State AI laws are the main source of AI-specific rules in the United States, and no federal statute overrides them. By one count from NYU’s Center on Technology Policy, states had enacted 109 AI laws as of 1 July 2026. They cover chatbots, hiring and insurance decisions, frontier-model safety and government use, but there is still This article covers US federal and state law as checked on 10 October 2026.

The picture changed a lot this year. Colorado, the state with the broadest anti-discrimination AI statute, replaced it before it took effect. A presidential order pushed against state rules, yet Congress has not passed preemption.

How the patchwork is built

There is no AI Act equivalent in Washington. What exists is a layer of older federal laws (anti-discrimination, consumer protection, privacy) that apply to AI use, plus new state statutes written specifically for AI. States tend to regulate four things: what a system must disclose, how it can be used in consequential decisions, what frontier developers owe the public, and what chatbots may do around children.

Two federal moves sit on top. In December 2025 an executive order set a policy of “minimally burdensome” standards and told the Department of Justice to set up an AI Litigation Task Force. According to a Cloud Security Alliance research note, the order does not itself preempt anything. Then, in March 2026, the White House sent Congress a nonbinding framework urging preemption of state laws that impose “undue burdens.”

The big state laws at a glance

State Law Covers Status (Oct 2026)
Texas TRAIGA (HB 149) Bans developing or deploying AI with certain harmful intents; government disclosure In effect since 1 Jan 2026
California SB 53 Transparency duties for large frontier developers In effect since 1 Jan 2026
California SB 243 Companion chatbot safeguards, including for minors In effect since 1 Jan 2026
Colorado SB 26-189 (replaced SB 24-205) Notice and explanation for automated decisions in consequential areas Signed 14 May 2026; effective 1 Jan 2027
Illinois HB 3773 AI use in employment decisions and discrimination In effect since 1 Jan 2026
New York City Local Law 144 Bias audits of automated hiring tools In effect since 2023
New York State RAISE Act Frontier-model safety reporting Reported as targeted for 2027

Texas: a law about intent

Texas’s Responsible Artificial Intelligence Governance Act took effect on 1 January 2026. Ashurst Perkins Coie’s summary says it prohibits developing or deploying AI to manipulate people into self-harm, harm to others or crime, to unlawfully discriminate against protected classes, and to produce child sexual abuse material or certain sexually explicit content. Several of those bans turn on a “sole intent” test, which is a high bar. The same summary adds that disparate impact alone does not establish discriminatory intent.

Enforcement belongs to the Texas Attorney General, with no private lawsuits. Civil penalties run from $10,000 to $200,000 per violation depending on whether it can be cured, and some violations carry a 60-day cure window. State and local agencies must also tell people when they are dealing with an AI system.

California: frontier developers and chatbots

California has not passed a general decision-making statute. It has gone after specific targets instead. SB 53, signed 29 September 2025, applies to large frontier developers, described as those with over $500 million in revenue and models trained above a very large compute threshold. Penalties are capped at $1 million per violation, according to the CSA note.

SB 243, the first US law aimed at companion chatbots, also took effect on 1 January 2026. Per TechCrunch’s report, it calls for disclosure that the user is talking to AI, protocols for suicide and self-harm, break reminders for minors, a bar on chatbots posing as health professionals, and blocking minors from sexually explicit images the chatbot produces.

Colorado: the law that was rewritten

Colorado’s 2024 statute, SB 24-205, was the closest thing to an EU-style regime in the US. It was already delayed once, to 30 June 2026. Then, on 9 April 2026, xAI sued to challenge it on constitutional grounds, and the Department of Justice filed a companion complaint on 24 April. According to McDermott Will and Schulte, a 27 April stipulated order stopped the attorney general from enforcing or investigating the law until after the court rules on a preliminary injunction motion, which xAI agreed to hold back until rulemaking or replacement legislation.

The legislature then acted. SB 26-189 was introduced on 1 May and signed on 14 May 2026. It repeals and reenacts the earlier law as a narrower notice-based framework for automated decision-making technology used in consequential decisions, effective 1 January 2027. Consumers must be told when such technology is used, deployers must explain its role within 30 days of an adverse outcome, and people keep rights to correct data and seek human review. The replacement drops impact assessments and the affirmative duty to prevent algorithmic discrimination. The attorney general must offer a 60-day notice-and-cure period before enforcing, a provision that sunsets after three years.

McDermott says xAI and the Department of Justice were expected to challenge the new law as well. I found no later ruling.

Employment, insurance and pricing

Hiring is the most regulated everyday use. Illinois HB 3773, effective 1 January 2026, addresses AI-driven discrimination in employment. New York City’s Local Law 144 has required bias audits of automated employment tools since 2023. Federal anti-discrimination law also applies to these tools.

Insurance and pricing are newer. The Tech Policy Press mid-year review reports that at least six states, including Iowa and Washington, restricted how health insurers use AI, and that Connecticut and Nebraska limited AI-enabled dynamic pricing. That same review observes that broad algorithmic discrimination protections nearly collapsed this year, which fits with Colorado’s retreat.

Chatbots are where states move fastest

The Tech Policy Press review counted more than 100 companion-chatbot bills this year and 14 enacted. Most build on the California and New York laws of 2025: say plainly that the bot is not human and address sexual content involving minors and self-harm. Republican-backed versions more often add age verification and parental supervision. Six Democratic-controlled and eight Republican-controlled states enacted laws on this subject, which is unusual for AI policy.

Can Washington override all of this?

Not yet. A 10-year moratorium on state AI enforcement was stripped from the 2025 budget bill by a Senate vote of 99 to 1. Several drafts since then have circulated, including the Senate’s TRUMP AMERICA AI Act draft and a House draft from Representatives Obernolte and Trahan that would preempt rules aimed at model development for three years. The Washington Legal Foundation’s June 2026 review says none had passed and that Congress is gridlocked.

The executive branch has been slower than its own deadlines. According to that review, only the Justice Department met the March 2026 deadline in the order, by creating its task force in January. Its Colorado intervention is the first test of whether litigation can do what legislation has not.

A practical checklist for anyone building or buying AI

You do not need to track 50 legislatures to get most of the value. Start with where your users and employees are, not where your company is registered, because most of these laws follow the person affected.

  1. List the decisions your AI touches. Hiring, lending, insurance, housing and health care are the areas lawmakers keep returning to.
  2. Add plain disclosures. A visible note that a user is talking to a machine satisfies, or comes close to satisfying, the chatbot laws that exist today.
  3. Keep records of how a system was configured and tested. Colorado’s notice-and-explanation model and Texas’s intent-based bans both reward companies that can show their reasoning later.
  4. Check vendor contracts. Colorado’s replacement law restricts indemnification clauses that shift liability in ways the statute does not allow, per McDermott.
  5. Treat minors separately. Chatbot rules aimed at children are where the most new law is arriving.

None of this requires a lawyer to start, though a lawyer is worth hiring before a product launches into a regulated area.

Related questions

Which states have no AI laws?

The Tech Policy Press review says 21 states had enacted no AI legislation in 2026 as of 1 July, and ten of them still had open sessions. Having no 2026 law does not mean having none overall.

Do these laws apply to small businesses?

It depends. SB 53 reaches only very large frontier developers, while Texas’s prohibitions apply to anyone who develops or deploys a system with the banned intent. Colorado’s replacement applies to those deploying automated decision tools in consequential decisions, with obligations that vary by role.

Who enforces them?

Mostly state attorneys general. Texas and Colorado give no private right of action, while the CSA note says the Illinois employment law has one.

Why dates matter for compliance

Because this field changed several times in six months, check a law’s current text before relying on a summary, including this one. This is general information, not legal advice.

Sources