US State AI Laws in Force: What an Enterprise Deployer Actually Owes

As of 30 October 2026, the US state AI rules an enterprise deployer actually has to follow today are narrower than most summaries suggest, and the biggest ones have not started yet. In force now: Texas TRAIGA and Illinois HB 3773 (both since 1 January 2026), NYC Local Law 144 bias audits, Utah's generative AI disclosure law, and California's employment rules on automated-decision systems. California SB 53 is also in force, but it binds frontier model developers, not the companies that call their APIs. The two laws that will change a deployer's workload both start on 1 January 2027: California's CCPA rules on automated decisionmaking technology, and Colorado's rewritten AI law.

The headline correction: the Colorado AI Act most people have read about, SB 24-205, has been repealed and replaced. If your compliance plan still says "impact assessments for high-risk AI systems, Colorado, June 2026," it is planning against a law that no longer exists in that form.

Verified as of 30 October 2026 against enacted bill text, official state code publishers and regulator pages. Every date and number below links to its source. Where I could not find a primary document, I left the claim out.

The correction: Colorado's AI Act was rewritten before it started

Colorado passed SB 24-205 in 2024. A 2025 special session bill, SB25B-004, pushed its requirements to 30 June 2026. Then, on 14 May 2026, the Governor signed SB 26-189, which repeals and reenacts the whole of Part 17 under a new name: "Automated Decision-Making Technology in Consequential Decisions."

The new law takes effect 1 January 2027 and "applies to consequential decisions made on or after January 1, 2027". The old vocabulary of high-risk AI systems, risk management programs and annual impact assessments is gone. What replaced it is a transparency and recourse regime:

• Scope. A "covered ADMT" is technology that processes personal data and is "used to materially influence a consequential decision". The covered domains are education, employment, residential real estate in Colorado, financial or lending services, insurance, health care services, and essential government services.
• Exclusions that matter for SaaS. Customer service triage, routine scheduling and workflow management are excluded. So are advertising, marketing, product recommendations, search and content moderation. So is a tool that only summarizes information for a human, as long as it produces no score, ranking or prediction that materially influences the outcome.
• Deployer notice. Before using a covered ADMT to materially influence a consequential decision, the deployer gives a clear and conspicuous notice. A prominent public notice reachable at the point of interaction satisfies this.
• After an adverse outcome. Within thirty days, the deployer explains in plain language what role the ADMT played. It also gives a way to request more detail, including the tool's name, version, developer and the personal data used.
• Consumer rights. The consumer can correct factually incorrect personal data, and can get "meaningful human review and reconsideration" of the decision "to the extent commercially reasonable."
• Developer duties. The developer gives each deployer documentation on intended uses, known harmful uses, training data categories, known limitations and instructions for human review. It must also notify deployers of material updates.
• Records. Both developer and deployer keep compliance records for at least three years.
• Enforcement. The Attorney General enforces exclusively, a violation is a deceptive trade practice, and "nothing in this part 17 creates a new private right of action". Until 1 January 2030, the AG must give a notice and 60 days to cure first, unless the violation was knowing or repeated.

The rules are still being written. The Colorado Department of Law filed proposed rules on 11 August 2026, released an interim draft on 6 October and held its formal hearing on 26 October. The statute requires rules by 1 January 2027, so final text should land close to the start date.

One gap I would not paper over. SB 24-205's delayed start date was 30 June 2026, and its replacement starts on 1 January 2027. SB 26-189's text does not say what, if anything, applied in between. If that window matters to you, it is a question for Colorado counsel, not for a blog post.

Colorado also passed a separate Chatbot Safety Act, HB 26-1263. From 1 January 2027 it requires operators of consumer conversational AI services to disclose that the user is talking to AI, estimate user age, and run a self-harm response protocol. If you ship a consumer-facing chatbot, read it alongside SB 26-189.

The comparison table

Law	Who it binds	What triggers it	Core obligation	Applies from	Enforcement
Texas TRAIGA (HB 149)	Anyone doing business in Texas or serving Texas residents	Prohibited intent: manipulation toward harm, intentional discrimination, CSAM and deepfakes	Do not build or deploy for those purposes. Disclosure duty falls on government agencies and health care providers	1 Jan 2026	AG only, 60-day cure, $10,000 to $200,000 per violation
Illinois HB 3773	Employers	AI used in hiring, promotion, discipline, discharge or other terms of employment	No discriminatory effect, no zip code proxies, notify employees	1 Jan 2026	Illinois Human Rights Act process
NYC Local Law 144	Employers and employment agencies in NYC	An automated employment decision tool screens candidates or employees	Bias audit within a year before use, public summary, 10 business days' notice	Enforced since 5 Jul 2023	DCWP, $500 to $1,500 per violation
Utah Code 13-77	Suppliers in consumer transactions, regulated occupations	Generative AI interacting with a person	Disclose AI when asked. Regulated professions disclose up front for high-risk interactions	7 May 2025	Division of Consumer Protection, up to $2,500 per violation
California FEHA ADS regulations	Employers and their agents, including vendors acting for them	An automated-decision system used in employment decisions	No discriminatory ADS. Anti-bias testing is relevant evidence. Keep ADS data four years	1 Oct 2025	Civil Rights Department and FEHA claims
California SB 53 (TFAIA)	Frontier developers (training above 10^26 operations); large ones above $500M revenue	Training or deploying a frontier model	Publish a frontier AI framework and transparency reports, report critical safety incidents	1 Jan 2026	AG only, up to $1M per violation
California CCPA ADMT regulations	Businesses covered by the CCPA	ADMT replaces or substantially replaces a human in a significant decision	Pre-use notice, opt-out or human appeal, access, risk assessment	1 Jan 2027	California Privacy Protection Agency
Colorado SB 26-189	Developers and deployers doing business in Colorado	ADMT materially influences a consequential decision	Notice, adverse-outcome explanation in 30 days, correction, human review, three-year records	1 Jan 2027	AG only, 60-day cure until 2030

What applies today

Texas TRAIGA: an intent law, not a disclosure law

The Texas Responsible Artificial Intelligence Governance Act was signed on 22 June 2025 and took effect on 1 January 2026. Two details change how a private company should read it.

First, the AI disclosure duty in Section 552.051 is written for a "governmental agency" and for health care providers. It is not a general obligation on private businesses. Second, the prohibitions turn on intent. A person may not develop or deploy AI with the intent to unlawfully discriminate against a protected class, and the statute says "a disparate impact is not sufficient by itself to demonstrate an intent to discriminate". The other prohibitions cover AI built to push people toward self-harm, harming others or crime, AI built with the sole intent of infringing constitutional rights, and AI for child sexual abuse material or illegal deepfakes.

The Attorney General has exclusive enforcement and there is no private right of action. The AG must send written notice and wait 60 days for a cure before suing. Penalties run from $10,000 to $12,000 for a curable violation, $80,000 to $200,000 for an uncurable one, and $2,000 to $40,000 per day for a continuing one. Texas also preempts city and county AI ordinances.

The useful part for a governance program is Section 552.105(e). A defendant is not liable if it found the violation through red-team testing, through feedback, or through an internal review while substantially complying with NIST's Generative AI Profile of the AI Risk Management Framework, or another recognized AI risk framework. That is a statutory reason to run adversarial testing and to keep the evidence. If you already hold or are pursuing ISO 42001, the question for counsel is whether it counts as "another nationally or internationally recognized risk management framework". The statute does not name it.

Illinois HB 3773: effects, not intent

Illinois took the opposite approach to Texas. Since 1 January 2026, 775 ILCS 5/2-102(L) makes it a civil rights violation for an employer to use AI "that has the effect of subjecting employees to discrimination" on a protected basis. Using zip codes as a proxy for a protected class is named specifically. Failing to tell employees that AI is being used for these purposes is a separate violation.

The statute's definition of AI includes generative AI, so an LLM that screens résumés is in scope. The detail of the notice (when, how, in what circumstances) is delegated to rules from the Illinois Department of Human Rights. Check the Illinois Register for the current state of those rules before you finalize your notice.

NYC Local Law 144: the oldest one, and lightly enforced

Local Law 144 of 2021 makes it unlawful for an employer or employment agency to use an automated employment decision tool to screen candidates or employees unless three things are true. The tool had a bias audit "no more than one year prior to the use". A summary of the results is public on the employer's website. Candidates who live in the city got notice at least 10 business days before use, including the option to request an alternative selection process or accommodation.

Penalties are small per violation: up to $500 for a first violation, then $500 to $1,500 for each subsequent one. Each day of non-compliant use counts as a separate violation. The Department of Consumer and Worker Protection began enforcing on 5 July 2023.

The enforcement record is thin, and that is documented. A New York State Comptroller audit published on 2 December 2025 found the department received two complaints between July 2023 and June 2025. Reviewing the same 32 companies, the department identified one instance of non-compliance and the auditors identified at least 17. I would not read that as permission to skip the audit. I would read it as a sign that enforcement is likely to tighten.

Utah: disclose when asked, or up front in regulated work

Utah's rules now sit in Utah Code Chapter 13-77. A supplier using generative AI in a consumer transaction must disclose that the person is talking to AI and not a human, "if the individual asks or otherwise prompts" the question. The ask has to be clear and unambiguous.

Licensed professions carry a stronger duty. In a "high-risk artificial intelligence interaction," meaning one that collects health, financial or biometric data or gives advice relied on for significant personal decisions, the disclosure must be prominent and up front. It is spoken at the start of a voice interaction and written before a text one. Fines run up to $2,500 per violation. There is a safe harbor: disclose clearly at the outset and throughout, and you are not subject to enforcement under the disclosure section.

California employment: your vendor can be the "employer"

California's Civil Rights Council regulations on automated-decision systems took effect on 1 October 2025. They make it unlawful to use an automated-decision system that discriminates on a basis protected by the Fair Employment and Housing Act. Evidence of anti-bias testing, or the lack of it, is relevant to both the claim and the defense. Records, now including automated-decision system data, must be kept for four years.

The line that matters for B2B SaaS is in the definitions. An "agent" includes anyone acting on an employer's behalf in recruiting, screening, hiring, promotion or pay decisions, "including when such activities and decisions are conducted in whole or in part through the use of an automated decision system". An agent of an employer "is also an 'employer'" under the Act. If your product screens candidates for customers, your customers are not the only ones exposed.

California SB 53: it binds your model provider, not you

SB 53, the Transparency in Frontier Artificial Intelligence Act, was signed on 29 September 2025 as Chapter 138 and took effect on 1 January 2026. A "frontier model" is one trained with more than 10^26 integer or floating-point operations. A "frontier developer" is a person who trained one with that compute. A "large frontier developer" also had more than $500,000,000 in annual gross revenue, with affiliates, in the preceding year.

Large frontier developers must publish and follow a frontier AI framework, and face civil penalties of up to $1,000,000 per violation, recovered only by the Attorney General. Frontier developers publish a transparency report when they deploy a new or substantially modified frontier model. They report critical safety incidents to the Office of Emergency Services within 15 days of discovery. If an incident poses an imminent risk of death or serious physical injury, they must tell an appropriate authority, such as law enforcement, within 24 hours.

Calling an API does not make you a frontier developer; the definition turns on your own training compute. The practical use for a deployer is that your model provider now has to publish documents you can cite in your own vendor review.

What arrives on 1 January 2027

California's ADMT regulations

The California Privacy Protection Agency's regulations on automated decisionmaking technology, risk assessments and cybersecurity audits were approved on 22 September 2025 and took effect on 1 January 2026. The ADMT obligations carry their own date. A business already using ADMT for a significant decision must comply "no later than January 1, 2027."

The regulation text defines ADMT as technology that processes personal information and uses computation "to replace human decisionmaking or substantially replace human decisionmaking". A "significant decision" is one that provides or denies financial or lending services, housing, education, employment or contracting opportunities or compensation, or health care. When both conditions hold, the business owes:

• A pre-use notice explaining the ADMT use and the consumer's rights, given at or before collection of the personal information it will process.
• An opt-out, unless the business instead offers an appeal to a human reviewer who understands the output and has authority to overturn the decision.
• A right to access information about the ADMT's use.
• A risk assessment, because using ADMT for a significant decision is listed as a significant-risk activity. Processing already under way must be assessed by 31 December 2027, and 2026 and 2027 assessments are submitted to the agency by 1 April 2028.

The same package sets the first cybersecurity audit deadline at 1 April 2028 for businesses with more than $100,000,000 in 2026 annual gross revenue. That is not an AI obligation, but it lands on the same team.

The human-involvement test is the design decision to get right. Technology does not "substantially replace" a human if the reviewer knows how to interpret the output, actually reviews it alongside other relevant information, and has authority to make or change the decision. Meet all three and you may be outside the ADMT definition. A rubber-stamp review meets none of them.

Colorado SB 26-189

Covered above. The practical difference from California is the trigger. California asks whether the technology replaces a human. Colorado asks whether it "materially influences" a consequential decision. A scoring model that a recruiter always reviews can fall outside California's definition and still be inside Colorado's.

The federal preemption question

On 11 December 2025, the President signed Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence". It directs the Attorney General to set up an AI Litigation Task Force to challenge state AI laws. It asks the Secretary of Commerce for an evaluation of "onerous" state laws. It also calls for a legislative recommendation for a federal framework that preempts conflicting state laws. It names the Colorado algorithmic discrimination law in its opening section.

What the order does not do is repeal or suspend any state statute by its own terms. It sets federal agencies to work on challenges, funding conditions and a bill. Until a court rules or Congress passes something, the state laws above remain the laws you are measured against. I would plan for them as written and track the federal side as a risk to the timeline, not as a reason to wait.

A deployer's checklist

• Inventory decisions, not models. List every place AI output affects hiring, promotion, pay, lending, housing, insurance, education or health care for a person. Both 2027 regimes are keyed to the decision, not the technology.
• Classify each one against both 2027 tests. Does it replace or substantially replace a human (California)? Does it materially influence the outcome (Colorado)? Record the reasoning with a date.
• Design the human review on purpose. A trained reviewer with authority to overturn is California's alternative to an opt-out, and Colorado gives a right to human review anyway. Build it once.
• Write the adverse-outcome explanation now. Colorado gives you thirty days to explain the ADMT's role after an adverse decision. Template it per decision type before 1 January 2027.
• Ask vendors for developer documentation. Colorado developers owe you intended uses, limitations and update notices. Put the request and the update-notice duty into contracts.
• Bias-audit hiring tools. NYC requires an audit within a year before use. California treats anti-bias testing as evidence. Illinois judges effects. One defensible testing program serves all three.
• Notify employees and candidates. Illinois requires notice of AI use in employment. NYC requires 10 business days' notice to city residents. Use one notice that meets the stricter timing.
• Add AI disclosure to customer-facing chat. Utah's safe harbor is a clear disclosure at the outset and throughout. Colorado's chatbot law adds a disclosure duty for consumer chat from 2027.
• Keep evidence for three to four years. Colorado wants three years of records; California's employment rules want four years of ADS data. Set retention to the longer.
• Run and document red-team testing. Texas makes adversarial testing and framework-aligned internal review part of the liability defense.

If you also sell into Europe, much of this overlaps with what the EU AI Act asks of a downstream provider. The employment and credit use cases that trigger Colorado and California are the same ones Annex III treats as high-risk. That is the strongest argument for one inventory and one review process rather than one per jurisdiction.

Frequently Asked Questions

Is the Colorado AI Act in effect?

Not in its 2024 form. SB 24-205 was repealed and reenacted by SB 26-189, signed on 14 May 2026. The replacement takes effect on 1 January 2027 and applies to consequential decisions made on or after that date. It focuses on notice, adverse-outcome explanations, data correction and human review, rather than impact assessments.

Which US state AI laws apply to private companies right now?

As of 30 October 2026: Texas TRAIGA and Illinois HB 3773 (both since 1 January 2026), NYC Local Law 144, Utah's generative AI disclosure law, and California's employment rules on automated-decision systems (since 1 October 2025). California SB 53 is in force but binds only frontier model developers. California's ADMT rules and Colorado's law begin on 1 January 2027.

Does California SB 53 apply to companies that use AI models?

No, not by using them. SB 53 applies to frontier developers, defined by their own training compute above 10^26 operations, with extra duties for those above $500 million in annual revenue. A company that calls a model API does not meet that definition. It can, however, use the frameworks and transparency reports its provider must publish.

When do California's ADMT rules take effect?

The CPPA regulations took effect on 1 January 2026, but businesses using ADMT for significant decisions have until 1 January 2027 to comply. Risk assessments for processing already under way are due by 31 December 2027, with submissions to the agency by 1 April 2028.

Does Texas TRAIGA require disclosing AI use to customers?

Generally not for private businesses. The disclosure duty in Section 552.051 applies to governmental agencies and to health care service providers. For everyone else, TRAIGA prohibits developing or deploying AI with specific harmful intents, enforced only by the Attorney General after a 60-day cure period.

Has the federal government preempted state AI laws?

Not as of 30 October 2026. Executive Order 14365 directs a federal litigation task force to challenge state AI laws and asks for a preemptive federal framework, but it does not void any state statute by its own terms. State laws stay enforceable unless a court rules otherwise or Congress acts.

The question I would start with is not "which states are we in". It is this: where in our product does an AI output change what happens to a specific person, and could we explain that decision to them within thirty days?