US State Laws

US states have moved faster on AI law than the federal government during 2024-2026. By May 2026, Colorado, Texas, California, Utah, Tennessee, Illinois, and New York City all have binding AI statutes or ordinances. The December 2025 federal preemption executive order (see US Federal) signals coming conflict, but in the absence of a federal preemption statute, state laws continue to apply.

This chapter is organised state-by-state, with effective dates and enforcement posture as of May 2026.

Colorado — SB 24-205 (Colorado AI Act)

Colorado’s SB 24-205, signed in May 2024, was originally to take effect 1 February 2026. SB 25B-004 (signed 28 August 2025) delayed the effective date to 30 June 2026, leaving the substantive obligations intact.^[1]

The Act applies to developers and deployers of “high-risk artificial intelligence systems” — AI systems that make, or are a substantial factor in making, consequential decisions affecting consumers in employment, education, financial services, essential government services, healthcare, housing, insurance, or legal services.

Core obligations:

• Developers must provide deployers with a statement describing intended uses, known risks, training-data summaries, performance metrics, mitigation measures, and information needed for impact assessments.
• Deployers must implement a risk-management programme, conduct annual impact assessments, notify consumers when a high-risk AI system is used to make a consequential decision, provide an opportunity to correct data and appeal adverse decisions, and disclose certain incidents to the Attorney General.
• A rebuttable presumption of compliance is available to deployers using risk-management programmes that reasonably conform to recognised frameworks (NIST AI RMF, ISO/IEC 42001).

Enforcement. The Colorado Attorney General has exclusive enforcement authority. There is no private right of action.

Texas — HB 149 (Texas Responsible AI Governance Act, TRAIGA)

Signed 22 June 2025, effective 1 January 2026.^[2] TRAIGA prohibits specific AI uses (e.g., social scoring by government, manipulative AI targeting protected classes), imposes disclosure obligations on AI used in government services, and creates a regulatory sandbox for AI development.

Enforcement is by the Attorney General, with civil penalties of $10,000 to $200,000 per violation. TRAIGA also includes a right-to-cure provision: violations cured within 60 days of notice are not subject to penalty.

California

California is the most active state on AI legislation. Four laws shape the landscape:

SB 53 — Transparency in Frontier Artificial Intelligence Act

Signed 29 September 2025, SB 53 is the first US frontier-model safety statute.^[3] It applies to “large frontier developers” (computational and revenue thresholds) and requires:

• Publishing a frontier AI framework describing how the developer assesses and mitigates catastrophic risks.
• Publishing a safety case before deploying a covered model.
• Reporting critical incidents to the California Office of Emergency Services.
• Whistleblower protections for employees raising safety concerns.

SB 53 deliberately mirrors the substantive structure of the EU GPAI Code of Practice’s Safety & Security chapter, easing dual compliance for developers.

AB 2013 — Training Data Transparency

Effective 1 January 2026. Requires GenAI developers to publish, on the model’s product page, a summary of the training data including data sources, types of data, ownership/licensing, whether personal information was included, and whether copyrighted material was used.

SB 942 — California AI Transparency Act

Originally effective 1 January 2026, postponed by AB 853 to 2 August 2026. Requires covered GenAI providers to offer free AI-detection tools and to embed both visible and metadata-based provenance disclosures in AI-generated content. Aligned with EU AI Act Article 50(2) deadlines, allowing a single technical implementation to satisfy both regimes.

Other California laws

Additional California statutes effective during 2025-2026 cover deepfakes in elections (AB 2655, AB 2839), digital-replica rights for performers (AB 2602, AB 1836), and required disclosures in AI-generated political advertisements.

Utah — SB 226 (amending the Utah Artificial Intelligence Policy Act)

Effective 7 May 2025. SB 226 narrows the original 2024 Utah AI Policy Act:

• GenAI disclosure obligation is now limited to “high-risk AI interactions” rather than all generative AI interactions.
• Adds a safe harbour for organisations whose AI usage is governed by sector-specific regulators (e.g., licensed healthcare providers).
• Narrows the definition of generative AI to clearer technical criteria.

Utah’s revised framework is widely viewed as a more workable template than the original, and may inform similar laws in other states.

Tennessee — ELVIS Act

The Ensuring Likeness Voice and Image Security Act (ELVIS Act) has been in force since 1 July 2024. It extends Tennessee’s right of publicity to cover voice, prohibiting unauthorised AI-generated voice replicas. The Act is most relevant to entertainment and advertising; it has been cited in several voice-cloning enforcement actions during 2025.

Illinois

• HB 3773 (effective 1 January 2026) prohibits employers from using AI that has the effect of subjecting employees to discrimination on the basis of protected classes; requires notice to applicants and employees when AI is used in employment decisions.
• Older provisions of the Artificial Intelligence Video Interview Act continue to apply to AI used in video interviews.

New York City — Local Law 144 (AEDT)

Local Law 144, in effect since 2023, requires employers using automated employment decision tools (AEDTs) to (i) conduct an independent bias audit, (ii) publish a summary of audit results, and (iii) notify candidates before use.

Enforcement status (2026): On 2 December 2025, the New York State Comptroller published an audit finding that the Department of Consumer and Worker Protection (DCWP) had identified only 1 violation while auditors identified 17 — concluding DCWP enforcement had been “ineffective.”^[4] DCWP has committed to proactive 2026 enforcement, and several NYC employer audits are now in process.

Where state law is heading

Two patterns are visible across the 2025-2026 wave of state AI laws:

1. Convergence on the Colorado / Texas template — high-risk classification, deployer-and-developer split, AG enforcement, no private right of action, right-to-cure. Several additional states (Connecticut, New York at the state level, Virginia) have considered similar bills during 2025-2026.
2. Divergent niches — California’s frontier focus (SB 53), Tennessee’s voice-replica focus (ELVIS), New York City’s hiring focus (LL 144), Utah’s “high-risk interaction” disclosure focus — reflecting state-specific industry and political priorities.

Organisations operating across multiple states face a meaningful compliance multiplexing problem. The federal preemption EO (December 2025) signals federal intent to consolidate, but until a federal preemption statute is enacted or courts resolve preemption challenges, multi-state compliance programmes must address each state’s instruments individually.