Regulation 11 min read 2026

The US State AI Law Patchwork Is Now Your Problem

Connecticut enacted one of the most comprehensive US state AI laws in May 2026. Colorado repealed and replaced its landmark Act before it ever took effect. Texas's lighter-touch law is now in force. The US state AI patchwork is no longer theoretical, it is a live compliance problem.

AIRiskAware

Specialist AI Risk Governance & Compliance

The US State AI Law Patchwork Is Now Your Problem

Key Takeaways

Connecticut SB 5, the Connecticut Artificial Intelligence Responsibility and Transparency Act, was signed into law by Governor Lamont in late May 2026 after clearing the legislature on 1 May 2026 (House 131-17, Senate 32-4 on 21 April). One of the most comprehensive US state AI laws, it is a multi-part framework covering frontier-model developers, AI companions, generative-AI synthetic content, automated employment-decision technology, and youth online safety, with most provisions effective 1 October 2026 and the remainder phasing in through January 2028. Enforced by the Attorney General, with no private right of action.
Colorado repealed and replaced its AI Act before it took effect: after a federal court froze enforcement in April 2026, Governor Polis signed SB 189 on 14 May 2026, replacing the original framework with a narrower, disclosure-based law effective 1 January 2027.
Texas TRAIGA (HB 149), effective 1 January 2026, takes a lighter-touch, intent-based approach: it prohibits AI used to intentionally discriminate, social-score, or produce certain unlawful content, governs state-agency AI use, and adds disclosure duties for government and healthcare providers - it does not impose Colorado-style impact assessments on most private deployers. Enforced solely by the Texas Attorney General.
California SB 53 (TFAIA, effective January 2026) requires large frontier AI developers to publish safety frameworks and report critical safety incidents. AB 2013 requires developers of generative AI systems to disclose their training data sources. AB 2885 (2025) standardises the legal definition of AI across California law.
The patchwork creates a compliance challenge: requirements vary by state, conflict in places, and are evolving rapidly. Organisations serving multiple US states face genuine complexity.
Federal preemption remains the wild card. Congress has twice rejected bills that would preempt state AI laws. Without federal legislation, the patchwork will continue to grow.
The practical response: map your AI systems against the states where you operate, identify which state laws apply, and build a compliance program that addresses the highest common denominator.

AI-assisted · Editorially reviewed

Key facts, dates and regulatory citations in this article have been checked against primary sources. Not legal advice, always consult a qualified specialist for your specific situation. Spotted an issue? Let us know.

The US AI regulatory landscape in 2026: federal tension, state acceleration

The defining feature of US AI regulation in 2026 is the collision between federal deregulatory ambitions and aggressive state-level legislation. On December 11, 2025, President Trump signed an executive order proposing to preempt state AI laws deemed inconsistent with a "minimally burdensome" federal AI policy. At the same time, state legislatures passed more AI laws in 2025 than in all previous years combined, over 70 AI-related laws enacted in at least 27 states.

The critical legal question, whether an executive order can preempt enacted state legislation without congressional action, remains unresolved. Courts, not the executive order, will ultimately determine the enforceability of state AI laws. Until that question is resolved, organisations should maintain compliance with applicable state laws rather than relying on the executive order as relief.

Colorado AI Act: repealed and replaced before it took effect

Colorado's SB 24-205, the first comprehensive US state AI law, never took effect. After its start date was delayed from February to June 30, 2026, a federal court granted a stay of enforcement on April 27, 2026 in xAI LLC v. Weiser (the US Department of Justice intervened to support the challenge). Then, on May 14, 2026, Governor Polis signed SB 189, which repealed and replaced the original Act outright.

The replacement is a markedly narrower, disclosure-based framework that takes effect 1 January 2027, it drops the original duty of care, the risk-management programmes, and the impact-assessment requirements in favour of notice-and-disclosure obligations. The episode matters beyond Colorado: it shows how quickly a first-in-the-nation AI law can be unwound under industry and federal pressure, and why organisations should anchor governance in durable principles, anti-discrimination, transparency, documentation, rather than any single statute.

Connecticut SB 5: signed into law in May 2026

Connecticut's comprehensive AI bill, SB 5, cleared both chambers of the legislature in May 2026, the Senate on April 21 (32-4) and the House on May 1 (131-17), and was signed into law by Governor Lamont in late May 2026 as the Connecticut Artificial Intelligence Responsibility and Transparency Act ("An Act Concerning Online Safety"), after a similar effort died under his veto threat in 2025. SB 5 is a multi-part framework rather than a single high-risk regime: it imposes obligations on frontier-model developers (those training models above roughly 10^26 operations), operators of AI "companion" systems, developers of general-purpose models that can generate synthetic content, and developers and deployers of automated employment-decision technology, alongside youth online-safety provisions and a regulatory sandbox. Enforcement sits with the Attorney General as an unfair or deceptive trade practice, with no private right of action. Most provisions take effect on 1 October 2026, with the remaining obligations phasing in on staggered dates through January 2028.

Texas TRAIGA: a lighter-touch model now in force

The Texas Responsible Artificial Intelligence Governance Act (TRAIGA, HB 149) took effect on 1 January 2026, making Texas the third state with a comprehensive AI law. The enacted version was scaled back dramatically from its original Colorado-style draft (HB 1709): instead of impact assessments and broad deployer duties, it uses an intent-based liability model. It prohibits developing or deploying AI to intentionally discriminate against a protected class, to enable certain unlawful conduct, or for unlawful biometric capture; it governs state-agency AI use; and it adds disclosure duties for government bodies and healthcare providers. Enforcement is exclusive to the Texas Attorney General, there is no private right of action, through a 60-day notice-and-cure process, with civil penalties that can reach $200,000 per uncurable violation. TRAIGA also creates a regulatory sandbox and preempts local AI ordinances.

NYC Local Law 144: enforcement strengthening

New York City's Local Law 144, requiring annual bias audits for automated employment decision tools and candidate notification, has been enforced since 2023. A December 2025 audit by the NYC Comptroller found DCWP enforcement "ineffective", leading to DCWP shifting to proactive investigations in 2026. Employers using AI hiring tools in NYC should treat Local Law 144 as an active enforcement priority, not a compliance checkbox.

The federal-state tension: what it means for organisations

With the Trump executive order challenged in courts and Congress not having passed a preempting federal AI law, state AI laws remain enforceable. The practical approach for enterprises operating across multiple states: identify the most stringent applicable requirements across all relevant states and build a compliance program that satisfies those requirements. This produces a more robust governance program than a state-by-state approach and positions well for eventual federal legislation. Federal preemption, if it comes, typically establishes floors, not ceilings, for state protection.

Further reading: OECD AI Incidents Monitor