US AI Laws Tracker

Prohibits developing or deploying AI intended to incite self-harm or crime, unlawfully discriminate, or produce CSAM and non-consensual deepfake imagery, and requires Texas state agencies to disclose AI use. The final Act is far narrower than the original draft: the broad high-risk impact-assessment regime was cut. Documented substantial compliance with the NIST AI RMF is a defence against enforcement.

Developers of frontier models trained above 10^26 FLOPS must publish risk frameworks, report critical safety incidents within 15 days, and maintain whistleblower protections. Penalties up to US$1 million per violation. Signed 29 September 2025.

Any developer of a generative AI system offered in California must publish a summary of the datasets used to train it. Applies far more broadly than SB 53: most products with embedded generative AI offered to Californians should assume relevance.

Covered generative AI providers must offer watermarks, latent disclosures and free detection tools for AI-generated content. Note the date: it lands the same day as the EU AI Act Article 50 transparency duties, making 2 August 2026 a dual-jurisdiction deadline for AI content disclosure.

Privacy-agency rules governing automated decision-making technology for significant decisions about California consumers, with obligations phasing in through 1 April 2027. Sits alongside, not inside, the AI statutes: the trigger is personal information processing.

Colorado repealed its landmark 2024 AI Act before it ever applied and replaced it with a narrower ADMT regime (signed 14 May 2026): notice, explanation, correction and human-review rights after adverse consequential decisions in employment, education, housing, lending, insurance, healthcare and public benefits. The original duty-of-care and annual impact-assessment obligations were dropped. Attorney General rulemaking is pending.

One of the most comprehensive state AI laws enacted so far: a 71-page framework covering subscription transparency, frontier-model whistleblower protections, synthetic-content provenance, automated employment-decision technology, AI companions and youth online safety. Signed 27 May 2026 as Public Act No. 26-15 after passing the Senate 32-4 and the House 131-17. Phased: core provisions 1 Oct 2026, AI companions 1 Jan 2027, AEDT deployer disclosure for deployments from 1 Oct 2027, minors social-media protections 1 Jan 2028. Attorney General enforced under CUTPA; provisions largely exclude private suits.

Employers may not use AI in a way that discriminates against protected classes in recruitment, hiring, promotion, discipline or discharge, and must notify employees when AI is used for such decisions.

Automated employment decision tools used for NYC roles require an independent bias audit within the prior year, a published audit summary, and candidate notice. The longest-running enforced AI hiring rule in the US.

Frontier-model safety and transparency duties for large developers. Signed 19 December 2025 with a chapter amendment agreed 27 March 2026. Check the chaptered text before relying on thresholds; amendments moved during passage.

Generative AI use must be disclosed on request in consumer interactions, and proactively in regulated-occupation (high-risk) interactions. The first state generative-AI statute to commence.

There is no enacted federal AI statute and no enacted preemption of state AI laws. A December 2025 Executive Order directed federal pushback on state laws seen as excessive (naming Colorado), and framework legislation has been floated, but preemption remains a live political push, not settled law. Plan against the state patchwork as it stands.

The de facto US governance baseline. Voluntary everywhere, but Texas TRAIGA makes documented substantial compliance a defence against enforcement, turning RMF alignment from good practice into legal protection in at least one state.

US organisations whose AI systems reach EU users face the Article 50 transparency duties from 2 August 2026 (chatbot disclosure, AI content labelling). High-risk obligations are deferred to 2 December 2027 (Annex III) and 2 August 2028 (Annex I) under the Digital Omnibus, adopted by both co-legislators and signed 8 July 2026, awaiting Official Journal publication.