State AI Laws in 2026: What Is in Effect and What Is Coming

If your business uses AI to screen job applicants, answer customers in a chat window, score applications or generate images and video, at least one state law probably already applies to you. Congress has not passed a broad AI law, so states have filled the gap one use case at a time.

This guide maps the state AI laws in effect or enacted as of October 2026: what each requires, who it covers, when it starts and where to read the official text, plus a summary table and a 5-step plan.

This is not legal advice. Confirm details with the official source and your own counsel before acting.

Why state AI laws matter right now

Three trends define 2026. First, states have moved to enforcement: Texas, California and Illinois laws took effect January 1, 2026. Second, most laws target a specific use: consequential decisions (hiring, lending, housing, insurance), chatbots, deepfakes and large “frontier” model developers.

Third, the federal government is pushing back. Executive Order 14365, signed December 11, 2025, directed the US Attorney General to create an AI Litigation Task Force to challenge state AI laws, told the Commerce Department to identify “onerous” state laws, and called for a federal framework that would preempt conflicting state rules while carving out child safety, data center infrastructure and state government procurement. An executive order cannot by itself cancel a state law, so state laws stay enforceable unless Congress preempts them or a court blocks them.

Key takeaway: Federal preemption is a live debate, not settled law. Until a court or Congress says otherwise, plan to comply with the state AI laws that apply to your business.

Rolling out autonomous tools? Our AI agents guide shows where agents touch these rules.

Colorado: the AI Act was replaced, not just delayed

Colorado’s 2024 AI Act (SB 24-205) was due to start February 1, 2026, then a 2025 special session bill (SB 25B-004) pushed it to June 30, 2026. It never took effect as written. In April 2026, xAI sued to block it, the US Department of Justice intervened on xAI’s side, and the court approved an agreement pausing state investigations.

The legislature then passed SB 26-189, signed May 14, 2026, which repeals and reenacts the law as a narrower framework for automated decision-making technology (ADMT):

• Who it covers: Developers and deployers of “covered ADMT,” meaning technology that processes personal data and materially influences a consequential decision about a person in education, employment, housing, lending, insurance, health care or essential government services.
• Developers must: Give deployers technical documentation on intended uses, training data categories, known limitations and human review, and tell them about material updates.
• Deployers must: Give consumers clear notice at the point of interaction and, within 30 days of an adverse decision, a plain-language explanation of the ADMT’s role.
• Consumer rights: Access to the personal data used, correction of inaccurate data, and meaningful human review of adverse decisions.
• Enforcement: The Attorney General, under the Colorado Consumer Protection Act. There is no new private right of action, and until January 1, 2030 the AG must give 60 days’ notice and a chance to cure where possible.
• Effective date: Core duties start January 1, 2027. The Attorney General must adopt implementing rules by then and released an interim draft in October 2026.

California: the largest set of AI rules

The California laws most businesses should know:

• Transparency in Frontier Artificial Intelligence Act (SB 53). Effective January 1, 2026. Large frontier model developers must publish a safety framework, report critical safety incidents to the Office of Emergency Services and protect whistleblowers. The Attorney General enforces civil penalties. It matters mainly to the biggest model labs.
• Generative AI training data transparency (AB 2013). Effective January 1, 2026. Developers of generative AI systems offered to Californians must post documentation about the data used to train them.
• California AI Transparency Act (SB 942). Delayed by AB 853, it became operative August 2, 2026. Large generative AI providers must embed provenance information (latent disclosures) in AI-generated images, video and audio, offer a visible disclosure option and provide a free detection tool. Two 2026 bills, SB 1000 and AB 2713, revise these rules, so check the current text.
• Companion chatbots (SB 243). Effective January 1, 2026. Operators must disclose that users are talking to AI, run protocols for suicidal ideation and self-harm, add break reminders and sexual-content limits for minors, and report on their protocols to the Department of Public Health.
• Employment ADS regulations. The Civil Rights Council’s rules, effective October 1, 2025, confirm that automated-decision systems can violate state anti-discrimination law and require employers to keep automated-decision data for at least 4 years.
• CCPA ADMT regulations. The California Privacy Protection Agency’s regulations took effect January 1, 2026. Businesses that use ADMT to make significant decisions must comply with the ADMT rules (pre-use notices, opt-out and access rights) starting January 1, 2027.

In September 2026, Governor Newsom signed SB 1119 (“Adam’s Law”), adding age assurance, risk assessments, crisis protocols, parental controls and audits for companion chatbots used by children, and a package of worker laws, including SB 947 (no relying solely on automated systems to discipline or fire workers) and AB 1883 (limits on AI workplace surveillance). Most phase in during 2027 or later; check each chaptered bill for its operative date.

Texas, Utah and New York: broad and frontier AI laws

Texas Responsible Artificial Intelligence Governance Act (TRAIGA, HB 149). Signed June 22, 2025 and effective January 1, 2026. It applies to anyone who develops or deploys AI in Texas or offers AI products to Texans. It bans specific intentional misuses: AI designed to encourage self-harm, harm or crime, to unlawfully discriminate, or to produce sexual deepfakes of minors. Government agencies must disclose AI interactions. The Attorney General enforces it, with a 60-day cure period, and a sandbox allows testing for up to 36 months.

Utah Artificial Intelligence Policy Act. In effect since May 2024 and amended in 2025. Under SB 226, businesses must disclose generative AI use when a consumer clearly asks, and proactively in “high-risk” interactions involving sensitive data or financial, legal or health advice. SB 332 extended the law to July 1, 2027. A separate 2025 law, HB 452, sets disclosure, advertising and data rules for mental health chatbots.

New York RAISE Act. Signed in December 2025 and revised by agreed amendments in 2026, the Responsible AI Safety and Education Act applies to large frontier AI developers. They must publish safety and transparency frameworks, report critical safety incidents within 72 hours and register with a new office inside the Department of Financial Services. Compliance starts January 1, 2027.

AI in hiring and the workplace

Employment is where AI rules touch the most small and midsize businesses.

• Illinois Human Rights Act amendment (HB 3773, Public Act 103-0804). Effective January 1, 2026. Employers may not use AI in recruiting, hiring, promotion, discipline or firing in a way that has a discriminatory effect on protected classes, may not use ZIP codes as a proxy for protected traits, and must notify workers when AI is used in these decisions.
• Illinois Artificial Intelligence Video Interview Act. In effect since 2020. Employers that use AI to analyze recorded video interviews must notify candidates, explain how the AI works and get consent.
• New York City Local Law 144. A city law, enforced since July 5, 2023. Employers and agencies using an automated employment decision tool on NYC candidates need a bias audit within the past year, a public audit summary and advance notice to candidates.

Chatbots, deepfakes and digital replicas

Chatbot disclosure and companion AI.

• New York AI companion law: Effective November 5, 2025. Operators must detect signs of suicidal ideation and refer users to crisis services, and remind users they are talking to AI at the start of a session and every 3 hours. The Attorney General enforces it.
• Colorado Chatbot Safety Act (HB 26-1263): Signed May 29, 2026, with operator duties starting January 1, 2027. Public-facing conversational AI services must disclose that they are AI, run self-harm protocols, estimate user age and apply extra protections for known minors.
• Maine (LD 1727): Effective September 24, 2025. Businesses may not use a chatbot in a way that could make a reasonable consumer think they are talking to a human unless they clearly disclose it. Violations fall under the Maine Unfair Trade Practices Act.
• Illinois Wellness and Oversight for Psychological Resources Act (Public Act 104-0054): Effective August 1, 2025. AI may not provide therapy on its own; licensed professionals can use it only for administrative and supplementary support.

Deepfakes and voice cloning. Most states now have sexual or election deepfake laws, and they vary widely. Two notable examples:

• Tennessee ELVIS Act (HB 2091): Effective July 1, 2024. It adds “voice” to Tennessee’s right of publicity and creates liability for distributing tools mainly designed to clone a specific person’s voice or likeness without permission.
• Federal TAKE IT DOWN Act: Not a state law, but it sits on top of them. Since May 19, 2026, covered platforms must remove reported nonconsensual intimate images, including AI-generated ones, within 48 hours, and the FTC is enforcing it.

Summary table of state AI laws

Where to start: a 5-step compliance plan

1. Inventory your AI uses. List every tool that screens people, chats with customers, generates media or feeds a decision about someone. Include vendor tools; most obligations fall on the business that deploys them.
2. Map uses to states. Match each use to where your customers, applicants and employees live. A chatbot serving California, New York, Colorado and Maine users faces 4 different disclosure rules.
3. Fix disclosures first. Clear “you are talking to AI” notices and AI-use notices for job candidates are cheap and cover a lot of ground across states.
4. Add human review and records. Colorado, California and Illinois all reward the ability to explain a decision, correct bad data and have a person reconsider it. Keep logs and vendor documentation; California employers need 4 years of automated-decision records.
5. Pair AI rules with privacy rules. ADMT duties often live inside privacy laws, so read our state data privacy laws guide next. Then set a quarterly review, because dates keep moving.

New to terms like ADMT? See our tech glossary.

The bottom line

State AI law in 2026 is a patchwork, but the pattern is clear: tell people when AI is involved, avoid discriminatory outcomes, protect minors, label synthetic media and offer human review. Colorado’s and New York’s big laws arrive January 1, 2027. Build those habits now and most new laws will need only small adjustments. This is not legal advice.

Sources

• Colorado General Assembly: SB26-189 Automated Decision-Making Technology — Colorado AI Act replacement, duties, enforcement and January 1, 2027 start
• Texas Legislature Online: HB 149 history — TRAIGA signing on June 22, 2025 and January 1, 2026 effective date
• Office of Governor Gavin Newsom: SB 53 signing — California frontier AI law requirements
• California Privacy Protection Agency: CCPA updates and ADMT regulations — ADMT compliance from January 1, 2027
• New York Department of Financial Services: RAISE Act next steps — RAISE Act registration and January 2027 compliance
• Federal Register: Executive Order 14365 — federal effort to challenge and preempt state AI laws