactions | Utah, Texas |
| Access reviews for decisioning services, agents and model pipelines | CPPA cybersecurity audits; supports all |
Mapping to other frameworks
- NIST AI RMF: state duties map to Govern (accountability, policies), Map (inventory and context), Measure (bias audits, testing) and Manage (incident response, human review). California SB 53 asks large frontier developers to describe how they incorporate national and international standards. See the NIST AI RMF Guide.
- ISO/IEC 42001: an AI management system provides the inventory, roles, risk assessment and documentation that every state law here needs. See the ISO/IEC 42001 Guide.
- NIST SP 800-53 Rev. 5: AU-2 Event Logging and AU-12 Audit Record Generation for decision logs, AC-6 Least Privilege for decisioning services and agents, IR-6 Incident Reporting for frontier incident duties.
- EU AI Act: organisations operating in both regions can reuse high-risk documentation and logging for Colorado-type duties. See the EU AI Act Compliance Guide.
Common pitfalls
- Planning to a repealed law. Programmes built for Colorado SB 24-205 impact assessments and risk management programmes need re-scoping to SB 26-189.
- Assuming federal preemption has happened. The executive order uses litigation and funding levers; state laws remain in force unless a court or Congress decides otherwise.
- Reading secondary trackers. Law firm and vendor trackers lag and sometimes list bills that died. Check the legislature or Attorney General page.
- Ignoring local law. New York City's employment rule applies regardless of state law.
- Logs that cannot explain a decision. Shared service accounts and missing model version data make adverse outcome explanations impossible.
- Vendor contracts silent on documentation. Deployers cannot meet notice and explanation duties without developer documentation.
What to watch next
- Colorado: final Attorney General ADMT rules before 1 January 2027.
- New York: any chapter amendment to the RAISE Act and its operative dates.
- California: phased CPPA compliance dates and SB 53 implementation by the Office of Emergency Services.
- Utah: whether the legislature extends the 1 July 2027 repeal date.
- Federal: AI Litigation Task Force cases, the Commerce evaluation of state laws and any federal preemption bill.
How to use this tracker
Use the status tables to decide which laws need a project, the identity section to brief security teams, and the evidence table to plan what you must be able to produce. Each row reflects the official source on 27 October 2026; recheck the source before each milestone, because effective dates and scope have already changed in Colorado and Utah. Add new states to your own copy as they pass laws, using the same columns.
Practitioner checklist
- Inventory AI systems with the states and cities whose residents they affect.
- Re-scope any Colorado work from SB 24-205 to SB 26-189.
- Set a single notice, explanation and human review baseline.
- Give every decisioning service and agent its own owned identity.
- Log decisions with system, model version and identity, and retain them.
- Require developer documentation and audit support in vendor contracts.
- Run NYC bias audits for employment tools before use.
- Map frontier incident reporting into the security incident process.
- Recheck official sources quarterly and after each legislative session.
Standards and references
- Colorado General Assembly: SB 26-189 Automated Decision-Making Technology
- Colorado Attorney General: Artificial Intelligence
- Governor of California: Governor Newsom signs SB 53
- California Privacy Protection Agency: CCPA updates, cybersecurity audits, risk assessments and ADMT regulations
- Texas Legislature: HB 149 enrolled text
- Utah Legislature: SB 332 (2025) enrolled
- New York State Senate: S6953B RAISE Act
- The White House: Fact sheet on a national policy framework for AI
Related NHI Mgmt Group resources: California AI Laws Guide · Colorado AI Act Guide · Texas Responsible AI Governance Act (TRAIGA) Guide · Global AI Regulation Map. This guide summarises US state and local AI laws as shown on official sources on 27 October 2026 and is not legal advice.