Library
US State AI Law Tracker
There is no federal AI Act. As of 13 August 2026 the live picture is a state patchwork, led by Colorado’s rewrite (SB 26-189, mostly effective 1 January 2027) and California’s AI Transparency Act (SB 942 / BPC Chapter 25, operative 2 August 2026). Treat every other state’s column as volatile.
Last reviewed
MikeFounder & developer
- US & China
- AI governance
- Compliance
On this page
Who this is for
- Operators with US customers, US staff, or a US entity
- Teams who were told “Colorado is the US AI Act” without checking 2026
- Readers putting US dates on the global calendar
The federal picture
There is no single US federal AI statute as of 13 August 2026. Existing federal law (civil rights, FTC Act section 5, sector rules) still applies to AI systems. Agency activity and litigation over state AI laws are moving faster than Congress. Do not wait for a federal Act, and do not assume a federal Act will pre-empt the table below. Pre-emption is a live political argument, not a settled rule.
This page will go stale first. Cadence is 30–90 days for that reason.
Lead statutes
Colorado: from SB 24-205 to SB 26-189
| Fact | Status as of 13 August 2026 | Source |
|---|---|---|
| Original Colorado AI Act (SB 24-205, 2024) | Risk-based high-risk AI duties. Effective date was pushed to 30 June 2026. Enforcement was stayed in xAI v. Weiser (D. Colo.) in April 2026. | Colorado session law; federal docket as reported in contemporaneous firm notes. We have not independently opened the docket in this review. Treat the stay as widely reported, confirm on PACER before relying on “not enforced”. |
| Replacement (SB 26-189) | Signed 14 May 2026. Repeals and reenacts part 17 of article 1 of title 6 CRS as the Automated Decision-Making Technology rules. | Colorado General Assembly, SB26-189 |
| When SB 26-189 applies | 1 January 2027 for consequential decisions on or after that date (section 5). Some rulemaking and appropriation sections took effect on passage. | SB 26-189 s.5 |
| What it now does | Narrower than 24-205. Developer documentation to deployers (intended uses, training-data categories, limitations, human-review instructions); deployer notices; consumer rights including correction and human review; AG rulemaking by 1 January 2027; three-year record keeping. Drops the original duty-of-care / impact-assessment architecture. | SB 26-189, CRS 6-1-1701 ff. |
| Enforcement of the replacement | AG has indicated, in the stay litigation, an intent not to enforce until rulemaking is done. Status of that commitment as of 13 August 2026 should be re-checked against the AG and the docket. Do not treat “on hold” as a repeal. | Secondary reports of the joint stay; confirm before a board paper |
If you hire, house, lend, insure, or provide essential services in Colorado with ADMT that materially influences a consequential decision, 1 January 2027 is the date on the calendar. Building to the old 24-205 impact-assessment pack is the wrong target.
California: SB 942 (AI Transparency Act)
Codified at Business and Professions Code Chapter 25, sections 22757–22757.6.
- Enacted 2024 (SB 942). Operative 2 August 2026 under section 22757.6, after AB 853 (2025) moved the original 1 January 2026 date and added later-phase duties for platforms and capture devices.
- Covers covered providers: publicly accessible generative AI systems with more than 1,000,000 monthly visitors or users in California, producing image, video or audio.
- From 2 August 2026: free public detection tool; option for a visible (manifest) disclosure; latent provenance disclosure in the file; flow-down to licensees (revoke within 96 hours if a licensee will not comply).
- Civil penalty $5,000 per violation per day, AG / city attorney / county counsel. No private right of action in the chapter as enacted.
- Later phases (2027–2028) for large online platforms and capture-device manufacturers. Check AB 853’s staged dates when those hit your product. As of 13 August 2026 the covered-provider duties are the live ones.
- SB 1000 (2026) has been reported as an active bill that would change the user threshold. Not signed as of our 13 August 2026 check. Do not apply it.
Employment / automated decisions in California sit in a different stack: Civil Rights Council regulations under FEHA on automated-decision systems in hiring and employment, plus CCPA/CPRA automated-decision rules. SB 942 is a content-transparency law. Do not use it as your hiring-compliance page.
Also in the patchwork (not a 50-state digest)
This table is a watch list, not advice that your product is in or out. Re-verify each cell; several 2025–26 bills moved after they were first blogged.
| Jurisdiction | What to check | Note as of 13 August 2026 |
|---|---|---|
| New York City Local Law 144 | Automated employment decision tools: bias audit, notices | Still the practical hiring-AI rule for NYC employers and their vendors. Independent of Colorado. |
| Illinois BIPA | Biometric identifiers | Not an “AI Act”. Catches face and voice templates used in AI features. Private right of action. |
| Other states | Employment disclosure, deepfake, government-use, and ADMT bills | Too many, too fast for a static page to be complete. If you employ or sell in a given state, search that legislature before you ship. |
Questions
Is the Colorado AI Act in force today?
The original SB 24-205 became operative 30 June 2026 on paper; enforcement was stayed. SB 26-189 takes over on 1 January 2027. For planning, use 1 January 2027 and the ADMT text, and confirm the stay/rulemaking position before you tell a board “nothing applies in Colorado this year”.
Does SB 942 catch our internal chatbot?
Usually no. Covered providers are large, publicly accessible generative systems. An internal staff bot is a different analysis (employment rules, CCPA, contracts).
Will Washington pre-empt Colorado and California?
Unknown as of 13 August 2026. Federal litigation and executive action exist. They have not erased BPC Chapter 25 or SB 26-189. Plan for the state duties unless and until a court or statute says otherwise.
What changed
- 13 August 2026: First publication. Cadence: high-risk / fast-moving (30–90 days). This is the most volatile page in the library. Next review due 13 October 2026. Off-cycle on a Colorado AG rule, a signed California amendment, or a ruling in xAI v. Weiser.
Note: This is compliance consulting and training, not legal advice. We work alongside your legal counsel, translating regulation into operational reality rather than replacing them. For a structured pass, see AI compliance.
Was this helpful?
Also in the library
- China's Generative AI Rules: Filing, Labelling, Content ControlPublic generative AI services in China need a CAC security assessment and algorithm filing before launch. Labelling of AI-generated content has been mandatory under the March 2025 Identification Measures and GB 45438-2025 since 1 September 2025. Selling into China is not the same as training or deploying a model there.
- The AI Vendor Risk ChecklistA procurement list you can actually use. Data handling, training-on-your-data, sub-processors, audit rights, and model-change notifications: the clauses that decide whether a vendor is safe to put on a live path.
- What Counts as High-Risk Under Annex IIIAnnex III is a use-case list, not a model list. Most Lathestone clients who over-classify do it because the tool is 'AI'; most who under-classify miss internal HR and customer-decision systems. Article 6(3) exemptions exist. They are narrow, and profiling is not one of them.